Correlation is Not Causation Electrical Analysis of St Jude Implant Shows Normal Pacing

Correlation is Not Causation Electrical Analysis of St Jude Implant Shows Normal Pacing

St. Jude Merlin Error Indicators Are Not Evidence of Malfunction

Battle of the bands: Heres what we listened to while
writing this summary.

Heres an abbreviated technical analysis of some claims by Muddy Waters and St. Jude regarding pacemaker/defibrillator security. We will show you why correlation is not causation in the sense that a scary-looking screen is not a reliable indicator of a clinically relevant security problem. We did this analysis based on our experience over the last ten years analyzing pacemaker and defibrillator security and our experience building cardiac arrhythmia simulators for humanitarian pacemaker reuse. Read more at our ancient research website. Or see our index of previous blog posts on medical device security. This is a fun extracurricular activity for our team at the University of Michigan and Virta Labs, and we may post more thoughts before we return to our regular lives baking hearth breads and helping hospitals with cybersecurity risks.

The Muddy Waters report of August 25 showed a screenshot which they say shows an �apparent malfunction.� They also say that red error marks �are also indicators that the device is malfunctioning.� We were curious about these claims and decided to see if we could produce the same onscreen displays without causing any malfunction. This summary shows the screenshot is correlated with normal pacing and sensing, suggesting that the Muddy Waters report misinterprets clinical relevance of the screenshot.

Figure 1: Our experiment shows that a Merlin programmer screenshot from p. 17 of the Muddy Waters report is not supportive evidence of a successful attack. The top photo shows our reproduction of the Merlin programmer screen photo, but without causing changes to the pacing pulses. Our end-to-end oscilloscope measurements (bottom photo) show that pacing pulses continue normally despite the three benign alerts that are expected when not connected to cardiac tissue. 

Hypothesis: The Merlin programmer screen photo on page 17 of the Muddy Waters report is not supportive evidence of appearing �to have caused the device to pace at a rapid rate.�

Approach: Produce the same on-screen screen output, and externally measure electrical signals to test safety and effectiveness of pacing and sensing.

Result: We reliably produced the same screen output while the implant continued to pace normally.

Material: St. Jude Medical Fortify Assura ICD, Merlin programmer (software version 22.0.1 rev1)

Clinical validation: Verified by Dr. Thomas Crawford, a cardiologist and a clinical electrophysiologist at the University of Michigan Health Systems Frankel Cardiovascular Center.

Commentary:

To verify pacing, we configured the device to emit 40 bpm pacing pulses at 2.5 V, then connected a clipped lead (~20 cm) to the V (IS-1 Bi) sense/pace port, connected an oscilloscope to the clipped lead with 50 ? probes, and visually confirmed that the device was emitting 40 pulses per minute (Figure 1 bottom). To verify sensing, we used a signal generator to produce a 0.5 Hz square wave (consisting of 2 events, a rising then a falling edge, for a total of 1 event per second or 60 pbm) at 2 mV which we fed into the sense/pace port via the same lead; the programmer recognized a 60 bpm beat as expected. We tested other square-wave frequencies between 0.5 Hz and 2 Hz to verify that the sensing worked as expected.

To reproduce the markers that the Muddy Waters report highlights as indicators of a successful attack, we introduced benign electrical noise on the sense/pace port via the clipped lead by connecting the lead to a separately grounded oscilloscope (i.e., not grounded to the �can� of the device, which typically acts as ground). This noise was sufficient to trigger the �VS2� markers on the programmer screen, indicating that the device sensed a �ventricular beat.� While sampling the 40 bpm pacing output as described above, we reproduced the count of three alerts visible in the Muddy Waters report�s screen photo: two alerts from high impedance on two leads (since those were not connected to cardiac tissue), and one indicating �ventricular noise reversion.� The pacing and sensing continued to function normally. ?

The team from the University of Michigan and Virta Labs is continuing to investigate the contrasting claims by Muddy Waters and St. Jude Medical. To receive notifications of updates, follow the Archimedes Center for Medical Device security @ARC_MedSec and @DrKevinFu on Twitter. Virta Labs also plans to issue a separate white paper.

{ Read More }

COUNT column is fast in DB2

COUNT column is fast in DB2

Antonio Cangiano just set up a simple benchmark comparing COUNT(column) performance between untweaked DB2 Express-C and MySQL.

The results:

{ Read More }

Credit Only where Credit is Due

Credit Only where Credit is Due

New Seekers: Beg Steal or Borrow


In the last month or so Marcus and Agata have been in contact with some high rollers.  Or so we thought. By that I mean the couple or (usually) guy with the big house, the fancy car and all the trappings that say:

Yes, Im a successful person.

But in several cases on digging a little deeper the words like Mortgage and Car Lease Plan were divulged.

It used to be that a Mortgage was a way for you to afford to own your own house over a period of some decades, because otherwise youd be renting till almost retirement before your savings were adequate.

Id like to propose a more honest way.

It is that you save up for things that you actually want to own, and by exception only take out loans or Mortgages for items that take a lifetime to pay for.

We are living in dangerous times where because of Government orchestrated almost zero interest rates not just for savers but also for borrowers lifestyles that you cannot rightly afford can be achieved via leveraged borrowing.

The cop out excuse for the many is that:  "But they [the banks] let me borrow it, who was I to say no?"  Often coupled with a sense of entitlement "But I deserve this level of living and luxury".

Here in the UK
Without Mortgage UK people are in debt to over 12K GBP per person. Astonishing

http://www.bbc.co.uk/news/business-38534238


Summary
In 2017 it really is time for people to start living within their means, and to increase their means honestly if they want to afford more.






Talking House: Burning Down the House

{ Read More }

Cracking your knuckles does not actually hurt your bones or cause arthritis The sound you hear is just gas bubbles bursting

Cracking your knuckles does not actually hurt your bones or cause arthritis The sound you hear is just gas bubbles bursting

Cracking your knuckles (or any of your joints) can have therapeutic benefits. When you crack one of your joints you are pulling the bones that are connected at the joint apart from each other. This process stimulates your tendons, relaxes your muscles, and loosens your joints. Chiropractors do this for spinal joints when your back is sore and stiff, but you can do this on your own for your knuckles, toes, knees, neck, etc. 

Unfortunately, there can be too much of a good thing. Cracking your knuckles will never lead to arthritis (despite what your mom keeps telling you), but scientists have discovered that it can cause tissue damage in the affected joints. Knuckle-cracking pulls your finger bones apart which stretches your ligaments. Too much stretching of your ligaments will cause damage to your fingers akin to the arm injuries sustained by a baseball pitcher who throws too many pitches. In addition to making your hand really sore, this ligament damage can also result in reduced grip strength. 

How does this work? Your joints, the places in your body where you can bend, are where your bones intersect and are held together by ligaments. These joints are surrounded by a liquid called synovial fluid. When you stretch your ligaments by pulling the bones apart to crack your knuckles a gas in the synovial fluid escapes and turns into a bubble. This process is called cavitation. Cavitation ends when the bubble eventually bursts, producing that popping sound we know and love. After that, your joints wont be able to crack for another 25-30 minutes while the gas gets reabsorbed into the synovial fluid.

{ Read More }

Countries Where Web 2 0 and Blogging Craze is Popular

Countries Where Web 2 0 and Blogging Craze is Popular

Wondering which countries in the world have the largest number of people following the Web 2.0 and blogging phenomenon. We can get some good pointers indirectly by looking at the traffic of TechCrunch, CNET (for tech, Web 2.0) and ProBlogger (for Blogging).

People who enjoy the latest innovations in the world of web 2.0, tech start-ups and blogging are very likely to be following these sites.

Recently, this widely-read trio embedded the new maps.amung.us mapping widget that displays, in real time, their recent site traffic on a World Map. It was used only on one of their pages but still, its a fairly good indicator of their traffic per country.

Heres a recent snapshot from each of their widgets suggesting the bulk of tech & blogging crazy users is concentrated in North America, Europe, Australia and South / South-East Asia. Russia, China and Africa are not active in these maps probably because these sites primarily cater to English speaking audiences.

TechCrunch Visitors:

CNET Visitors:

Problogger Visitors:

Rafe Needleman adds: I have a love/hate relationship with widgets like whos.amung.us, Feedjit and MyBlogLog. Site managers who are thinking of adding these need to be aware that they can expose information about traffic and users to the general public.

{ Read More }

Copying Is Not Theft Official Version

Copying Is Not Theft Official Version

{ Read More }

Create timer for non windows application in C in which long process is run

Create timer for non windows application in C in which long process is run

There are times when we need to create a timer for our codes, this can be done by following some simple structure like the following:

using System.Threading;

public class WebCrawler
{
 private Timer mTimer;
 
 public void Start()
 {
 mTimer = new Timer(OnTimerTicked, null, 0, 100);
 }

 public void Stop()
 {
 mTimer.Change(Timeout.Infinite, Timeout.Infinite);
 }

 private void OnTimerTicked(object state)
 {
 DoSomethingLong();
 }
}

The problem is the operation implemented in OnTimerTicked may take more than the timer interval (which is 100 milliseconds in the above example) to run. This is not desired as it may lead to memory corruption. The simple way to work around this is to fire the timer only once at the start, which will then invoke OnTimerTicked callback function, at the end of the OnTimerTicked callback, the timer can be reinvoked by calling its change() method, until flag change which cancel the timers ticked operation. This is shown in the following code.

using System.Threading;

public class WebCrawler
{
 private Timer mTimer;
 private bool mIsWorking;
 
 public void Start()
 {
 mIsWorking=true;
 mTimer = new Timer(OnTimerTicked, null, 0, 100);
 }

 public void Stop()
 {
 mIsWorking = false;
 mTimer.Change(Timeout.Infinite, Timeout.Infinite);
 }

 private void OnTimerTicked(object state)
 {
 if(mIsWorking)
 {
 DoSomethingLong();
 mTimer.Change(100, Timeout.Infinite);
 }
 }
}

{ Read More }