TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

291 点作者 akehrer大约 9 年前

25 条评论

Avernar大约 9 年前
&quot;Merge says the antivirus froze access to crucial data acquired during the heart catheterization. Unable to access real-time data, the app crashed spectacularly.<p>The company claims that they included proper instructions in their documentation, advising companies to whitelist Merge Hemo&#x27;s folders in order to prevent crashes from happening, so it seems that the whole incident was nothing more than an oversight on the medical unit&#x27;s side.&quot;<p>Here&#x27;s how I read that: The programmers of this piece of software assumed that some I&#x2F;O operation would never fail and when it does the program shits itself. So instead of hardening their software to withstand loss of telemetry gracefully, which would cost time and money for the company, they just give instructions to disable scans on their folder.<p>Odds are good that somewhere this scan will happen (and it did). Either IT doesn&#x27;t read the release notes or goofs the configuration or an antivirus update clears the white list. Might not even be the antivirus that interferes with the telemetry briefly.<p>But instead of having resilient software it&#x27;s &quot;the anitvirus software&#x27;s fault&quot; or &quot;it&#x27;s IT&#x27;s fault&quot; when something goes wrong because of their bad management&#x2F;engineering decision.
评论 #11651602 未加载
评论 #11654009 未加载
评论 #11651568 未加载
评论 #11654585 未加载
评论 #11651887 未加载
评论 #11653142 未加载
评论 #11662618 未加载
11thEarlOfMar大约 9 年前
&#x2F;rant&#x2F;<p>I can&#x27;t tell you how many times we&#x27;ve chased down field problems that ultimately were the result of antivirus scans. It&#x27;s been so bad, that one of the first questions we now ask when we get a tool-down report is &quot;is there antivirus running and what is the configuration?&quot;<p>Bringing Windows into the architecture of any type of capital equipment control system is a bane. A scourge. I mean to say, it really is a misappropriation of software. Imagine, &quot;Yeah, Frank only knows VB, so that&#x27;s what we used for the aircraft&#x27;s cockpit GUI.&quot;<p>&#x2F;xrant&#x2F;
评论 #11650334 未加载
评论 #11650039 未加载
评论 #11650216 未加载
评论 #11654632 未加载
评论 #11651420 未加载
CaptSpify大约 9 年前
<a href="https:&#x2F;&#x2F;xkcd.com&#x2F;463&#x2F;" rel="nofollow">https:&#x2F;&#x2F;xkcd.com&#x2F;463&#x2F;</a><p>The whole structure is wrong. I used to work in medical equipment repair. Windows Embedded is running so many devices it&#x27;s not funny. But it&#x27;s not <i>just</i> Windows that&#x27;s the problem.<p>I put a linux-system on a PACS network to diagnose equipment. It was a headless, and we <i>asked</i> the IT group to block it off from the Internet.<p>Hospital IT: &quot;Does it have antivirus?&quot;<p>Me: &quot;...&quot;
评论 #11650461 未加载
评论 #11650521 未加载
dchichkov大约 9 年前
Let me surprise you, with the code quality that sometimes is running in what is actually &#x27;life-critical&#x27; software.<p>Back in the nineties, I wrote a nice piece of some 300kb of C code, for DOS&#x2F;x86. It was a complete software package, controlling medical equipment that was testing speed of blood coagulation. These tests are crucial in the patient post-operation recovery.<p>This piece of C code had some hardware control code, some statistics, a bit of math, some visualisation, GUI, etc. Normally, you&#x27;d imagine a team of 2-3 people, carefully written test cases, dedicated QA person, and a year of time to write something like it. And independend lab, that would certify the thing. Well... in that case, yes, there was independent certification... but...<p>It was just one developer, and I was 13, when I wrote it ;) During after-school time, in around 4-6 months. And I must say, I still sometimes have chills, when I think of the code quality, and, um, unorthodox solutions of 13-year-old myself. Yes, I&#x27;ve had some years of experience at the time, both writing software and designing hardware, and advice from my parents, who both could write software. But, at the time, I&#x27;ve had zero formal training, aside from reading K&amp;R and PC XT manuals ;). So, you might imagine the code quality ;) Even, no need to imagine, I actually still have it somewhere in the archives :)
评论 #11654522 未加载
评论 #11652050 未加载
pdkl95大约 9 年前
Is it going to take more deaths to convince people to learn from the Therac-25[1]? If you aren&#x27;t designing for <i>safety first</i>, you have no business working on medical devices or anything else that might be a dangerous when it misbehaves.<p>[1] <a href="http:&#x2F;&#x2F;sunnyday.mit.edu&#x2F;papers&#x2F;therac.pdf" rel="nofollow">http:&#x2F;&#x2F;sunnyday.mit.edu&#x2F;papers&#x2F;therac.pdf</a>
评论 #11650632 未加载
iask大约 9 年前
There are a couple of things here from my POV, first - I would replace the head of their IT and any senior IT staff - who seem to look for the quickest-then-cheap solutions. Dumb ducks who don&#x27;t spend the extra time understanding the importance of the infrastructure and the software they install. And also replace the service vendor, if they have one.<p>I&#x27;ve seen this happen time and again, where companies have some 3rd party service vendors who would install AV software on anything they can get their hand on, even a microwave or coffee machine - just to tell the client &quot;my bill is expensive, but you can feel secure, we installed AV&quot;. I despise these folks with a passion.<p>The problem is not Windows. It&#x27;s a lack of knowledge and understanding. Simple.<p>For god&#x27;s sake - it&#x27;s 2016 - dump the Anti Virus software. I am gonna make t-shirts this summer with this ;)
评论 #11652987 未加载
GunboatDiplomat大约 9 年前
Why on earth is medical equipment running standard Windows? This is the ideal location for some basic RTOS or even just an embedded Linux. Seems like a huge cost and risk for no gain.
评论 #11650291 未加载
评论 #11650268 未加载
评论 #11650565 未加载
评论 #11659257 未加载
评论 #11650503 未加载
steven2012大约 9 年前
Antivirus scans are one of those things added on IT checklists to cover their ass whenever something wrong happens.<p>But it rarely is useful. It only causes problems. We&#x27;ve seen so many issues related to virus scans throughout the years it&#x27;s crazy.<p>What&#x27;s better is to lock down the servers with only minimal access. I haven&#x27;t used virus scan on my main desktop for over 10 years because I don&#x27;t click on weird emails and I don&#x27;t go to sketchy websites ever. Sure there&#x27;s the risk of malware from ads I suppose, but I&#x27;m not that worried.
评论 #11650429 未加载
评论 #11651843 未加载
评论 #11652612 未加载
评论 #11650431 未加载
YeGoblynQueenne大约 9 年前
&gt;&gt; The antivirus was configured to scan for viruses every hour, and the scan started right in the middle of the procedure.<p>&gt;&gt; The company claims that they included proper instructions in their documentation, advising companies to whitelist Merge Hemo&#x27;s folders in order to prevent crashes from happening, so it seems that the whole incident was nothing more than an oversight on the medical unit&#x27;s side.<p>So &quot;RTFM&quot;? Not very helpful.
combatentropy大约 9 年前
&gt; they included proper instructions in their documentation, advising companies to whitelist Merge Hemo&#x27;s folders in order to prevent crashes from happening, so it seems that the whole incident was nothing more than an oversight on the medical unit&#x27;s side.<p>And the hospital included full instructions to the software company on how to properly perform a heart transplant, so they were baffled why the programmer just let his teammate die of heart failure.<p>Come on, this kind of stuff should be a zero-configuration hardware-based black box, with its own buttons, screen, etc. --- not something that needs to be (or even can be) connected to something outside the vendor&#x27;s total control.
ezoe大约 9 年前
This situation is even funnier(and sadly very seriously flawed) in Japan.<p>Medical equipment require an authorization to use. Any change to the medical equipment requires another authorization or it&#x27;s prohibited.<p>By &quot;any change&quot; , it includes Windows Update(it changes the system obviously).<p>The result: they use anti-malware software to protect(or rather, believed to protect) unpatched Windows.<p>At least one anti-malware software company(Trend Micro), marketing that their software can protect the medical equipment in such situation.
评论 #11650891 未加载
评论 #11651316 未加载
callesgg大约 9 年前
Putting antivirus on equipment at all indicates a much bigger problem.<p>That the equipment is somehow configured to be susceptible to viruses.
评论 #11650525 未加载
stevetrewick大约 9 年前
From the linked report :<p><i>Based upon the available information, the cause for the reported event was due to the customer not following instructions concerning the installation of anti-virus software; therefore, there is no indication that the reported event was related to product malfunction or defect</i><p>I beg to differ. I&#x27;d consider a momentary loss of file I&#x2F;O due to lock contention causing a machine to require a reboot a shocking defect in - say - a word processor (which, notably, do not have this problem). That this risk is apparently known and the vendor&#x27;s sole mitigation is to document a &#x27;Don&#x27;t do that then&#x27; is absolutely 100% an indication of a product defect, even in the absence of an actual occurrence.
kinai大约 9 年前
this reminds me of IT crowds bomb disposal robot: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=z88b96ECZCE" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=z88b96ECZCE</a><p>just perfect
toomanythings2大约 9 年前
I don&#x27;t think they say this device is controlled by Windows but it must be. Why professional software and instruments even consider using Windows is beyond me.
malbs大约 9 年前
We&#x27;ve had issues with the latest versions of kaspersky. A burst of network activity is almost guaranteed to crash a machine.<p>It took us a while to isolate Kaspersky 10, and it&#x27;s not even any particular component inside of Kaspersky, but only when all features are enabled. We tried different permutations of features to try and isolate the cause of our crashes, but as soon as you have any one feature disabled in, the crashes stop, Very frustrating because ultimately our clients laid the blame at my feet (new software feature, new release, blah blah blah), and not exactly much you can do in the way of hardening against this particular crash, the app generates a burst of network data, and boom, blue screen&#x2F;instant reboot.
coldcode大约 9 年前
I worked at a financial company that ran its production Oracle database servers on Windows in the same network as the staff (no firewall) and ran virus checkers on them. Performance was terrible of course.
angersock大约 9 年前
Okay, seriously, I need to say something, because I doubt most of the people commenting in this thread have ever dealt with either health IT, healthcare software, or any of the related nonsense.<p>There are kinda four flavors of machine setup I ran into while in that field: big server banks for on-site hosting (think huge enterprise VM farms, for data warehousing and record storage and virtual desktop hosting), care provider systems (think like tablets, doctor office computers, nurse workstations, room workstations), cart computers (used for things like running the sonogram or cardiogram equipment, or for other studies), and actual integrated devices (for, say, data collection).<p>The care provider systems are usually comically locked-down, tablets and phones having the meanest management software they can (no apps, limited connectivity, remote wiping, and so forth). Workstations tend to be centrally managed, have images pushed regularly (ha!), and often use AD and smartcards to handle authentication. One place I&#x27;ve seen took this a step further, and basically just booted users directly into a VM hosted on the server farms mentioned earlier. You can&#x27;t use USB devices, you have highly-regulated clipboard access, and so forth--this is done to prevent HIPAA breaches. Which is kinda silly given other workarounds, but whatever makes people feel safe and the CIO happy. These workstations run some enterprise version of Windows, probably 7 Pro. Those silly-long extended service agreements you see on Microsoft? Hospitals are some of the people keeping that alive, and they will pay <i>obnoxious</i> amounts of money for the privilege.<p>The cart computers are typically like the workstations in terms of functionality, but they may have software specific to the device they&#x27;re talking to. They might not be as locked down (e.g., only acting as thin clients to a remote VM), but they are still running Windows.<p>The device computers may run some kind of RTOS. In some cases, they&#x27;ll be running a customized Windows CE installation--which is totally reasonable. There are a lot of good guarantees that that can give a development shop, least of all that they can call up Microsoft instead of StackOverflow and say &quot;Hey, this function does x, it&#x27;s documented as y, and we&#x27;re paying you a lot of money, so what the fuck?&quot;. Windows Embedded (which is I think the successor, am not sure).<p>In all of these cases, <i>Windows itself works pretty damned well</i>.<p>It runs the software everybody needs, it has the enterprise deployment stuff figured out through decades of improvement, and really there is no reason to be scoffing at its choice.<p>Now, if folks have goofed up and thrown a stupid AV policy on the machine, <i>that&#x27;s</i> a different question entirely. Health IT is <i>full</i> to the brim of people basically just punching a clock and being unable to get anything done in a reasonable amount of time. Sometimes, they do awesome things, but mainly they are just custodians standing between doctors and really really stupid policy decisions that seemed good at the time.<p>EDIT: Removed unrelated example at top.
saganus大约 9 年前
Wtf?<p>&quot;The antivirus was configured to scan for viruses every hour, and the scan started right in the middle of the procedure.&quot;<p>Who configures an antiviurs for an hourly scan on a doctor&#x27;s computer?
评论 #11663116 未加载
Kristine1975大约 9 年前
Why is there a virus scanner on a PC inside the operating room?<p>Don&#x27;t tell me that PC is connected to the internet...
评论 #11651279 未加载
billforsternz大约 9 年前
&quot;A critical medical equipment crashed during a heart procedure due to a <i>timely</i> scan triggered by the antivirus software installed on the PC to which the said device was sending data for logging and monitoring.&quot;<p>That should be <i>untimely</i>. The opposite of timely.
firebones大约 9 年前
For what it is worth, Merge is now part of IBM Watson.<p><a href="http:&#x2F;&#x2F;www.merge.com&#x2F;News&#x2F;Article.aspx?ItemID=660" rel="nofollow">http:&#x2F;&#x2F;www.merge.com&#x2F;News&#x2F;Article.aspx?ItemID=660</a><p>Welcome to the Health Cloud Powered by Watson.
fla大约 9 年前
How can a medical device be certified for running on &#x27;user hardware&#x27; (=uncontrolled environment).<p>Something is probably missing from the article. IMO, the device in question wasn&#x27;t critical at all, and a failure could be expected.
fencepost大约 9 年前
I see a bunch of folks talking about whether PCs are connected to the Internet and &quot;why was it running antivirus in the first place?&quot; It&#x27;s called Defense in Depth.<p>It Does Not Matter if the device is connected to&#x2F;able to reach the Internet.<p>First, it probably can reach the Internet in some way simply by being networked. I don&#x27;t think I&#x27;ve ever seen a medical office (can&#x27;t speak about hospitals) where medical diagnostic equipment was on a fully-separate network able only to talk to other network equipment and specified data destinations (PACS servers).<p>Second, I&#x27;m not concerned about unpatched, unprotected machines being infected from the Internet. Odds are they&#x27;re running a restricted version of Windows, with a custom shell and a lot of stuff stripped out. I&#x27;m concerned that they&#x27;re going to be infected by another machine on the network that&#x27;s gotten infected. With all the past SQL Server security issues a decade or more ago, how many people think those SQL Server boxes could be directly reached from outside the local network?<p>The conjunction of those two is that even if you firewall all that stuff off, the PACS servers are still on both networks, and are probably running much more interesting and vulnerable stuff than the device controllers.<p>Sure you can fully wall everything off - it&#x27;s really easy, just do your X-rays onto film, burn your MRIs and ultrasounds onto CDs, and print your EKGs for later scanning. Oh, and listen to people complain about how out-of-date your systems and procedures are.<p>There are other factors that come in as well - sure, every device manufacturer could provide fully bespoke diagnostic displays developed from the ground up in artisanal software shops providing full employment for assembly programmers working on embedded systems, along with cohorts of graphic designers creating glorious steampunk-styled interfaces. That&#x27;s a beautiful dream, keep having it.<p>For the rest of the world, creating a UI on that custom embedded system running on something from RIM&#x2F;Blackberry (yeah, they own QNX) is just going to get them crap from people because of A) how clunky it probably looks and B) How could they even consider allowing direct user interaction with the RTOS that was chosen to ensure that the dangerous bits in contact with patients&#x2F;radiation&#x2F;irradiated patients were safe?<p>There&#x27;s a beautiful world out there somewhere where everything is safe and secure and seamless and updated. The rest of us live in worlds where Joe in Marketing&#x27;s PC gets infected with something that allows an attacker to start scanning the network for unpatched vulnerabilities on any system, which leads to an out-of-date install of IIS on a legacy server that hasn&#x27;t been updated because there&#x27;s no longer a contract with the vendor (or no vendor) but it&#x27;s around because there&#x27;s a statutory requirement to keep the data on that system for 7-10 years.<p>There&#x27;s a lot of ugliness out there. Antivirus is a way to try to ensure that when (not if) some of it hits you the repercussions are minimized.
评论 #11651231 未加载
mtgx大约 9 年前
Microsoft must be relieved this wasn&#x27;t yet another Windows 10 upgrade horror story.