EUVD-2017-14258

Malware in sbrugna...

A week in security (August 28 – September 3)

Last week, we looked at what actions Kronos can perform in the final installment of a 2-part post. We also dived into Locky, again, a ransomware that just made a comeback, and found that its latest variant as of this writing has anti-sandboxing capabilities. This means that once Locky has...

Security of St. Jude Pacemakers

This is a good summary article about the horrible security of St. Jude pacemakers, and the history of the company not doing anything about it...

FDA Demands St. Jude Take Action on Medical Device Security

The U.S. Food and Drug Administration on Wednesday sent Abbott Laboratories a warning letter citing that it had inadequately addressed the security of the maligned Merlin@home Transmitter. The letter promises regulatory action against the healthcare company should vulnerabilities in the device...

CVE-2017-5149

An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability. The identities of the endpoints for the communication channel between the transmitter and St. Jude...

Code injection

An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability. The identities of the endpoints for the communication channel between the transmitter and St. Jude...

CVE-2017-5149

Summary: CVE-2017-5149 concerns the Merlin@home transmitter from St. Jude Medical, affected versions prior to 8.2.2 (RF models EX1150; inductive models EX1100; and EX1100 with MerlinOnDemand). The issue is that the identities of the endpoints for the communication channel between the transmitter ...

CVE-2017-5149

An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability. The identities of the endpoints for the communication channel between the transmitter and St. Jude...

St. Jude Patches Additional Cardiac Device

St. Jude Medical has patched a vulnerability in another Merlin@home Transmitter medical device vulnerable to a man-in-the-middle attack. The medical device maker issued an update on Monday for its Merlin@home Transmitter “inductive” models, expanding the number of devices impacted by a...

Justine Bone on St. Jude Vulnerabilities and Medical Device Security

MedSec CEO Justine Bone talks to Mike Mimoso about the St. Jude Medical vulnerabilities, the considerations her company and Muddy Waters made in short selling St. Jude stock, and the current state of medical device security. Download: JustineBoneonSt.JudeVulnerabilitiesandMedicalDeviceSecurity.mp...

Saying Goodbye to the ShadowBrokers, GoDaddy's Domain Validation Issue, and More

Mike Mimoso and Chris Brook discuss the news of the week, including the ShadowBrokers’ farewell, GoDaddy’s buggy domain validation issue, MongoDB ransoms, and the latest with St. Jude Medical. Show notes: ShadowBrokers Bid Farewell, Close Doors ShadowBrokers Selling Windows Exploits, Attack Tools...

Merlin@home Man-in-the-Middle Security Bypass Vulnerability

St.JudeMedicalMerlin@hometransmitter是美国St.JudeMedical公司的一款用于对植入心脏装置的患者进行远程护理管理的产品. A man-in-the-middle security bypass vulnerability exists in Merlin@home. A remote attacker could exploit this vulnerability to access or affect communications between Merlin.net and the transmitter terminal...

St. Jude Medical Patches Vulnerable Cardiac Devices

St. Jude Medical today released an update for the Merlin@home Transmitter medical device that includes a patch for vulnerabilities made public last year in a controversial disclosure by research company MedSec Holdings and hedge fund Muddy Waters. In a paper published last August, Muddy Waters sa...

ICSMA-17-009-01A_St. Jude Merlin@home Transmitter Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSMA-17-009-01 St. Jude Merlin@home Transmitter Vulnerability that was published January 9, 2017, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 5 -------- MedSec Holdings has identified a channel...

St. Jude Faces New Claim Heart Devices are Hackable

St. Jude Medical is facing fresh allegations its heart implant devices are vulnerable to cyberattacks. The claims were introduced by the defense as part of St. Jude’s defamation lawsuit against short seller Muddy Waters and security firm MedSec. In a legal filing submitted Monday, experts hired b...

FDA, DHS Investigating St. Jude Device Vulnerabilities

The U.S. government has entered into the St. Jude-MedSec-Muddy Waters fray with an investigation into claims St. Jude medical devices are vulnerable to cyberattacks. The Food and Drug Administration and Department of Homeland Security also apparently disapprove of the approach taken by MedSec and...

St. Jude Alleges False Claims, Stock Manipulation in Suit Against Med Sec, Muddy Waters

St. Jude Medical yesterday filed a lawsuit alleging that investment research firm Muddy Waters and healthcare security research company Med Sec made false claims in a report focused on the security of St. Jude products. The report released Aug. 25 warned of potentially catastrophic cybersecurity...

Researchers: MedSec, Muddy Waters Set Bad Precedent With St. Jude Medical Short

Security researchers warn mixing vulnerability disclosures with stock market bets sets a troubling precedent that erodes confidence in the relationship between businesses and white hat hackers who help uncover threats. Researchers are responding to the unprecedented partnership between security...

Pacemaker Hacking Fears Rise With Critical Research Report

Pacemakers, defibrillators and other medical devices made by a leading medical equipment maker are vulnerable to potentially “catastrophic” cyberattacks. With relatively little effort tens of thousands of cardiac devices made by St. Jude Medical are vulnerable to attack, according a report releas...