|
 Shares of St. Jude fell 5 percent on Thursday after short-selling
firm Muddy Waters and its business partner, cyber security company
MedSec Holdings Inc, alleged finding significant security bugs in
the company's Merlin@home device for monitoring implanted heart
devices. They said the flaws could potentially enable others to
remotely speed up the heart devices or drain their power.
The university said its researchers came "to strikingly different
conclusions" after generating the conditions reported by Muddy
Waters.
The team consisted of several leading medical device security
researchers and a cardiologist from the university, it said in a
release.
Muddy Waters founder Carson Block said he shorted St. Jude shares
after MedSec approached him three months ago with results of
research it had conducted into the company's medical device
security.
In an unusual deal, Block said he hired the cyber security firm as a
consultant and agreed to pay it a licensing fee for the research and
a percentage of any profits from the investment.
The University of Michigan's team reproduced error messages, or
signs of a problem, which Muddy Waters cited as evidence of a
successful "crash attack" into a home-monitored implantable heart
device. But the messages are the same set of errors that display if
the device is not properly plugged in, the university said.
"We're not saying the (Muddy Waters) report is false; we're saying
it's inconclusive because the evidence does not support their
conclusions," said Kevin Fu, University of Michigan associate
professor of computer science and engineering and director of the
Archimedes Center for Medical Device Security.
[to top of second column] |
St. Jude has called the Muddy Waters report "false and misleading,"
saying most of the observations applied to older versions of its
Merlin@home devices that had not been patched with security
upgrades.
Muddy Waters issued a statement saying the firm was not surprised
that the result of the research was inconclusive.
"We deliberately did not publish detailed information on the
vulnerabilities, exploits or attacks on the devices in order to
avoid giving the play book to potential attackers," the statement
said. "If anything, this proves that we were responsible with our
disclosure."
(Reporting by Ransdell Pierson; Editing by Frances Kerry and Andrew
Hay)
[© 2016 Thomson Reuters. All rights
reserved.] Copyright 2016 Reuters. All rights reserved. This material may not be published,
broadcast, rewritten or redistributed.
 |
