[mikekij]

My company (W17 hopeful) is working to help med device vendors ensure basic crypto and security practices. I agree with @teuobk below; these problems are not unique to St. Jude.

BTW we're hiring. If you're reading this comment thread, you're probably a great potential team member. Email in profile.

[yoo1I]

I'm only half joking, but can I join to convince the med device vendors who you're helping to make implantable devices that have so little connectivity to not need any crypto?

[manyxcxi]

There are some very valid reasons for basic communications. For example, a doctor can wave a wand over the device and get telemetry info, which is necessary in order to get it tuned to each individual, which takes time and a number of visits. If you have a remote monitor (basically a high powered wand that lives in your house) the doctor can get alerted if you go into defib or have some other episode, or gather that info over time to make better adjustments and decrease the frequency of visits. Changing settings on the device generally needs to be done 'remotely' as well, as you don't likely want a micro USB port in your armpit (or maybe you do).

The problem with most of these devices is that if you can get them to ACK, you can pretty much get them to do whatever you want and the instruction set isn't all that complicated once you've grabbed some data streaming through the air for a little bit.

[mikekij]

You need some connectivity, so some crypto, but your point stands.

[mikekij]

Yes. Email me.

[etendue]

I'd like to speak with you, but I only see a medium link.

[mikekij]

Sorry. Mike at MedCrypt dot co