{ "docId": "019dd923-622c-750b-8b96-76efb5813bae", "docSlug": "8ff52fe302da", "documentTitle": "St. Jude Medical (STJ)", "authorId": "51_Muddy_Waters", "authorName": "Carson C. Block", "documentKindSlug": "research-note", "documentKindLabel": "Research note", "sourceTypeSlug": "short_seller", "sourceTypeLabel": "Short seller", "presentationDate": "2016-08-25 00:00:00", "orientation": "portrait", "aspectRatio": 0.77272725, "pageNumber": 14, "pageCount": 34, "prevPage": 13, "nextPage": 15, "slideType": "villain_critique", "function": "name_villain", "density": "overcrowded", "nDataPoints": 0, "notes": "Includes a photograph of a disassembled device with a red box highlighting a 'Removable hard drive'.", "elementsJson": [ "photo", "paragraph", "footnote" ], "metadataConfidence": 1, "imagePath": null, "slideHref": "/slides/019dd923-622c-750b-8b96-76efb5813bae/14", "deckHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckJsonHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json", "deckAnchorHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-14", "components": [ { "bbox": null, "kind": "callout", "text": "We believe the foregoing issues evidence a company that either does not know how to do device security, or does not care about it.", "attrs": null, "subkind": null, "toolName": "Visual emphasis", "toolSlug": "visual-emphasis", "confidence": null, "componentId": "019dd953-1ac3-70f9-8550-06d26b26c81c", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.4, "w": 0.764, "x": 0.118, "y": 0.091 }, "kind": "image", "text": "Disassembled device showing internal components and removable hard drive", "attrs": null, "subkind": "photo", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "9f3d69f2-d72d-4d83-b0c1-2b55e2dfb534", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.05, "w": 0.764, "x": 0.118, "y": 0.539 }, "kind": "paragraph", "text": "We believe the foregoing issues evidence a company that either does not know how to do device security, or does not care about it. Ironically, STJ touts its claimed strength in network security.", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "120c0188-7054-42ec-b5a0-7483eb8bcc9e", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.05, "w": 0.764, "x": 0.118, "y": 0.763 }, "kind": "paragraph", "text": "MedSec was able to review only a small portion of the massive code base, yet it found vulnerabilities on a regular basis. STJ should and could identify and fix these as subset of the MedSec identified vulnerabilities, and new vulnerabilities will likely continue to exist, unless", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "c7a06f5d-e151-4350-be14-3729c562412d", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.08, "w": 0.764, "x": 0.118, "y": 0.662 }, "kind": "paragraph", "text": "Although MedSec has spent considerable time researching STJ's devices (and those of its major competitors), it expects that there are numerous additional security issues with its Cardiac Device ecosystem. MedSec extrapolates this based on the obvious lack of attention to security evident in the devices it has researched. This seeming shoddiness is more likely than not a systemic problem at STJ, rather than an isolated one.", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "cb59dba7-25f3-4585-8597-fda21ead563a", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.065, "w": 0.764, "x": 0.118, "y": 0.59 }, "kind": "paragraph", "text": "It strikes us as bizarre that STJ seems so focused on its internal corporate network, which is arguably its last line of defense (and does nothing to protect against local attacks), while distributing hundreds of thousands of non-secure Merlin@home devices into the homes of its customers.", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "d959414f-58b0-4be5-8e88-bf778a3d4770", "frameworkName": null, "frameworkSlug": null }, { "bbox": null, "kind": "quote", "text": "STJ seems quite proud of its “CTAC” – “Cyber Threat Action Center”. “CTAC’s mission is to identify, protect against, respond to, and enhance resiliency against cyber security threats. Learn how St. Jude Medical fulfills this mission by using threat intelligence to monitor for emerging threats against the healthcare industry and make informed verdicts on events in its SIEM.” — St. Jude Medical (via footnote 16)", "attrs": null, "subkind": null, "toolName": "Authority citation", "toolSlug": "authority-citation", "confidence": null, "componentId": "019dd953-1ac3-70f9-8550-083806523218", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.05, "w": 0.764, "x": 0.118, "y": 0.836 }, "kind": "source-note", "text": "16 STJ seems quite proud of its “CTAC” – “Cyber Threat Action Center”. “CTAC’s mission is to identify, protect against, respond to, and enhance resiliency against cyber security threats...", "attrs": null, "subkind": null, "toolName": null, "toolSlug": null, "confidence": null, "componentId": "b2d6aab7-f9b0-4300-8633-3255438c41c7", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.018, "w": 0.358, "x": 0.118, "y": 0.505 }, "kind": "title", "text": "Incompetence or Indifference?", "attrs": null, "subkind": "headline", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "3c3fc0c5-ea65-4b6e-bfe0-5e2c27b18725", "frameworkName": null, "frameworkSlug": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "imagePathAlt": null, "thumbSrc": null, "thumbSrcAlt": null, "locked": true }