{ "docId": "019dd923-622c-750b-8b96-76efb5813bae", "docSlug": "8ff52fe302da", "documentTitle": "St. Jude Medical (STJ)", "authorId": "51_Muddy_Waters", "authorName": "Carson C. Block", "documentKindSlug": "research-note", "documentKindLabel": "Research note", "sourceTypeSlug": "short_seller", "sourceTypeLabel": "Short seller", "presentationDate": "2016-08-25 00:00:00", "orientation": "portrait", "aspectRatio": 0.77272725, "pageNumber": 3, "pageCount": 34, "prevPage": 2, "nextPage": 4, "slideType": "other", "function": "diagnose_problem", "density": "overcrowded", "nDataPoints": 0, "notes": "This is a text-heavy research note page. It discusses the collaboration between Muddy Waters and MedSec to expose security flaws in STJ devices.", "elementsJson": [ "paragraph", "footnote" ], "metadataConfidence": 0.9, "imagePath": null, "slideHref": "/slides/019dd923-622c-750b-8b96-76efb5813bae/3", "deckHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckJsonHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json", "deckAnchorHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-3", "components": [ { "bbox": null, "kind": "callout", "text": "The lack of security in the STJ pacemaker and ICD infrastructure stunned MedSec. STJ’s apparent lack of device security is egregious, and in our view, likely a product of years of neglect.", "attrs": null, "subkind": null, "toolName": "Visual emphasis", "toolSlug": "visual-emphasis", "confidence": null, "componentId": "019dd953-1ac3-70f9-854e-6b276e95dca5", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.06, "w": 0.78, "x": 0.11, "y": 0.28 }, "kind": "paragraph", "text": "Dr. Hemal Nayak, a cardio electrophysiologist at the University of Chicago, is recommending his patients unplug their Merlin@home units; and, he is not going to implant STJ devices until the problems discussed in this report are remediated.", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "7f283014-b2de-4ca0-8891-7bf1536c069c", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.16 }, "kind": "paragraph", "text": "The vulnerabilities result from an apparent lack of device security; and, the communication protocols for the Cardiac Device ecosystem – which we believe lacks basic protections such as encryption and authentication – are in fact compromised.", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "9d9113be-859a-4868-a69d-57e26c0a5383", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.46 }, "kind": "paragraph", "text": "MedSec is a cybersecurity research firm focused on the healthcare industry. It contacted Muddy Waters after largely completing an assessment of major manufacturers’ pacemakers and implantable cardioverter defibrillators (“ICDs”).", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "bd909859-ebb4-441b-b061-6fb0743e7264", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "to cause implanted devices to malfunction and harm users. We believe that courts will hold STJ’s lack of security in its Cardiac Device ecosystem is grossly negligent, unless STJ settles the litigation we see as inevitable.", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "d3bb1b85-7619-47a4-ab55-62ab5a4b7cde", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.03, "w": 0.78, "x": 0.11, "y": 0.76 }, "kind": "paragraph", "text": "MedSec has given Muddy Waters multiple demonstrations evidencing how hollow STJ’s device security is. To illustrate the severity of these vulnerabilities, MedSec demonstrated two types of", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "e914d534-80c3-4a2f-8c66-b64f5e69e97b", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.53 }, "kind": "paragraph", "text": "The lack of security in the STJ pacemaker and ICD infrastructure stunned MedSec. STJ’s apparent lack of device security is egregious, and in our view, likely a product of years of neglect.", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "eb98842a-69e2-4503-a48b-fb6d0a3dbf5c", "frameworkName": null, "frameworkSlug": null }, { "bbox": null, "kind": "quote", "text": "Dr. Hemal Nayak, a cardio electrophysiologist at the University of Chicago, is recommending his patients unplug their Merlin@home units; and, he is not going to implant STJ devices until the problems discussed in this report are remediated.", "attrs": null, "subkind": null, "toolName": "Authority citation", "toolSlug": "authority-citation", "confidence": null, "componentId": "019dd953-1ac3-70f9-854e-6e3a4eda5686", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.85 }, "kind": "source-note", "text": "4 Dr. Nayak had been granted an immaterial equity interest in MedSec prior to MedSec reaching its conclusions regarding STJ. 5 MedSec believes this study is the first of its kind. 6 http://www.reuters.com/article/us-cybersecurity-medicaldevices-insight-idUSKCN0IB0DQ20141022", "attrs": null, "subkind": null, "toolName": null, "toolSlug": null, "confidence": null, "componentId": "bc3d95a8-54c3-46bc-8bf5-48fee0d9f4bc", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.02, "w": 0.12, "x": 0.11, "y": 0.42 }, "kind": "title", "text": "Background", "attrs": null, "subkind": "headline", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "77942872-e30a-4c7e-96c6-94e2649de1ed", "frameworkName": null, "frameworkSlug": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "imagePathAlt": null, "thumbSrc": null, "thumbSrcAlt": null, "locked": true }