{
  "docId": "019dd923-622c-750b-8b96-76efb5813bae",
  "docSlug": "8ff52fe302da",
  "documentTitle": "St. Jude Medical (STJ)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson C. Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2016-08-25 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 4,
  "pageCount": 34,
  "prevPage": 3,
  "nextPage": 5,
  "slideType": "appendix_disclosure",
  "function": "frame_situation",
  "density": "overcrowded",
  "nDataPoints": 1,
  "notes": "This is a disclosure/methodology page from a Muddy Waters research report regarding St. Jude Medical (STJ) device vulnerabilities.",
  "elementsJson": [
    "paragraph",
    "footnote"
  ],
  "metadataConfidence": 0.95,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b96-76efb5813bae/4",
  "deckHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-4",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "As we detail in this report, Muddy Waters believes there is a strong possibility that STJ will need to recall its pacemakers, ICDs, and CRTs while it hardens security of the device ecosystem.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-1ac3-70f9-854e-b3dedd3bf27a",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.03,
        "w": 0.78,
        "x": 0.11,
        "y": 0.81
      },
      "kind": "paragraph",
      "text": "For our purposes, the Cardiac Device ecosystem consists of four components: the implantable device, the Merlin programmer, the STJ network, and the Merlin@home.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "3381a1d5-a35b-4aa9-8c2f-af53137cbfdb",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.09,
        "w": 0.78,
        "x": 0.11,
        "y": 0.58
      },
      "kind": "paragraph",
      "text": "The Merlin@home devices were obtained second hand – often from online vendors. The programmers were obtained via a third party partnership with a licensed physician. The observations regarding device security in this report are derived from the substantial majority of devices studied, and it is possible that newer versions of these devices have some security enhancements that could eliminate some seemingly minor vulnerabilities in those particular devices.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "5ad231f5-e445-49a4-adac-7cefc8f427cb",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.09,
        "w": 0.78,
        "x": 0.11,
        "y": 0.47
      },
      "kind": "paragraph",
      "text": "The devices MedSec studied, and that formed the basis for these conclusions included pacemakers and ICDs; but, did not include CRTs. Because the CRTs are compatible with the compromised Merlin@home devices, this report assumes that they have similar vulnerabilities, and should also be recalled and remediated. (Were the CRTs not to have the expected or similar vulnerabilities, then the products would not need to be recalled.)",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "7f8870c3-b5bf-496a-b964-48b9ddc6546a",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.08,
        "w": 0.78,
        "x": 0.11,
        "y": 0.14
      },
      "kind": "paragraph",
      "text": "In addition to making an investment case, the purpose of this report is to inform device users and their physicians of these risks. MedSec and we believe that users have a right to know that there are serious security problems with their implanted Cardiac Devices, and the related devices. However, we are withholding and redacting technical information that could give potential attackers a roadmap.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "86f7f095-7401-4b79-b461-bf108daff50e",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.08,
        "w": 0.78,
        "x": 0.11,
        "y": 0.37
      },
      "kind": "paragraph",
      "text": "As we detail in this report, Muddy Waters believes there is a strong possibility that STJ will need to recall its pacemakers, ICDs, and CRTs while it hardens security of the device ecosystem. This recall would likely entail a moratorium on sales of these devices, and we estimate this moratorium would be effective for a remediation period of at least two years.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "a130ba36-e2aa-4152-a286-ab2e7ea42764",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.03,
        "w": 0.78,
        "x": 0.11,
        "y": 0.09
      },
      "kind": "paragraph",
      "text": "attacks that could do severe harm to devices and users, and theoretically could be deployed on a large scale.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "aca6c217-ccee-444a-87bf-04dfd3b80d60",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.11,
        "w": 0.78,
        "x": 0.11,
        "y": 0.24
      },
      "kind": "paragraph",
      "text": "We are unaware of any imminent threat to patient safety. However, we believe it is prudent from a security standpoint for STJ to immediately disable the RF capability of patients' implanted devices. Regardless, Cardiac Device users should speak with their physicians about the risks. Muddy Waters is providing the United States Food and Drug Administration and Department of Homeland Security with a version of this report, and expects to facilitate dialogue between the agencies and MedSec.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "aec5c1c9-f3b1-48d2-8023-7908fce253f1",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.07,
        "w": 0.78,
        "x": 0.11,
        "y": 0.69
      },
      "kind": "paragraph",
      "text": "However, even if new generations of devices have some enhancements, we still view the entire ecosystem as greatly compromised. There are likely hundreds of thousands of Merlin@home devices with easily exploitable vulnerabilities in the world, and vulnerable devices are easily purchased online for no more than $35. This train has already left the station.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "b8e69fd2-11a9-4004-9e32-c4e75ee3ee2a",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.04,
        "w": 0.78,
        "x": 0.11,
        "y": 0.88
      },
      "kind": "source-note",
      "text": "7 It would have been illegal to try to validate the ability to commit large scale attacks. 8 The device pictures supra are representative, and are not pictures of the actual devices studied.",
      "attrs": null,
      "subkind": null,
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "2c57623a-2132-41a7-a779-73bff46c03d4",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.02,
        "w": 0.4,
        "x": 0.11,
        "y": 0.77
      },
      "kind": "title",
      "text": "STJ's Compromised Cardiac Device Ecosystem",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "969a21d2-3732-4956-87f0-a7c38b8621f4",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}