Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror

Comment Unpopular opinion: But this is just dangerous (Score 1) 69

Full disclosure: I design Class IIb medical equipment for a living and our (really old) manuals are on the site as well. I really love ifixit when it comes down to tear-downs of phones or game consoles, but when I noticed last month they published these service manuals I just thought: "this is insane and really dangerous". I know due to COVID-19, repairs were difficult since access to facilities were blocked and exemptions should be made, but publishing these service manuals online so that your average washing machine repair guy can "try" and repair a medical device is dangerous. The company I work for requires a hands-on training for all repair technicians for the devices we make, and for good reason. Most modern medical devices are complex machines which require proper tools to service and re-certify. A faulty repair can at the least compromise the "essential performance" of the device and at worst kill people. Even trained technicians screw up but at least you minimized the chance of this happening due proper training. Besides the liability point of view (burden of proof will be on the manufacturer) this can be damaging to the general patient population. If the hospital or outpatient clinic decides to save money by going with the cheaper unlicensed (read untrained) service shop there is no guarantee that the repairs are done properly. Most manufacturer these days earn their money on initial sale and disposables, service is just the extra's but you get what you pay for. Basic example: Cheap service shop repairs a medical device as a side gig but fails to properly reconnect all the Protective Earth parts during reassembly. Normally after repairs you would do a full EST review but they are a cheap shop, they skip on the expensive testing tools (like a Electrical Safety Tester) that can test stuff like patient leakage or Earth bonding test. Device is put back into service but accidentally zaps a operator/patient during use due unconnected PE parts. If it was Functional Earth it might not zap anyone but screw up any measurement the device needs to do (erroneous readings) Basic example 2: John Doe (hospital tech), downloaded the service manual of a malfunctioning device. Reads the troubleshooting guide and wiggles some parts and pokes some software parameters in the service menu changing the calibration settings. YaY, the error they were experiencing goes away, back into general use. But the calibration parameters were controlling the flow control of an IVU. Its now give double the output that the is shown on the screen. Nobody will know, since they tech does not have a flow control calibration tool.... until someone dies over overdose. Would you want to have an untrained tech working on a commercial airplane that you fly on and your life depends on its properly operation? I guess you wouldn't, same goes for medical equipment. Side note, which is commercially oriented. Service manuals usually contain complete schematics and BOM of devices for repair purposes. If your device does not heavily rely on software, your competition just got free industrial espionage handed to them making it trivial to copy your device.

Comment COBOL programmers aren't all old (Score 1) 383

There's a COBOL shop in my small town that contracts for corporations and the government. I know several COBOL specialists in their 30s. It's actually an extremely lucrative field to get into these days, with good pay and job security.

Rewriting all that COBOL code in some other language would be bound to cause major problems.

Submission + - Badlock Vulnerability Falls Flat Against Hype (threatpost.com)

msm1267 writes: Weeks of anxiety and concern over the Badlock vulnerability ended today with an anticlimactic thud.

Badlock was the security boogeyman since the appearance three weeks ago of a website and logo branding the bug as something serious in Samba, an open source implementation of the server message block (SMB) protocol that provides file and print services for Windows clients.

As it turns out, Badlock was hardly the remote code execution monster many anticipated. Instead, it’s a man-in-the-middle and denial-of-service bug, allowing an attacker to elevate privileges or crash a Windows machine running Samba services.

SerNet, a German consultancy behind the discovery of Badlock, fueled the hype at the outset with a number of since-deleted tweets that said any marketing boost as a result of its branding and private disclosure of the bug to Microsoft was a bonus for its business.

For its part, Microsoft refused to join the hype machine and today in MS16-047 issued a security update it rated “Important” for the Windows Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD). The bulletin patches one vulnerability (CVE-2016-0128), an elevation of privilege bug in both SAM and LSAD that could be exploited in a man-in-the-middle attack, forcing a downgrade of the authentication level of both channels, Microsoft said. An attacker could then impersonate an authenticated user.

Slashdot Top Deals

Show me a man who is a good loser and I'll show you a man who is playing golf with his boss.

Working...