Shares of St. Jude fell 5 percent on Thursday after short-selling firm Muddy Waters.
University of Michigan researchers on Tuesday said their own experiments undermine recent allegations of security flaws in St. Jude Medical Inc's pacemakers and other implantable medical devices.
Shares of St. Jude fell 5 percent on Thursday after short-selling firm Muddy Waters and its business partner, cyber security company MedSec Holdings Inc, alleged finding significant security bugs in the company's Merlin@home device for monitoring implanted heart devices. They said the flaws could potentially enable others to remotely speed up the heart devices or drain their power.
The university said its researchers came "to strikingly different conclusions" after generating the conditions reported by Muddy Waters and not finding a security issue.
The team consisted of several leading medical device security researchers and a cardiologist from the university, it said in a release.
Muddy Waters founder Carson Block had shorted St. Jude shares after MedSec recently approached him with results of research it had conducted into the company's medical device security, he said. In an unusual deal, Block said he hired the cyber security firm as a consultant and agreed to pay it a licensing fee for the research and a percentage of any profits from the investment.
The University of Michigan's team reproduced error messages, or signs of a problem, which Muddy Waters cited as evidence of a successful "crash attack" into a home-monitored implantable heart device. But the messages are the same set of errors that display if the device is not properly plugged in, the university said.
"We're not saying the (Muddy Waters) report is false; we're saying it's inconclusive because the evidence does not support their conclusions," said Kevin Fu, University of Michigan associate professor of computer science and engineering and director of the Archimedes Center for Medical Device Security.
St. Jude has called the Muddy Waters report "false and misleading," saying most of the observations applied to older versions of its Merlin@home devices that had not been patched with security upgrades.
Officials at Muddy Waters could not immediately be reached for comment on Tuesday.
(This story has not been edited by NDTV staff and is auto-generated from a syndicated feed.)
Shares of St. Jude fell 5 percent on Thursday after short-selling firm Muddy Waters and its business partner, cyber security company MedSec Holdings Inc, alleged finding significant security bugs in the company's Merlin@home device for monitoring implanted heart devices. They said the flaws could potentially enable others to remotely speed up the heart devices or drain their power.
The university said its researchers came "to strikingly different conclusions" after generating the conditions reported by Muddy Waters and not finding a security issue.
The team consisted of several leading medical device security researchers and a cardiologist from the university, it said in a release.
Muddy Waters founder Carson Block had shorted St. Jude shares after MedSec recently approached him with results of research it had conducted into the company's medical device security, he said. In an unusual deal, Block said he hired the cyber security firm as a consultant and agreed to pay it a licensing fee for the research and a percentage of any profits from the investment.
The University of Michigan's team reproduced error messages, or signs of a problem, which Muddy Waters cited as evidence of a successful "crash attack" into a home-monitored implantable heart device. But the messages are the same set of errors that display if the device is not properly plugged in, the university said.
"We're not saying the (Muddy Waters) report is false; we're saying it's inconclusive because the evidence does not support their conclusions," said Kevin Fu, University of Michigan associate professor of computer science and engineering and director of the Archimedes Center for Medical Device Security.
St. Jude has called the Muddy Waters report "false and misleading," saying most of the observations applied to older versions of its Merlin@home devices that had not been patched with security upgrades.
Officials at Muddy Waters could not immediately be reached for comment on Tuesday.
© Thomson Reuters 2016
(This story has not been edited by NDTV staff and is auto-generated from a syndicated feed.)
