Safe, Secure, and Effective - What Static Behavior Analysis Reveals About Your Med Devices

The talk argues that medical device security is often framed around vulnerabilities and CVSS scores, when the more useful question is whether a device's software behaves safely and effectively for its clinical purpose. The speaker proposes a "software bill of behaviors": a machine-readable record of what each function in a compiled binary does. The approach comes from research done under ARPA-H, and the work is being carried into the CycloneDX SBOM standard.

The method starts by decompiling firmware. In the example, about 40,000 functions were analyzed and labeled by behavior, such as reading ECG data, sending data over the network, or writing hardware configuration. Those functions were then clustered into clinical subsystems. Public FDA 510(k) summaries were used as reference for what a patient monitor should do. The case study was the Contec CMS8000 patient monitor, with 62 extracted files. It showed 35 wireless functions that were never cleared by the FDA, a hardcoded external address that received patient information, and an NFS-based path that copied and ran remote files. ECG configuration functions were reachable only through the user interface, so they were not a direct remote risk, but any change to them would matter for safety.

The speaker then compared a vendor patch against the original firmware. Only a small share of functions changed, and none of the cyber-relevant behaviors did. The original backdoor remained because it was documented design and removing it could hurt patient care, so compensating controls were needed. One patched listener's call graph changed heavily and required deeper functional checks. The practical takeaway is to classify changes by clinical impact, keep behavior records in a standard format, and check them against the threat model.