Arxan Protects Pacemaker Medical Device

The physicians needed to be able to: Securely read and monitor patient data provided by medical devices and control and monitor the medical devices using a mobile application. The medical device company, however, faced a security challenge from potential tampering by hackers — including the injection or hooking of malicious code and/or attacks on memory — which could compromise the run-time operation of the application, and thereby cause unsafe or improper operation and a potential danger to patient safety

The company’s application was created using Xamarin, and is now protected with Arxan Application Protection. They followed Arxan’s patented and proven approach to protecting applications for healthcare and medical device providers that minimizes threats to patient health and safety by protecting binary code and cryptographic keys, and thereby also ensures the privacy and confidentiality of medical health records used in the application. Arxan “Guards” were inserted into the application binary to harden and tamper-proof the code, detect attacks at runtime, and defend the app. The protection solution is both reactive and proactive. It is able to: repair tampered elements of the software application by replacing them with the original code, provide alerts and “phone home” protocols to monitoring consoles, and react to attacks with exit, fail, and notify functionality. These techniques prevent the disassembly or decompilation of the application or application logic that can expose code and IP. Arxan protection was applied at the post-compile stage by injecting guards into the binary. Once protected, a hacker would only be able to see obfuscated code, or “scrambled junk.” With this approach, the security is “built-In” to the application so it is protected everywhere it resides – on desktops, tablets and/or mobile phones.

• [Data Management - Data Security]
  The pacemaker solution and related mobile app have been successfully protected from attacks. Patient data has remained confidential, and the application has not been tampered with in a manner that jeopardizes patient safety.