Medical Device 'Jailbreak' Could Help Solve the Dangerous Shortage of Ventilators (arstechnica.com) 116
An anonymous reader quotes a report from Ars Technica: Security researcher Trammell Hudson analyzed the AirSense 10 -- the world's most widely used CPAP -- and made a startling discovery. Although its manufacturer says the AirSense 10 would require "significant rework to function as a ventilator," many ventilator functions were already built into the device firmware. Its manufacturer, ResMed, says the $700 device solely functions as a continuous positive airway pressure machine used to treat sleep apnea. It does this by funneling air into a mask. ResMed says the device can't work as a bilevel positive airway pressure device, which is a more advanced machine that pushes air into a mask and then pulls it back out. With no ability to work in both directions or increase the output when needed, the AirSense 10 can't be used as the type of ventilator that could help patients who are struggling to breathe. After reverse-engineering the firmware, Hudson says the ResMed claim is simply untrue.
To demonstrate his findings, Hudson on Tuesday is releasing a patch that he says unlocks the hidden capabilities buried deep inside the AirSense 10. The patch is dubbed Airbreak in a nod to jailbreaks that hobbyists use to remove technical barriers Apple developers erect inside iPhones and iPads. Whereas jailbreaks unlock functions that allow the installation of unauthorized apps and the accessing of log files and forensic data, Airbreak allows the AirSense 10 to work as a bilevel positive airway pressure machine, a device that many people refer to as a BiPAP. "Our changes bring the AirSense S10 to near feature parity with BiPAP machines from the same manufacturer, boost the maximum pressure output available, and provide a starting point to add more advanced emergency ventilator functionality," Hudson and other researchers wrote on their website disclosing the findings. The researchers say Airbreak isn't ready to be used on any device to treat a patient suffering from COVID-19 -- it's simply to prove that the AirSense 10 does have the ability to provide emergency ventilator functions, and to push ResMed to release its own firmware update that unlocks the ventilator functions.
To demonstrate his findings, Hudson on Tuesday is releasing a patch that he says unlocks the hidden capabilities buried deep inside the AirSense 10. The patch is dubbed Airbreak in a nod to jailbreaks that hobbyists use to remove technical barriers Apple developers erect inside iPhones and iPads. Whereas jailbreaks unlock functions that allow the installation of unauthorized apps and the accessing of log files and forensic data, Airbreak allows the AirSense 10 to work as a bilevel positive airway pressure machine, a device that many people refer to as a BiPAP. "Our changes bring the AirSense S10 to near feature parity with BiPAP machines from the same manufacturer, boost the maximum pressure output available, and provide a starting point to add more advanced emergency ventilator functionality," Hudson and other researchers wrote on their website disclosing the findings. The researchers say Airbreak isn't ready to be used on any device to treat a patient suffering from COVID-19 -- it's simply to prove that the AirSense 10 does have the ability to provide emergency ventilator functions, and to push ResMed to release its own firmware update that unlocks the ventilator functions.
FDA wouldn't allow it... (Score:5, Insightful)
Re:FDA wouldn't allow it... (Score:5, Informative)
Re: (Score:2)
Re:FDA wouldn't allow it... (Score:5, Insightful)
Not just that, but this 'jailbreak' just exposes functionality that was already left in the firmware by the developers - it does not validate that that functionality is intended for the current hardware revision (it might overpressure or otherwise cause harm), nor that the functionality is complete and properly tested, nor that the functionality actually has no bugs in it. This is essentially exposing the medical equivalent of GTAs Hot Coffee and then saying you can risk someones life with it.
Good on the devs for finding it, but this really shouldn't be publicised in this way as a win - the functionality needs to be validated before it can be used.
Re: (Score:1)
saying you can risk someones life with it
Good, we won't bother asking you "would you prefer (a) this rigged up ventilator (b) waiting list", we'll save both our time with the answer you just gave and ask the next guy down.
Re: (Score:2)
Re: (Score:2, Informative)
You have to buy the Airsense BiPAP machine. Which probably costs many thousands of dollars but is physically identical (except for the model number sticker).
Re: (Score:3)
Which is why they specifically said it was being used to pressure the company to "rethink" their assertion that it can't be used. Because as they said, if it was that or dying from no ventilator at all, this may function acceptably as a stopgap. Likely the company just didn't want to assume any possible liability or bad press, so they claimed it couldn't.
Re: (Score:2)
Or more likely they just wanted to make even more money. If they could firmware upgrade existing hardware they wouldn't make anything from it, maybe a little bit from servicing. If they tried to charge for it they would be heavily criticised because people would see them withholding ventilators when it would cost them basically nothing to supply them.
So they just pretend it can't be done and you have to buy the more expensive model.
Re: FDA wouldn't allow it... (Score:2)
Or maybe they use the same control hardware and software for both machines? That way they can save money by only have to write the software once and minimize number of software updates they have to do
Re: (Score:2)
That's what I was implying.
Re: (Score:3)
Re: FDA wouldn't allow it... (Score:5, Informative)
Correct.
Breathing isnâ(TM)t a one-way street, and both CPAP and BiPAP are only capable of adding pressure. They exist to inflate the soft tissues of the _throat_ like a balloon, keeping the _throat_ from obstructing breathing (snoring is one example).
Using a CPAP or BiPAP instead of a real ventilator means a patient get a bit of help breathing in, but they won't be able breathe out. Death is certain.
Re: (Score:3)
But we have anonymous cowards insisting that this must be allowed for desperate patients. When has anonymous coward ever been wrong or lacking in wisdom before?
Re: (Score:2)
Bloody stupid design. Which deity do I attach the electrodes to, to learn them proper-like why to do their worshipper design better.
Even the bloody dinosaurs - well the ancestors of the ones that are still flying around keeping the car polishing industry busy - had unidirectional breathing : in to the lungs for gas exchange, out to air pockets in the abdomen, along air tubes to be ejected into the throat. Does that go through the syrinx - I'd have to check.
Terrible design,
Re: (Score:2)
I’m still trying to decide if the cloaca is a sick joke, or just really, really bad luck. The lungs are a mode of perfection compared to sharing plumbing between their reproductive and multiple waste elimination systems.
Re: (Score:2)
Outside the great apes, does any species indulge in non-reproductive sex? Does any other genus have sexually transmitted infections? (Except by catching them from humans?) I can't think of an example - can you?
Really, you're arguing for substantial re-engineering of the human body to pu
Re: (Score:2)
But my old S9 from Resmed has done this for years and is only marketed as a CPAP not a BIPAP. when I start breathing out it greatly reduces the pressure, and then ramps back up once I start breathing in.
My wife calls it the annoying mode because instead of a soft background whoosh you get a sound more akin to a gasp from the machine.
Need to balance Risks (Score:2)
This is essentially exposing the medical equivalent of GTAs Hot Coffee and then saying you can risk someone's life with it.
Under normal conditions, you would be absolutely right but these are not normal conditions. If the choice ends up between no ventilator and certain death vs. ventilator that may not have all the bugs worked out but might just do the job the choice is clear.
It might not be the best way to avoid lawsuits but, given the right conditions, it may be the best way to save lives and that's really the point.
Re: (Score:2)
Not just that, but this 'jailbreak' just exposes functionality that was already left in the firmware by the developers - it does not validate that that functionality is intended for the current hardware revision (it might overpressure or otherwise cause harm), nor that the functionality is complete and properly tested, nor that the functionality actually has no bugs in it..
They may have simply used software designed for the ventilator in the CPAP machine since they were familiar with it and it was easily adapted. As you pointed out, the CPAP hardware, despite being technically able to use the functionality may not do so in a safe manner. Besides the FDA, the manufacturer may want to avoid the risk of being sued when someone dies using their machine.
Re: (Score:2)
Thanks for a little sanity!
As a CPAP user I could see how, while my machine might act like it, the hardware would not stand-up to day-in-day out 24/7 operation without a breakdown. CPAP hardware only has to run several hours a night and then it gets a nice long rest, unlike a ventilator.
I wouldn't rely on a cpap for that type of operation.
Re: (Score:2)
But as another xPAP user, it's amazing how reliable these devices really are. My province pays 75% of the price of a machine for me every 5 years. I'm into my 4th, and never had an in-service failure. And they're in use more than several hours a day. If you're one of these people that claims to get by on 4 hours of sleep per night, I wonder what your life expectancy will ultimately be.
I wish the drives in my computers were as reliable as my xPAPs. But there's no FDA looking over the manufacturers' shoulders
Re: (Score:2)
4 failures in 5 years @ 4h/day is pretty unreliable, that's 1500 hours of operation on average or 62 days. Even though yours doesn't happen to be in-service during failure, when you're relying on this.
Re: (Score:2)
Re: (Score:2)
Well, if you're 100% out of ventilators, having a shot with a potentially workable vent seems a lot better than nothing.
Re:FDA wouldn't allow it... (Score:4, Insightful)
Unfortunately, the FDA would rather you take the certain death option rather than use an "unapproved" device.
I suspect most lawyers would cheer you on though so they could represent your family in the wrongful death lawsuit should it go badly.
So many shitty people in the world, eh?
Re:FDA wouldn't allow it... (Score:4, Informative)
Accidents, _very bad_ accidents that kill people, can handle when mechanical devices ar4e used in unexpected ways. Will reversing the pump break it, or cause it to collect mousture and bacteria in places that are much more difficult to clean? Many brilliant hacks of existing mechanics can fail under even ordinary use. Anyone who's done mechanical or electrical work in a household of broke people can warn you about it.
Re: (Score:2)
And if your alternative is guaranteed death?
Re: (Score:2)
I do not believe that is one of the options being presented. This solution will not work for people who cannot breath on their own; it may help those who need some small assistance breathing, especially while asleep or unconscious.
The attitude of some seems to be that if the patient is already certain to die, that we may as well try out the leeches because it can't get any worse.
Re:FDA wouldn't allow it... (Score:5, Informative)
The whole "if it's my only chance, I'd take it" argument is not a good one.
CPAP and BiPAP aren’t even close to assistive for breathing. The pressure is just too low. Everybody who is on CPAP/BiPAP treatment knows this. It’s just enough pressure to keep the soft tissues in your _throat_ from obstructing breathing (ie. snoring). It’s meant to be just enough to compensate for the muscles in the throat relaxing while sleeping.
BiPAP literally lacks the mechanical power to force air into lungs with a relaxed diaphragm, and no firmware magic is going to change that. BiPAP max pressure is around 25 cm of water — 0.35 PSI. That is less than a third of the pressure your own diaphragm can easily deliver, and far from enough to force air into your lungs with a relaxed diaphragm.
It can assist breathing in the same way a newborn baby could fight Mohamed Ali - “better than nothing,” but utterly worthless all the same.
Re: (Score:2)
No, nobody is "reversing the pump". The difference between a CPAP and a BIPAP is the latter sense your exhalation and LOWERS the pressure. It doesn't suck air out of you. I speak from experience with both kinds of devices.
Back in the heyday of the Commodore64 and its 5-1/4" floppies, media manufacturers were selling so-called single-sided disks, The user base soon discovered that with the aid of a disk notcher, you could flip the disk over and user the other side. Media manufacturers swore up and down that
Re: FDA wouldn't allow it... (Score:2)
Re: (Score:2)
Re: (Score:2)
I can't see them taking the liability of releasing a firmware update for this.
Under ordinary circumstances, the FDA would require he machine to be fully qualified a a ventilator before approving this patch. But under present conditions I can see an emergency exemption being issued for this.
FDA (Score:3, Informative)
The device is FDA approved as is. New firmware would require FDA approval.
Re: (Score:2)
Re: (Score:2)
Well that (legalities and approvals) part is true in the context of 'hacking the firmware' but, what if the device fails due to the firmware change resulting in a death? The legal issues would have far reaching ramifications. Who's going to be held liable? Who's going to go to be fined or possibly jailed for using a non-FDA approved device?
In the real world scenario this would never fly until the FDA and the maker of the device accept the firmware change and the associated risks. That's why it takes so long
Re: FDA (Score:3)
Right and the converse is not true. The FDA can drag their feet and let a million people die and they will personally and as an agency suffer no consequences.
Re: (Score:1)
Not too sure about that. Statistically, a few of the million people who would die likely have a loved one with the means and the will to MAKE someone in power there personally feel consequences.
Re: (Score:2)
Covid-19 gets the blame.
There's no family allowed in with you to dispute that.
You just die, like you would have...
Re: (Score:2)
You must not actually be treating patients. How many doctors, hospitals, and medical staff want to get sued when a patient dies?
Re: (Score:3)
It is actually pretty difficult to start a medical malpractice lawsuit. Many states require a medical professional to swear (in essence) that no reasonable health care provider would do what the defendant Dr. did--and that is just to file a suit that won't be summarily dismissed.
I would take the odds of hacking firmware to attempt to save a patient who would almost surely die--but someone pointed out below that these machines aerosolize the covid-infected fluids. You would have a better (but difficult) cas
Re: (Score:2)
Then use it on yourself. Do not expect a doctor who's taken the Hippocratic oath to subject a patient to a hacked device handed to them by a stranger. It's like one brief paragraph appears in Slashdot and people are shouting Hallelujah before they've read the article.
Re: (Score:2)
Then use it on yourself. Do not expect a doctor who's taken the Hippocratic oath to subject a patient to a hacked device handed to them by a stranger. It's like one brief paragraph appears in Slashdot and people are shouting Hallelujah before they've read the article.
The Hippocratic oath basically says that you will treat a patient to the best of your abilities and judgement. Any doctor who didn't use a hacked device on a dying patient if that was the only or best option available would be violating their oath.
Re: (Score:2)
We agree then, since the hacked device will never be the only option. This jail broken CPAP device will NOT work on a dying patient. It is not a respirator and cannot force air into the patient's lungs.
Re: (Score:2)
malpractice insurance doesn't cover the use of out-of-warranty equipment.
Re: FDA (Score:2)
If you are a hospital who must use FDA approved equipment or be fined or sued out of existence, you care.
Bad Idea (Score:5, Informative)
Re: (Score:3)
Yet a BiPAP can be hooked up to intubation hoses, forgoing the mask, and be used as a makeshift ventilator. I think the bigger picture thing here is that ventilators aren't nesc helping hugely. If you can't take someone back off the ventilator in 2-3 days, then it may do as much harm as help.
Re: (Score:2)
https://www.npr.org/sections/health-shots/2020/03/27/822211604/cpap-machines-were-seen-as-ventilator-alternatives-but-could-spread-covid-19 [npr.org]
Re: (Score:3)
And a CPAP =/= a BiPAP. BiPAP + intubation == ventilator
The point of this is a firmware change that gives the CPAP BiPAP abilities.
Just to be pedantic (Score:3)
I sleep with a BiPAP machine - Resmed's AirCurve 10S. The summary's description of how a BiPAP machine functions is not correct. The machine maintains positive air pressure the entire time - it just cycles between a higher pressure and a somewhat lower pressure, depending on whether you're inhaling or exhaling. The idea is to maintain an "air splint" which prevents the back of your tongue from collapsing into your throat, keeping your airway open.
On a related note... a BiPAP machine also doesn't actually fo
Re: (Score:3)
Re: (Score:2)
A ventilator only breathes for you if you cannot breath on your own. This is the "complicated" part of a ventilator. Otherwise the thing is quite simple and anyone can make a passable workable contraption with bits and pieces that most people have in the house.
Before we had minature aquarium style air pumps and plastic tubing there used to be these things called "iron lungs" that worked on the same principle.
Re: (Score:2)
A ventilator can help someone who cannot breathe on their own, and they can force air into you (at the correct pressure). That's why the patient is intubated, so that the air doesn't end up in the stomach.
Re: (Score:3)
Depends. The old one I use as a backup and for travelling actually does force a preset respiration pattern on the user.
Re: (Score:2)
The way around that is to protect the first responders and all hospital staff.
It took experts in Italy a while but they finally understood that quality, tested PPE works better.
The skills to actually fully suit up in good quality PPE and always clean up.
Re: (Score:3)
Ventilators are closed loop.
What the fuck are you smoking?
Re: (Score:2)
Given the organic lifeforms in some humidification tanks, I've suspected that some of them may be recycling carbon dioxide to oxygen uqite locally. But then I scrubbed it.
Closed loop really means properly filtered. (Score:3)
Open means that the air that is breathed is released into the air. A closed system collects that air and cleans it before releasing it.
Re: (Score:3)
A closed system collects that air and cleans it before releasing it.
LOL perhaps in your imagination. In a real life mechanical ventilator, there's a bit of paper. That's all the "cleaning" you're going to get, and it's not designed to "clean" the exhaled gas so much as to prevent bacteria from colonizing their way up the tubing... Needless to say viruses are quite a bit smaller than bacteria, and let's not mention how much virus the nurses are slinging around the room every day or so when they come and aspirate the patient's trachea...
Actually, CPAPs can be used without aerosolizing. (Score:5, Informative)
Mount Sinai pioneered this. You don't use a CPAP mask, which would create aerosols as you describe. Instead, this is used with an intubated patient, but instead of having a return branch in the circuit (the way a normal ventilator works), they use a controlled leak, and vent through a viral filter. The exhausted air can also be sent to the hospital's vacuum system.
It doesn't provide as much capability as a real ventilator, but it's adequate for some cases.
More details here: https://health.mountsinai.org/... [mountsinai.org]
Re: (Score:3)
The constant positive pressure aerosolizes the viral load and pumps it into the air.
Just curious but is this any worse than a patient who does not need a ventilator just breathing?
drugs not ventilators (Score:2)
I appreciate effort, but we need more effective ways to slow transmission and an effective drug to treat this with more than we need ventilators.
Maybe a way to conduct business through a doorway instead of allowing people into a store woudl be more tractible, or perhaps a way to work side by side without risking co-workers would help work through the uncertainty of the coming months before there are proven vaccines
Re: (Score:3)
A lot of places need ventilators right now.
Obviously just not where you live.
Re: (Score:2)
The problem is that 80% of COVID patients that are put on ventilators die. That's as opposed of 50% of people who are put on ventilators for other reasons. Possibly this is because COVID patients typically need to be on ventilators longer. (Which, of course, contributes to the shortage.)
So we really need a better solution than ventilators. Maybe gravity boots and an antihistamine nasal inhaler (to help drain the lungs). But that's not a good long term answer either. (Even short term it's likely to ind
Re: (Score:2)
"something to quiet the cytokinetic storm"
You mean like AIDS? Yes, that would work. Unfortunately it takes about 10 years to progress from HIV infection to AIDS so it is unlikely to be helpful.
There are lots of immunosuppresive drugs. However, preventing the immune system from doing its job does not resolve the infection. It just stops the immune response from occurring.
Re: (Score:2)
I appreciate effort, but we need more effective ways to slow transmission and an effective drug to treat this with more than we need ventilators.
Is it the same people working on both? Is the one team that could create a drug also the one team able to work on ventilators? Or could we possibly work on both at the same time, one for long-term cure and one for critical care?
Time scales (Score:2)
I appreciate effort, but we need more effective ways to slow transmission and an effective drug to treat this with more than we need ventilators.
These are different timescales. Slowing transmissions reduces hospital cases in 2-3 weeks, it does nothing for the cases already there or arriving in the next 1-2 weeks. Drug trials take time so again this does nothing for the next several weeks and probably longer. It's also not clear whether either of these approaches will be worked until several weeks have passed so if you wait and do nothing else things might be really bad.
If a simple firmware update could immediately place lots of, admittedly proba
Maybe this guy should path the 737Max firmware (Score:1)
Re: (Score:2)
So the ventilator firmware gets installed in the plane and every time auto-pilot is engaged, oxygen masks come down.
What is truth? (Score:2, Interesting)
Tonight, Donald Trump said that hospitals have "more than 60,000 unused ventilators". But this article says we have a "dangerous shortage" of ventilators. Who's bullshitting?
https://www.whitehouse.gov/bri... [whitehouse.gov]
Re: What is truth? (Score:4, Interesting)
Re: (Score:1)
For the most part, hospitals (aside from NYC) are close to empty, and they are laying off personnel, because there hasn't been much Wuhan flu admittances, and all other elective or routine treatments are postponed or rescheduled. The 60,000 number is probably right.
CPAP (Score:2)
Sleep apnea is a major contributing factor to heart attacks and stroke. If we cause a shortage of CPAP machines, co-morbidities related to sleep apnea will increase. Have we done the math on that? Carrie Fisher (Star Wars actress) for example, death was sleep apnea related.
Make more ventilators. Find treatments.
Re: (Score:2, Flamebait)
Re: (Score:2)
Obesity correlates with sleep apnea, but it's not the only cause.
Re: (Score:3)
Fisher was elderly and obese. (Score:3)
The first is inevitable but the second is voluntary, mostly a recent problem, and far worse in social impact then sleep apnea taking out elders who are circling the drain due to co-morbidities.
I'm old too. No one lives forever but if you refuse to have your shit together you volunteer for bad outcomes.
Re: (Score:2)
And prevent the spread. Develop vaccines, keep people at home, change behavior.
Very nice, but he'll likely get sued over it (Score:2)
Re: (Score:2)
Re: (Score:2)
Of course Mr. Hudsons' discovery hidden in their own firmware reveals an embarassing fact that could be interpreted as them holding out on everyone during a disaster. The optics on that won't be good. If they're smart they'll step up and convert the things into respirators and STFU about the rest of it, hoping no one makes an issue out of the discovery.
Re: (Score:2)
Not clear. Just because the firmware would support the use doesn't mean the hardware would. It might be a really bad idea. Perhaps they just had one set of firmware designed for all their models, and different models had different hardware features to support.
Of course, this might not be the case. But I wouldn't bet one way or the other. (I do remember that RCA computer that you upgraded by taking out a long cable and replacing it with a short one.)
Re: (Score:2)
No not that one, the other one! (Score:3)
Re: (Score:2)
This is true with a lot of products actually. It's cheaper them with full functionality then "remove" it for low end models. Especially when dealing with anything electronic.
Re: (Score:2)
or hidden or illegal that need to pass with a wink.
I recall an instruction manual for a CB radio in the late 70s to the effect of "Do not use diagonal pliers to cut Jumper J3,a s this would illegally boost radio output."
Or prohibition era hopped malt extract (yeah, hops are important for brownies . . .) with the warning "Do not dissolve in water and add yeast, as this would make beer, which is illegal"
Re: (Score:2)
Re: (Score:2)
He's thinking of his radio shack scanner...
The AirSense 10 is already BiPAP (Score:3)
This doesn't make sense.
The AirSense 10 is already BiPAP, or at least is to any user who is on the CPAP forums and has learnt how to set the pressure relief setting via the clinicians menu.
CPAP + timer equals emergency bilevel device. (Score:2)
Re: (Score:1)
Yeah no. (Score:2)
Cpap is an entirely different I.e. less complex machine than a ventillator. What needs very close control and attention is what is called "tidal volume" of air. Besides the intubation that is done with a ventillator and not a cpap machine.
What the manufacturer did was use a complex control board to control a simpler machine. Not something you want to trust your or someone else's life to in a life and death critical situation.
Just because you can do something doesn't mean that you actually should.
The one thi
Enemy of the state (Score:1)
They are clearly an enemy of the state by not enabling the emergency use (no lawsuits permitted) of the device.
In many countries, they do come up with emergency ventilators. Car manufacturers are making them. A non-approved ventilator is better than nothing.
Re: (Score:2)
a non approved ventilator could easily kill you in the most painful way imaginable
luckily there is so far no shortage of ventilators
the word ventilator is really clickbait at this point
Shortage? (Score:2)
There is a shortage of ventilators? News to me.
Warranty and Liability (Score:1)
Advanced?? That is some *ancient* tech! (Score:2)
This is for everyone: Do not EVER let anyone prescribe a CPAP or BPAP machine to you. They are horribly outdated.
At the very least, get an APAP! With ramping and humidity control and everything. One with proper data logging!
And *non* of those devices ever "pulls" air out of the lungs! BPAPs and APAPs just lower their pressure, so your peritoneum and chest can relax, and push the air out, like a balloon would. CPAPs don't even do that. Which is why they are shit. And APAPs intelligently set the prressure to
Re: (Score:2)