Millions of Patient Records at Risk: The Perils of Legacy Protocols
summary
Internet-wide scans find 3,800 DICOM servers exposed on ports 104/4242/11112 and reveal over 59 million records (about 16M PII, 43M health records). Simple tools (nmap, Python DICOM clients) and a scraped list of ~250 default AETs bypass authorization and break more than 750 servers; C-FIND/C-GET/C-MOVE leaks let attackers download records, while C-STORE tampering injects thousands of crafted images to corrupt or fake studies—demonstrated end-to-end and effective against ~39M vulnerable records.
AI-written summary · about
chapters (13)
- 0:00Introduction to DICOM
- 1:03The security crisis
- 2:03Causes of data leakage
- 4:09Scale of the breach
- 7:38DICOM protocol internals
- 11:00Attack vectors
- 12:45Authorization failures
- 14:39Data enumeration demo
- 17:06Image tampering attack
- 21:11Live exploitation demo
- 24:29Wider security issues
- 26:11Governance and solutions
- 29:27Mitigation strategies
related talks
22mRIS-ky Business: Exploiting Medical Information Systems
52mInformation Sharing to Mitigate Emerging Vulnerabilities
58mMedical Device Security
36m Macabre stories of a hacker in the public health sector (Chile)
41mPlenary session
26mCommSec D2 - Hacking a Hospital for Fun and Profit
43mSecurity in FHIR
01h 01m(In)Security of Medical Devices