Understanding HL7 2.X Standards, Pen Testing, and Defending HL7 2.X Messages
summary
HL7 v2.x runs in ~95% of hospitals and sends plaintext patient data; scans find HL7 listeners on arbitrary ports (examples: 207, 9001, 10200). Demos show Wireshark traces collecting ~632 packets in five minutes, an authored main.py scanner that fingerprints supported messages (ADT, ORU, ORM), an emulator that crashes on malformed segments, replayable ACK behavior that stalls devices, DoS via oversized messages, and SSRF through report file fields. Recommended fixes: TLS, message size validation, input sanitization, and per-message identifiers.
AI-written summary · about
chapters (24)
- 0:00Start
- 2:25Securing hospitals
- 3:02HL7 - Health Level 7
- 3:29In a nutshell
- 3:54HL 7 2.x crash course
- 5:18ADT - Admit Discharge and Transfer
- 6:31ADT - Potential Entry Points
- 7:00ORM - Order message
- 8:23ORM - Potential Entry points
- 9:18RDE - Pharmacy order message
- 9:48RDE - Potential entry points
- 10:00Viewing these messages
- 16:22Recon
- 24:16Common flaws - HL7 2 x
- 25:14Message source not validated
- 26:09Unvalidated size
- 26:30Abusing file upload / download functionality
- 28:00Bad server attacks
- 28:35ACK and NACK messages
- 29:25Denial of service
- 31:11Fuzzing HL7 2.x
- 37:57Defending HL7 2.x messages
- 39:51Finally
- 41:10Questions?
related talks
53mAttacking & Securing HealthCare Standards & Hospital Secured Systems
26mCommSec D2 - Hacking a Hospital for Fun and Profit
47mPenetration Testing & Red Teaming for Healthcare
41mPlenary session
37mMillions of Patient Records at Risk: The Perils of Legacy Protocols
58mMedical Device Security
43mSecurity in FHIR
40mWebsite security 101