RIS-ky Business: Exploiting Medical Information Systems
summary
Research shows radiology networks accept unauthenticated DICOM associations via guessable AE titles, allowing remote C‑FIND queries and C‑STORE uploads. Demonstrations use pydicom/pynetdicom and DCMTK to enumerate presentation contexts, push malformed DICOM files with metadata XSS payloads, and trigger persistent script execution in an open source PACS (ClearCanvas) using admin:admin. Attack surface includes exposed gateways, unmonitored DICOM ports, and hundreds of permissive AE entries; mitigation options include DICOM user identity negotiation (Kerberos/SAML) and strict PACS input sanitization.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:20Medical device risks overview
- 1:23DICOM and PACS explained
- 3:51DICOM protocol deep dive
- 6:42DICOM network operations
- 8:29Authentication flaws in DICOM
- 10:36Exploiting AE titles
- 11:42Guessing AE titles easily
- 13:06Exposed DICOM servers
- 14:11Enumerating DICOM operations
- 15:36DICOM file protocol risks
- 16:42DICOM file injection attacks
- 17:23Cross-site scripting via DICOM
- 19:10PAC system security gaps
- 19:51New DICOM authentication standards
- 20:32Blue team monitoring advice
- 21:13Conclusion and Q&A
related talks
37mMillions of Patient Records at Risk: The Perils of Legacy Protocols
52mInformation Sharing to Mitigate Emerging Vulnerabilities
58mMedical Device Security
26mCommSec D2 - Hacking a Hospital for Fun and Profit
01h 01m(In)Security of Medical Devices
43mSecurity in FHIR
28mFrom a Hospital into the Realm of Hades
40mSomething Rotten in the State of Data Centers