CommSec D2 - Hacking a Hospital for Fun and Profit
summary
Hospital LAN has an open WiFi in the cafeteria that exposes a flat network, live RJ45 jacks give immediate IPs, and a kiosk runs Windows 7 with local admin and domain access allowing lateral movement to domain admin in hours. Imaging traffic (DICOM) travels unencrypted, a portable CT runs open VNC without auth and stores patient scans locally, PLCs controlling gas and HVAC accept trivial technician codes (many set to “1”), and an ECG device exposes FTP/telnet with command injection enabling uploaded ARM payloads and full device compromise.
AI-written summary · about
chapters (15)
- 0:00Introduction and motivation
- 1:17Why target medical facilities
- 2:43Attack vectors in hospitals
- 4:49First day findings
- 6:13Physical access risks
- 7:37Hacking the kiosk machine
- 9:49Network security reality
- 11:14DICOM protocol flaws
- 12:18Operation room devices
- 14:02Portable CT device vulnerabilities
- 15:31PLC device risks
- 19:02EKG device compromise
- 22:28Security gap in hospitals
- 24:14Call for awareness
- 24:35Q&A session
related talks
58mBreaking Bad: Stealing Patient Data Through Medical Devices
58mMedical Device Security
22mRIS-ky Business: Exploiting Medical Information Systems
01h 01m(In)Security of Medical Devices
38mHacking Demos, Dirty Secrets, Dangerous Lies, Asset Intelligence
47mPenetration Testing & Red Teaming for Healthcare
48mAssume Compromise: Think Like a Hacker to Build Resilience
58mWhere did you find that?