Plenary session
summary
Research shows a single patient login exposes 4 million records across one clinical-data ecosystem by abusing FHIR endpoints; testing uses Postman, Burp Suite, mitmproxy, APK extractor/MobSF and Frida to reverse mobile apps and decrypt traffic. Key findings: 53 apps had hard-coded keys and tokens, BOLA (broken object-level authorization) allows reading and even modifying other patients’ prescriptions, and ~50% of aggregators lack database segmentation. Fixes: pen test APIs, certificate pinning, remove hard-coded secrets, adopt zero trust and API-focused observability.
AI-written summary · about
chapters (4)
- 0:00General opening
- 0:45Meet the new HL7 FHIR Officers
- 9:28Playing with FHIR: how I hacked 4 million patient records through FHIR API's.
- 37:26General outro .
related talks
43mSecurity in FHIR
52mGetting API security right
53mGetting API Security Right
31mHow I hacked 30 mobile banking apps & the future of API Security
35mClosing Keynote Day 1 API First Hacking
30mAPI Security - Divide & Conquer
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs