Downloaded 18 times
![Sample FHIR request
{
"resourceType": "Query",
"text": {
"status": "generated",
"div": "<div>[Put rendering here]</div>"
},
"identifier": "urn:uuid:42b253f5-fa17-40d0-8da5-44aeb4230376",
"parameter": [
{
"url": "http://hl7.org/fhir/query#_query",
"valueString": "example"
}
]
}](https://image.slidesharecdn.com/breakingintohospitals-160203163657/85/Breaking-into-hospitals-38-320.jpg)
Uploaded bysecurityxploded
Breaking into hospitals
The document discusses the vulnerabilities in hospital cybersecurity and the various attack vectors targeting healthcare institutions, including insider and outsider threats. It highlights the significant risks posed by unprotected hospital infrastructure and the misuse of medical devices due to inadequate security measures. The author underscores the urgent need for improved security protocols in the face of evolving cyber threats.
More Related Content
![Bluetooth [in]security](https://cdn.slidesharecdn.com/ss_thumbnails/bluetoothinsecurity-160203162816-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Breaking into hospitals
Breaking into hospitals
- 1. Breaking into Hospitals Disclaimer:All the views / data presented are my own and do not reflect the opinions of my employer. -- Anirudh Duggal
- 2. About me • Seniorsoftware engineer with Royal Philips • Speaker at Cocon, HITCON, Ground Zero, Nullcon • Hack anything • Sustainability enthusiast • Play guitar in free time
- 3. Menu! • Hospitals • Whyattack hospitals? • Infrastructure inside a hospital • A reality check • Indian perspective • Changing threat scenario
- 4. Hospital • A hospitalis a health care institution providing patient treatment with specialized staff and equipment.-- wiki
- 5. Why Hospitals? • Cyberwar / Terrorism? • Privacy • Financial – a medical record fetches 8x of a credit card record • Physical?
- 7. Infrastructure inside ahospital
- 8. Range of devices Cost:Rs 250 115 (50% off) Fits in pocket Cost: can reach up to 3 million $ Size: about the size of a truck (don’t ask the weight ;) )
- 9. And the memory Ahospital data center… A simple DIY device
- 10. And………. • Patient monitors •Insulin monitors • Pacemakers • Heart rate devices • “smart bands” • Home monitoring solutions
- 11.
- 12. Healthcare centers andhospitals HVAC system Lighting system Hospital servers Waste management systems Medical devices Hospital computers Monitoring devices Tablets / phones Water controls NAT / Bridged network Other hospitals Vendor servers “service portals” Vendor servers Intranet Internet Security systems
- 13.
- 14. So where’s theproblem? • The infrastructure is not supposed to be “public” • Most of this infrastructure is not prepared to be Public
- 15. Attack Scenario • Outsiderattacks -> fingerprinting and attacking hospitals • Name, medical equipment, EMR systems, HVAC systems, control systems, routers, security systems • Insider attacks – network and medical devices • Public vs private networks, finding HL7 implementations, • Finding obsolete hardware / software
- 16. A reality check •As an attacker i Found 2000+ vulnerable hospital servers Found 200+ hospitals from major hospital chains Found HVAC controls Discovered many entry points in each of them Am updating the number of live EMR systems I found Still findings lots of hospitals and healthcare devices and solutions…
- 17. Indian perspective asan attacker • Found many major hospitals (40+) • Was able to fingerprint major hospital chains • Found FTP, Telnet, IIS instances (unprotected) • Found suspicious activity • Found hospital networks have open Wi-Fi Connections e.g. Hospital admin and hospital networks • Need security now!
- 18. Outsider attacks • Reconusing shodan
- 20. On the basisof EMR solutions
- 21. Fingerprinting chains ofhospitals
- 23. Infrastructure – besidesmedical devices
- 25.
- 26. Insider attacks • WiFinetworks – guests • Stealing information from employees– privacy • Evil staff – using existing infrastructure to launch attacks • HL7 and FHIR
- 27.
- 28. Potential entry points •Wifi / Lan • Serial ports • USB - Firmware • The sensors • Keyboard / mouse • Firewire • Protocols
- 29. What is HL7? •Health level standards • Most popular in healthcare devices (HL7 2.x) • Quite old – designed in 1989 • FHIR is the next gen
- 30. HL7 2.x • Mostpopular HL7 version • New messages / fields added
- 31.
- 32. Things to know •|| is a delimiter / field • MSH – message header segment • The standards define the messages – not the implementation
- 33. An HL7 message MSH|^~&||STISQESERV3|||||ORU^R01|HP1304538180456|P|2.3||||||8859/1 PID|||MRN-3M31^^^^MR~Encounter-3M31FF^^^^VN~AlternatiFF-3M31^^^^U||3M31LastUpdate^Test-FirstUpdate^Middle-Update||19330808|F PV1||I|OR^^OR9&0&0||||||||||||||||Encounter-3M31FF OBR|||||||20110504154300 OBX||TX|6^Soft Inop^MDIL-ALERT|1|ALL ARRH ALRMS OFF||||||F OBX||ST|0002-d006^EctSta^MDIL|0|""||||||F OBX||ST|0002-d007^RhySta^MDIL|0|SV Rhythm||||||F OBX||NM|0002-4bb8^SpO2^MDIL|0|100|0004-0220^%^MDIL|||||F OBX||NM|0002-0302^ST-II^MDIL|0|-1.0|0004-0512^mm^MDIL|||||F OBX||NM|0002-0304^ST-V2^MDIL|0|0.6|0004-0512^mm^MDIL|||||F OBX||NM|0002-f125^pNN50^MDIL|0|0.00|0004-0220^%^MDIL|||||F OBX||NM|0002-4182^HR^MDIL|0|80|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-4a15^ABPs^MDIL|0|120|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-4a16^ABPd^MDIL|0|70|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-4a17^ABPm^MDIL|0|91|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-4261^PVC^MDIL|0|0|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-5012^awRR^MDIL|0|25|0004-0ae0^rpm^MDIL|||||F OBX||NM|0002-e014^Tblood^MDIL|0|37.0|0004-17a0^°C^MDIL|||||F OBX||NM|0002-4822^Pulse^MDIL|0|60|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-50b0^etCO2^MDIL|0|40|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-50ba^imCO2^MDIL|0|0|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-f0c7^T1^MDIL|0|40.0|0004-17a0^°C^MDIL|||||F OBX||NM|0002-f081^SD NN^MDIL|0|0.00|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-f03d^STindx^MDIL|0|3.5|0004-0512^mm^MDIL|||||F
- 34. MSH|^~&||STI SQESERV3|||||ORU^R01|HP1304538180456|P|2.3||||||8859/1 PID|||MRN-3M31^^^^MR~Encounter-3M31FF^^^^VN~AlternatiFF-3M31^^^^U||3M31LastUpdate^Test- FirstUpdate^Middle-Update||19330808|F PV1||I|OR^^OR9&0&0||||||||||||||||Encounter-3M31FF OBR|||||||20110504154300 OBX||TX|6^Soft Inop^MDIL-ALERT|1|ALLARRH ALRMS OFF||||||F OBX||ST|0002-d006^EctSta^MDIL|0|""||||||F OBX||ST|0002-d007^RhySta^MDIL|0|SV Rhythm||||||F OBX||NM|0002-4bb8^SpO2^MDIL|0|100|0004-0220^%^MDIL|||||F OBX||NM|0002-0302^ST-II^MDIL|0|-1.0|0004-0512^mm^MDIL|||||F OBX||NM|0002-0304^ST-V2^MDIL|0|0.6|0004-0512^mm^MDIL|||||F OBX||NM|0002-f125^pNN50^MDIL|0|0.00|0004-0220^%^MDIL|||||F OBX||NM|0002-4182^HR^MDIL|0|80|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-4a15^ABPs^MDIL|0|120|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-4a16^ABPd^MDIL|0|70|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-4a17^ABPm^MDIL|0|91|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-4261^PVC^MDIL|0|0|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-5012^awRR^MDIL|0|25|0004-0ae0^rpm^MDIL|||||F OBX||NM|0002-e014^Tblood^MDIL|0|37.0|0004-17a0^°C^MDIL|||||F OBX||NM|0002-4822^Pulse^MDIL|0|60|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-50b0^etCO2^MDIL|0|40|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-50ba^imCO2^MDIL|0|0|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-f0c7^T1^MDIL|0|40.0|0004-17a0^°C^MDIL|||||F OBX||NM|0002-f081^SD NN^MDIL|0|0.00|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-f03d^STindx^MDIL|0|3.5|0004-0512^mm^MDIL|||||F
- 35. MSH|^~&||STI SQESERV3|||||ORU^R01|HP1304538180456|P|2.3||||||8859/1 PID|||MRN-3M31^^^^MR~Encounter-3M31FF^^^^VN~AlternatiFF-3M31^^^^U||3M31LastUpdate^Test- FirstUpdate^Middle-Update||19330808|F PV1||I|OR^^OR9&0&0||||||||||||||||Encounter-3M31FF OBR|||||||20110504154300 OBX||TX|6^Soft Inop^MDIL-ALERT|1|ALLARRH ALRMS OFF||||||F OBX||ST|0002-d006^EctSta^MDIL|0|""||||||F OBX||ST|0002-d007^RhySta^MDIL|0|SV Rhythm||||||F OBX||NM|0002-4bb8^SpO2^MDIL|0|100|0004-0220^%^MDIL|||||F OBX||NM|0002-0302^ST-II^MDIL|0|-1.0|0004-0512^mm^MDIL|||||F OBX||NM|0002-0304^ST-V2^MDIL|0|0.6|0004-0512^mm^MDIL|||||F OBX||NM|0002-f125^pNN50^MDIL|0|0.00|0004-0220^%^MDIL|||||F OBX||NM|0002-4182^HR^MDIL|0|80|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-4a15^ABPs^MDIL|0|120|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-4a16^ABPd^MDIL|0|70|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-4a17^ABPm^MDIL|0|91|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-4261^PVC^MDIL|0|0|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-5012^awRR^MDIL|0|25|0004-0ae0^rpm^MDIL|||||F OBX||NM|0002-e014^Tblood^MDIL|0|37.0|0004-17a0^°C^MDIL|||||F OBX||NM|0002-4822^Pulse^MDIL|0|60|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-50b0^etCO2^MDIL|0|40|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-50ba^imCO2^MDIL|0|0|0004-0f20^mmHg^MDIL|||||F OBX||NM|0002-f0c7^T1^MDIL|0|40.0|0004-17a0^°C^MDIL|||||F OBX||NM|0002-f081^SD NN^MDIL|0|0.00|0004-0aa0^bpm^MDIL|||||F OBX||NM|0002-f03d^STindx^MDIL|0|3.5|0004-0512^mm^MDIL|||||F Patient identifier Message type and HL7 identifier Message fields
- 36.
- 37. FHIR • FHIR isa new specification based on emerging industry approaches, but informed by years of lessons around requirements, successes and challenges gained through defining and implementing HL7 v2 , HL7 v3 and the RIM, and CDA . • REST based
- 38. Sample FHIR request { "resourceType":"Query", "text": { "status": "generated", "div": "<div>[Put rendering here]</div>" }, "identifier": "urn:uuid:42b253f5-fa17-40d0-8da5-44aeb4230376", "parameter": [ { "url": "http://hl7.org/fhir/query#_query", "valueString": "example" } ] }
- 39.
- 40. New threat landscape •BYOD • Cloud Based attacks • Targeted attacks
- 41. Thank you Minatee MishraMichael Mc Neil Ben Kokx Jiggyasu Sharma Sanjog Panda Pardhiv Reddy Ajay Pratap Singh Neelesh Swami Geethu Aravind Archita Aparichita Sagar Popat
- 42.
- 43.
Editor's Notes
- #5 To set the context of hospitals by definition.
- #6 To explain that there is a rise in the security events around the medical devices, besides gaining access to confidential information attackers can harm the patient directly. e.g. the insulin pump hacks demonstrated at blackhat showed how an attacker can hack into insulin pumps. In a hospital environment there are other devices say heart rate monitor, oximeter ; these devices are being targeted now.
- #7 The insulin pump hack was a hot topic for healthcare security researchers. The pump was remotely monitored by a server. The attacker was able to change the dosage and impersonate the server. The product was banned for sale by the FDA.
- #9 This is to break the notion that medical devices are just pumps, oximeters, heart rate sensors. The devices can be as simple as a thermometer or as sophisticated as a MRI machine which has many computers working synchronously.
- #10 To emphasize more on the fact that these devices hold much memory, be it processing or data collection, these devices are evolving very quick
- #11 Besides hospital environments there are many medical devices that as general population, are not aware of. They may be given on case to case basis.
- #12 Like other institutions / companies hospitals have automation in their infrastructure. Most of these vendors do not have security in built into their software / hardware. This makes hospitals more vulnerable to attacks. These systems does have we interfaces which seldom run on HTTPS or any secure channel.
- #13 An expected hospital network (though insecure), this is how most of the hospitals usually look like.
- #14 In reality it is a bunch of devices in the network connected to the internet.
- #15 The problem is that the infrastructure is made with the assumption that it will be private / un compromised network.
- #16 Using intelligence tools one can gather information from the internet one can fingerprint such infrastructure. Using combined searches or tracking systems specific to hospitals e.g. EMR systems.
- #18 From an Indian perspective over the past month I’ve seen the number of hospitals that are fingerprinted rise in number.
- #29 To compare them to an IOT device but with much enhanced capacity, these RTOS devices have a dedicated program and usually does not run an off the shelf OS.