Measuring Healthcare Data Leaks and Security Flaws at Internet Scale
This paper presents the first large-scale study of healthcare protocols (DICOM, HL7, and FHIR) across the Internet, revealing alarming security flaws including widespread authentication failures, lack of transport encryption, and critical software vulnerabilities affecting thousands of systems, while detailing a coordinated disclosure campaign to address these risks.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine the internet as a giant, bustling city where every building has a front door. Most of these doors are locked, but some are left wide open, inviting anyone to walk right in. In the world of medicine, these "buildings" are computer systems that hold our most private secrets: our medical records, X-rays, and diagnoses. To talk to each other, hospitals use special languages, or "protocols," like DICOM (for medical images), HL7 (for general patient records), and FHIR (a newer, web-based language). Think of these protocols as the specific dialects doctors and machines use to whisper secrets to one another. The big question researchers have been asking is: How many of these medical buildings have their doors left unlocked, and are strangers wandering in?
This paper is like a team of digital detectives who decided to walk the streets of the internet, knocking on every door that might belong to a hospital. They didn't just look at the old, famous doors (DICOM); they also checked the newer, flashier ones (HL7 and FHIR) that many people assumed were safe. They set up a fake "trap" building (a honeypot) to see who was trying to break in, and then they went on a massive sweep of the entire internet, checking both the old IPv4 addresses and the newer, huge IPv6 addresses. What they found was a bit scary: a huge number of medical systems are sitting out in the open, often without any locks (authentication) or even without a roof (encryption), leaving millions of patient records exposed to anyone with an internet connection.
The Detective Work: What They Did
The researchers started by building a "honeypot," which is like a fake, empty house left on the internet with a sign that says "Hospital." They waited nine months to see who would knock on the door. They found that while many people were knocking on the door for the old DICOM language, almost no one was checking the doors for HL7 or FHIR. This was surprising because everyone uses those languages, but it suggested that hackers (and researchers) had been ignoring them.
To get the full picture, the team launched a massive scan across the entire internet, looking for these three medical languages on both the old and new internet address systems. They didn't just look for the doors; they tried to open them. They sent special messages to see if the systems would let them in without a password, and they checked if the systems were using "TLS," which is like a secret tunnel that keeps data safe from prying eyes while it travels. They also checked the software running inside these systems to see if it had any known holes or bugs that hackers could use to take over the building.
The Shocking Findings
The results were a wake-up call. The team found 2,841 healthcare services that had serious security flaws. Here is the breakdown of what they discovered:
- The Open Doors: They found 1,780 DICOM systems leaking data due to missing authentication. For HL7, they found 903 systems without authentication, but because most HL7 systems are designed to push data rather than retrieve it, only 30 cases were confirmed to actually process data queries that could lead to a leak. Additionally, 242 FHIR endpoints were found leaking patient data. In total, 2,841 endpoints were accessible without proper authentication.
- The Missing Tunnels: A staggering 94.4% of all the exposed systems they found did not use transport encryption. This means that if someone intercepted the data, they could read it just like reading a postcard.
- The Broken Windows: They found 1,373 systems running software with known, dangerous vulnerabilities. Some of these flaws were so bad (with a "CVSS score" up to 9.8, which is near the maximum danger level) that a hacker could potentially take full control of the system.
- The Patient Count: Specifically for the newer FHIR systems, they identified 242 endpoints that were leaking data, potentially exposing records for 2,124,518 patients. While some of this might be test data, the sheer number is alarming.
The "Trap" and the Reality Check
The researchers also ran a "honeypot" experiment to see what kind of trouble was happening in the wild. They found that the fake DICOM server was scanned between 4 and 22 times every day by automated bots looking for weak spots. However, their fake HL7 and FHIR servers were completely ignored. This suggests that while hackers are actively hunting for the old medical image systems, they haven't yet started a massive hunt for the newer record systems—though the researchers warn that this doesn't mean the newer systems are safe, just that they haven't been targeted yet.
What Happened After?
The team didn't just publish the list of broken doors; they tried to fix them. They contacted the owners of these vulnerable systems through a process called "responsible disclosure," sending emails to the people in charge. They asked if the systems were supposed to be on the internet and if they knew about the risks.
The response was mixed. Only 26 people replied to their questionnaire, and while most admitted the systems were on purpose, only 4 said they had fixed the issues. When the researchers scanned the internet again four weeks later, the number of vulnerable systems had barely changed. In fact, for FHIR systems, the number of exposed hosts actually dropped by only 15.08%, and for DICOM, the change was a tiny -1.64%. This suggests that fixing these problems is incredibly difficult, perhaps because the systems are run by people who don't realize they are exposed, or because the technology is too complex to secure easily.
The Big Picture
The paper concludes that the state of cybersecurity in healthcare is "alarming." It's not just that data is being leaked; it's that the systems are so insecure that a hacker could potentially change a patient's medication dosage or delete a diagnosis, which could be life-threatening. The researchers suggest that the main problem is that these medical systems were never meant to be on the internet, yet they are there, often without any locks. They argue that hospitals need to stop connecting these sensitive systems to the public web and start using better security tools, but the slow response to their warnings shows that this is a massive challenge that hasn't been solved yet.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.