40% of Exposed Medical Image Consoles Answer without a Password
Brief
By Adrian Cheek, Senior Cybercrime Researcher
To reach a hospital’s medical images the hard way, you need a DICOM (Digital Imaging and Communications in Medicine) client and some knowledge of a protocol designed in the 1980s for machines that were never supposed to face the internet. To reach a growing number of them the easy way, you can open a web browser and type an address.
The image server that stores a patient’s scans no longer just speaks the old wire protocol on an obscure port. It increasingly runs a web console for administration and a browser-based viewer for the images themselves, and those two web interfaces sit on the public internet far more often, and far more openly, than they should.