Repeating a study that was presented at ECR 2015, researchers from Massachusetts General Hospital (MGH) in Boston unfortunately found no improvement in 2016 for DICOM security after a worldwide search for unprotected DICOM servers. Of the 2,773 unprotected DICOM servers found by the researchers this year, 29% were completely open to DICOM communication with outside computers and were capable of transferring patient data.
The troubling findings show that patient data is still not secured, according to presenter Oleg Pianykh, PhD.
"If you think that your hospital has not been hacked yet, then most probably you just don't know that it was," Pianykh said.
Assessing clinical security
Pianykh and colleague Sampson Abiola of MGH wrote an application designed to probe remote computers over an Internet protocol (IP) address and see if it would respond to a query to communicate. The idea was to survey a large sample of IP addresses and identify the ones that responded positively to the request.
Using geolocation technology, they would then map these unprotected IP addresses, pinpointing the coordinates and their providers/owners, he said. Pianykh noted that the search was conducted only for protocol verification purposes; no clinical data were accessed.
Thanks to some multicore programming and a highly parallel Amazon computing cluster, the researchers were able to scan 4 billion IP addresses -- the entire IP space -- in 12 hours, Pianykh said. They calculated the number of overall unprotected DICOM IP addresses, as well as those that also accepted external DICOM "handshakes" (i.e., communication requests), meaning they were fully open to DICOM communication with outside computers.
|Number of unprotected DICOM computers|
|Number of unprotected DICOM IP addresses||2,774||2,773||0%|
|Number of unprotected DICOM IP addresses that were fully open to outside communication||719||804||11%|
|Percent of unprotected DICOM servers fully open to outside communication||25%||29%||4 percentage points|
"Obviously, we don't know the actual [total] number of DICOM servers; nobody knows how many servers are being kept behind firewalls, so there's no way to count them," he said. But at least the number of unprotected DICOM addresses and the number of unprotected DICOM IP addresses that were fully open to outside communication give you a "fair idea of what's going on," he noted.
The biggest offenders
Pianykh noted that the total number of overall clinical servers was the major predictor for the number of unsecured servers.
Countries with the highest ratios of open DICOM servers accepting foreign handshakes to all detected DICOM servers included the following:
"You see some unusual [countries] on this list, but you also see countries that you would expect to take better care of their DICOM communications," he said.
The researchers also found open HL7 servers when they performed a similar search of all IP addresses for the HL7 protocol.
Countries with the most open HL7 servers:
More than 20 years after digital medicine began to be implemented, patient data still remain unsecured, according to Pianykh.