Measuring Healthcare Data Leaks and Security Flaws at Internet Scale
Measuring Healthcare Data Leaks and Security Flaws at Internet Scale - arXiv
Summary
Researchers conducted a large-scale internet scan of major protocols like HL7 and FHIR used in healthcare. They found 2,841 vulnerable services due to flaws such as lack of authentication, revealing that many systems operate without proper encryption.
Details
This study presents the first large-scale investigation into the security of medical data processing systems. While digitalization is widespread in hospitals, outdated network protocols often fail to implement basic security features like authentication or encryption. The research focused not only on DICOM but also on HL7 and FHIR, which are crucial for transmitting patient data. Covering both IPv4 and IPv6 address spaces, the team conducted large-scale internet scans of these major healthcare protocols. They identified a total of 2,841 services with authentication flaws. Furthermore, they found that 94.4% of exposed systems do not use encryption during transfer, and numerous endpoints suffer from critical vulnerabilities, including those potentially leading to system takeover. The findings highlight the alarming state of cybersecurity in healthcare facilities and propose countermeasures through a responsible disclosure process.
Original content copyright by respective publishers