Presentation Material
Abstract
Digital Imaging and Communications in Medicine ( DICOM ) is a file format used widely across the healthcare industry. These files serve the purpose of carrying the patient metadata and scans together in a single file. Since sensitive Personally Identifiable Information ( PII ) and Personal Health Information ( PHI ) are carried together in these files, securing them is very crucial.
Unfortunately, the DICOM files became powerful attack vectors due to a vulnerability resulting from their structure. We also found that such malicious DICOMs are evading the corporate antivirus. In this research, we propose an entropy-based DICOM detection technique that helps in detecting such malicious DICOMs and alerting the SOC teams. We have also built the under the amour utility that runs in Linux and Windows systems to detect the presence of such malicious DICOM. We will show how we attacked systems that are running DICOM and also show the innovations and solutions we have built to stop such DICOM attacks in Linux and Windows.
AI Generated Summary
The talk addresses a critical security vulnerability in the DICOM (Digital Imaging and Communications in Medicine) standard, the primary format for storing and transmitting medical images like CT scans and X-rays. The core issue stems from two design features: a 128-byte preamble intentionally left empty for legacy compatibility and the allowance of custom private metadata tags. These features enable attackers to embed malicious executable code directly into a DICOM file.
Researchers demonstrated a proof-of-concept tool that infuses a Windows Portable Executable (PE) into a legitimate DICOM file. The resulting file is polymorphic, simultaneously validating as a proper DICOM image for medical viewers while also being recognized as a valid executable by the Windows operating system. This dual nature allows the file to bypass antivirus and sandbox defenses, which typically analyze only one file type signature.
Once executed, the malicious DICOM can leverage process injection techniques. It targets the privileged DICOM viewer application commonly used in hospitals, often running on outdated or unpatched Windows systems. By injecting code into this trusted process, the malware inherits its privileges, enabling command-and-control callbacks, lateral movement, and the deployment of additional payloads like embedded PowerShell scripts or even a Python interpreter.
To mitigate this threat, the researchers propose a defense-in-depth strategy focused on static analysis of DICOM files before they enter the hospital network. Their solution employs Shannon’s entropy calculation to detect the high randomness indicative of packed or obfuscated malicious code, specifically within the preamble and private tags. This is combined with YARA rules to scan for known malicious patterns and strings (e.g., script tags). They offer a two-tier scanning approach: a fast “quick scan” of the preamble for a heat map, and a slower, more thorough “aggressive scan” using both entropy and YARA on the full file. This method is designed to be performant even for large gigabyte-sized DICOM files and has been implemented within GE Healthcare’s products, with a patent filed for the entropy-focused preamble analysis technique. The fundamental takeaway is that the DICOM standard’s flexibility creates an inherent attack surface requiring dedicated security validation at the network perimeter.