HL7Magic: Medical Data Hacking Made Easy

HL7Magic: Medical Data Hacking Made Easy

Speakers: Katie Inns, Head of Attack Surface Management Team, WISecure

Conference: 44CON

YouTube: https://www.youtube.com/watch?v=IpYa_MYc9HE

Overview

This talk, "HL7Magic: Medical Data Hacking Made Easy," presented by Katie Inns, Head of Attack Surface Management at WISecure, delves into the critical and often overlooked vulnerabilities within the healthcare industry's digital infrastructure, specifically focusing on the Health Level 7 (HL7) protocol. Inns highlights the alarming increase in cyberattacks targeting healthcare, emphasizing that this sector has become one of the most targeted, on par with the financial industry, yet remains severely underfunded in terms of security. The presentation serves as a "call to arms" for the cybersecurity community to contribute to securing healthcare systems, which historically have been reluctant to openly discuss their vulnerabilities.

The core of Inns' research centers on HL7, a legacy protocol widely used for exchanging electronic health information between medical applications. Despite its critical role, HL7 v2, the most prevalent version, lacks fundamental security features, making it highly susceptible to various attacks. Inns not only elucidates these vulnerabilities but also introduces HL7Magic, a custom Burp Suite plugin she developed to simplify the security testing of HL7 implementations, thereby making it easier for security professionals to identify and address these weaknesses. The talk underscores the severe implications of these vulnerabilities, ranging from data breaches and financial losses to potentially life-threatening impacts on patient care.

The significance of this research cannot be overstated. With the rapid proliferation of internet-connected medical devices—projected to reach 760 million by 2026—the attack surface of healthcare organizations is expanding dramatically. The sensitive nature of patient health information (PHI) makes it a lucrative target on the dark web, further incentivizing attackers. By demystifying the complexities of HL7 and providing practical tools and insights, Inns empowers defenders to proactively identify and mitigate risks in a sector where security failures can have catastrophic consequences, urging a collaborative effort to enhance the resilience of healthcare systems against an evolving threat landscape.

Background

▶ Watch: Introduction to healthcare security and HL7 protocol (0:00)

The healthcare industry faces an escalating and increasingly sophisticated threat landscape. Research from Checkpoint revealed a staggering 1,684 attacks against the healthcare industry in just the first three months of 2023, positioning it as one of the most targeted sectors, comparable to finance. This surge is attributed to a combination of factors: historically underreported attacks, a shift in motive among ransomware groups who previously avoided healthcare but now actively target it, and the inherent value of personal healthcare information (PHI) on the dark web, coupled with the industry's pervasive underfunding in cybersecurity.

Top Threats to Healthcare in 2024: The talk identifies common threats such as ransomware, data breaches, and a growing concern around Internet of Medical Things (IoMT) devices.

Data Breaches: Often a consequence of other attacks like ransomware, data breaches in healthcare are exceptionally costly. An IBM report indicated that a healthcare data breach costs organizations approximately $9.77 million, a figure 11% lower than 2023 but still significantly higher than other industries. Common initial access vectors include phishing, malware, and exploiting software vulnerabilities. A critical finding is the prolonged time to identify a breach in healthcare, averaging 213 days—19 days slower than the cross-industry average. A notable example cited is the 2023 data breach at the online mental health platform Cereal, which impacted 3.1 million patients due to the unauthorized use of tracking pixels sending sensitive mental health assessment data to big tech companies like Meta and TikTok without consent.

Ransomware: The first recorded ransomware attack in 1989 notably targeted the healthcare industry. More recently, the WannaCry attack in 2017 severely impacted the NHS, affecting around 200,000 systems globally. In 2023, approximately 630 ransomware incidents were observed worldwide, with initial access often gained through phishing, exploiting software vulnerabilities, and targeting exposed services like RDP. A high-profile example from early 2024 involved Change Healthcare, a company managing payments between patients and providers. This ransomware attack cost them around $2 million, led to the theft of 4 terabytes of data, and affected a third of Americans through data leaks. The breach occurred via stolen credentials used against a Citrix instance lacking MFA, attributed to an affiliate of the BlackCat group. A unique aspect of this incident was BlackCat's decision to shut down operations and withhold payment from their affiliate, leading the affiliate to leak the stolen data, implying Change Healthcare may have effectively paid two ransoms.

Medical Devices: While medical devices have a long history (X-rays in 1895, first medical record systems in the 1960s), the increasing connectivity presents new security challenges. IoMT devices are projected to reach 760 million by 2026, necessitating security considerations from manufacturing to deployment. Research by Clarity highlighted that 63% of vulnerabilities tracked on CISA's Known Exploited Vulnerabilities (KEV) catalog can be found in hospital networks, and 23% of medical devices have at least one known exploited vulnerability. These devices, ranging from patient monitors to lab equipment and pharmacy systems, represent potential access vectors for attackers.

Data Communication Protocols: Communication within healthcare networks relies on several protocols:

• FHIR (Fast Healthcare Interoperability Resources): A newer protocol designed by the HL7 standards organization for simpler data communication via APIs. While intended to be more secure, misconfigured APIs have led to compromises, such as one instance where 4 million patient records were accessed. A Shodan search revealed around 256 FHIR servers exposed to the internet.
• DICOM (Digital Imaging and Communications in Medicine): Used for transmitting and storing medical images. Clarity research uncovered path traversal vulnerabilities in DICOM that could lead to remote code execution. A Shodan scan identified approximately 5,600 DICOM servers exposed to the internet, many of which are misconfigured.
• HL7 (Health Level 7): The primary focus of Inns' research. Originally released in 1979, its version 2 is the most commonly used due to a lack of backward compatibility in version 3. HL7 messages are typically transported using the Minimal Lower Layer Protocol (MLLP) over TCP/IP and, critically, are often communicated in clear text.

Key Findings

▶ Watch: High cost of healthcare data breaches (average $9.77M) (4:50)

Katie Inns' research into HL7 exposes a series of critical vulnerabilities inherent in its design and common deployment, highlighting why this widely used, legacy protocol poses a significant threat to healthcare security:

• Ubiquitous and Outdated: HL7 is the most commonly used protocol in the healthcare industry, with version 2 being predominant. This version, dating back to 1979, was not designed with modern security considerations in mind, making it inherently vulnerable.
• Clear Text Communication: A fundamental flaw is that HL7 messages are almost universally communicated in clear text when transported over TCP/IP using MLLP. Unless TLS is explicitly configured (which is rarely the default or even enabled), all patient data, including sensitive information, is transmitted unencrypted, making it trivial for attackers to intercept and read.
• Lack of Authentication by Default: HL7 does not require any form of authentication to send or receive messages. An attacker, once on the network, can send any message to any device or server, and the recipient will assume its legitimacy. While a User Authentication Credential Segment exists for Kerberos or SAML authentication, it is not enabled by default and rarely implemented.
• Vulnerability to Message Tampering: Due to the lack of authentication and clear-text communication, an attacker positioned on the network can easily intercept and amend HL7 message contents. This allows for malicious alteration of critical patient data, such as changing patient identifiers or allergen information.
• Denial of Service (DoS) Potential: HL7 middleware applications often have low maximum connection limits (e.g., 10 connections observed in testing). This makes them susceptible to simple DoS attacks by exceeding the connection threshold, potentially disrupting critical healthcare services.
• Difficulty in Security Testing: HL7 is notoriously difficult to fingerprint due to the absence of default ports and reliable signatures for tools like Nmap. Furthermore, its non-standard structure makes it challenging for generic security tools to parse and analyze. Manually reading and interpreting raw HL7 messages, especially in bulk, is highly inefficient.
• Widespread Internet Exposure and Misconfiguration: Beyond HL7, other medical protocols like FHIR and DICOM, and the devices that use them, are frequently exposed to the internet and often misconfigured. Shodan searches revealed 256 exposed FHIR servers and 5,600 exposed DICOM servers, each representing a potential access vector for attackers.
• Severe Impact Potential: The exploitation of HL7 vulnerabilities can lead to dire consequences, extending beyond data breaches to direct patient harm. Altering medical records, such as allergen information, could result in the prescription of incorrect drugs, potentially leading to severe or fatal outcomes for individuals.

These findings collectively paint a stark picture of the security posture of many healthcare environments, emphasizing the urgent need for a systematic approach to identify and remediate these deep-seated protocol and configuration weaknesses.

Technical Deep Dive

▶ Watch: Cerebral mental health platform data breach analysis (6:00)

HL7, particularly version 2 (v2), forms the backbone of data exchange in many healthcare environments. Its structure is relatively simple, yet its lack of inherent security mechanisms, combined with its widespread use, creates significant vulnerabilities. An HL7 message is composed of multiple segments, each identified by a three-character code (e.g., MSH for Message Header, PID for Patient Identification, AL1 for Allergy Information). Within each segment, fields are separated by a pipe | character. The message begins with an MSH segment, which includes the message type (e.g., ADT for Admissions, Discharges, and Transfers) and the event segment, indicating when and where the message originated. Other common segments include patient identifiers, next of kin information, and allergen details. While not all segments are mandatory, specific fields within required segments must be present for the message to be accepted by a server.

The most common transport mechanism for HL7 v2 messages over TCP/IP is the Minimal Lower Layer Protocol (MLLP). MLLP wraps each HL7 message with a start block, an end block, and a carriage return. This wrapping is crucial for message delimitation, ensuring that individual HL7 messages are not mixed up during transmission and can be correctly processed by the receiving server. However, MLLP itself does not provide any security features like encryption or authentication.

The talk highlights several critical vulnerabilities stemming from HL7's design:

1. Lack of Authentication: By default, HL7 does not enforce any authentication. An attacker, once present on the network, can craft and send arbitrary HL7 messages, and the receiving system will process them as legitimate. While HL7 does support a User Authentication Credential Segment for integrating Kerberos or SAML, this feature is rarely enabled or configured, leaving systems open to unauthenticated access and manipulation.
2. Message Amendment and Tampering: Given the clear-text nature of HL7 communication and the absence of authentication, an attacker capable of intercepting network traffic can easily modify the contents of HL7 messages in transit. This could involve altering patient names, medical records, test results, or, most critically, allergen information. The potential for patient harm here is significant, as incorrect medical data could lead to misdiagnosis or improper treatment, such as prescribing drugs to which a patient is allergic.
3. Denial of Service (DoS): Middleware applications and HL7 servers often have low limits on the maximum number of concurrent connections they can handle. Inns' testing revealed limits as low as 10 connections. An attacker can exploit this by initiating numerous connections, quickly overwhelming the server and causing a DoS, which could disrupt critical patient care systems.
4. Man-in-the-Middle (MITM) and ARP Spoofing: The clear-text transmission of HL7 messages makes them highly vulnerable to MITM attacks and ARP spoofing. An attacker can position themselves between a medical device and an HL7 server, intercepting, reading, and modifying all traffic without detection, assuming no other security controls are in place. This provides complete control over the flow of patient data.

The speaker emphasizes the challenges associated with security testing HL7:

• Difficult Fingerprinting: HL7 does not use standardized default ports, making it hard to discover instances using common scanning tools like Nmap. Attempting to port scan legacy medical devices can also be dangerous, as it often crashes them.
• Clear-Text by Default (No TLS): While some devices or middleware might offer an option for TLS encryption, it's rarely enabled by default, necessitating manual configuration.
• Non-Standard Protocol: HL7's specific structure and variations between implementations mean that generic security tools often cannot parse or handle its messages effectively.
• Readability Issues: Raw HL7 messages, especially in MLLP format, are difficult for humans to read and parse efficiently, making manual analysis of intercepted traffic (e.g., in Wireshark) cumbersome and prone to error, particularly when dealing with high volumes of data.

To address these testing challenges, Inns developed HL7Magic, a Burp Suite plugin. The design philosophy behind HL7Magic was to enable security professionals to test HL7 systems with the same ease and familiarity as testing HTTP/web applications. The tool leverages a man-in-the-middle relay (such as one allowing non-HTTP traffic proxying) to intercept HL7 communications. Once a message hits Burp Suite, HL7Magic dynamically parses its contents using the hl7apy Python library. It then converts the complex HL7 message structure into a more human-readable JSON format, allowing testers to easily view and modify segments and fields. After modifications, the tool converts the JSON back into the correct HL7 format, including the MLLP wrapper, and forwards it to the intended server. This dynamic parsing and conversion capability makes HL7Magic compatible with any version of HL7 and any segment content, significantly streamlining the security testing process for medical devices.

Demo / Proof of Concept

▶ Watch: History and impact of ransomware on healthcare (6:50)

Katie Inns presented two compelling demonstrations of HL7Magic, her custom Burp Suite plugin, illustrating the ease with which HL7 messages can be intercepted, read, and modified. Both demonstrations utilized a man-in-the-middle relay to proxy non-HTTP traffic through Burp Suite, showcasing the tool's effectiveness in a real-world scenario.

The setup for both demos involved:

• A client (either an emulator or a physical medical device) sending HL7 messages.
• A server configured to receive and process HL7 messages.
• A man-in-the-middle relay tool listening on a specific port (e.g., 8880 or 4000) for client traffic and forwarding it to Burp Suite.
• Burp Suite, with HL7Magic enabled, listening on another port (e.g., 8081) to intercept the relayed traffic.
• The man-in-the-middle relay then forwards the processed traffic from Burp Suite to the HL7 server.

Demo 1: Client Emulator

In the first demonstration, an HL7 client emulator was used to send a pre-defined HL7 message to a server. The message contained standard patient information, including a patient name like "Mickey Mouse."

1. The client emulator sent the HL7 message, which was intercepted by the configured man-in-the-middle relay.
2. The relay forwarded the raw HL7 message to Burp Suite.
3. Upon reaching Burp, the message was initially displayed in its raw, difficult-to-read HL7 format.
4. HL7Magic, however, dynamically parsed the message and presented its contents in a clear, structured JSON format within a dedicated tab in Burp. This allowed the attacker (Inns) to easily identify all segments and fields.
5. Inns then demonstrated modifying the patient's name from "Mickey Mouse" to "Bob Mouse" directly within the JSON interface.
6. HL7Magic automatically converted the modified JSON back into the correct HL7 v2 format, complete with the MLLP wrapper.
7. The altered message was then forwarded by Burp Suite, through the man-in-the-middle relay, to the server. The server accepted this modified message without issue, demonstrating the lack of authentication and integrity checks.

Demo 2: Philips SureSigns Patient Monitor

The second, more impactful demonstration involved a physical Philips SureSigns Patient Monitor. Inns connected herself to the monitor, which then began sending real-time vital signs (e.g., blood oxygen and heart rate readings) as HL7 messages.

1. The patient monitor transmitted HL7 messages containing Inns' vital signs. These were intercepted by the man-in-the-middle relay.
2. The relay forwarded the traffic to Burp Suite, where HL7Magic again parsed the messages into readable JSON.
3. Similar to the first demo, Inns first changed the patient's name, this time from "Donald Trump" to "Donald Duck," to illustrate basic data manipulation.
4. Crucially, she then demonstrated the ability to tamper with the actual medical readings. She altered the blood oxygen readings and heart rate readings within the JSON interface.
5. HL7Magic converted these maliciously modified readings back into the HL7 format.
6. The tampered message was forwarded to the server, which again accepted it as legitimate.

These demonstrations unequivocally proved that, in the absence of proper security controls like encryption and authentication, HL7 messages are trivial to intercept and modify. The ability to alter critical patient data, such as vital signs or allergen information, highlights the severe, potentially life-threatening impact that exploiting these vulnerabilities could have in a healthcare setting. The HL7Magic tool makes this process accessible and efficient for security researchers, enabling them to identify these critical weaknesses more readily.

Defensive Implications

▶ Watch: Change Healthcare ransomware attack costing $2 million (8:00)

The vulnerabilities inherent in HL7 and the broader healthcare IT landscape necessitate a robust and multi-faceted defensive strategy. Katie Inns' research provides critical insights for healthcare organizations and security professionals aiming to bolster their defenses:

1. Know Your Attack Surface: This is Inns' top recommendation, emphasizing an Attack Surface Management (ASM) approach. Organizations must gain a comprehensive understanding of all their digital assets, including every medical device, server, and application. This involves identifying what is exposed to the internet, what protocols are in use (specifically whether HL7 messages are communicated in clear text), and how devices are communicating. A thorough inventory provides a clear picture of potential risks and helps prioritize mitigation efforts.
2. Network Segregation: A fundamental security principle, network segregation is paramount in healthcare. Medical devices, especially those handling sensitive patient data or critical functions, should never reside on the same network as guest Wi-Fi or less trusted segments. Isolating these devices into dedicated, tightly controlled network zones (e.g., using VLANs or micro-segmentation) significantly limits an attacker's ability to move laterally and access critical systems if an initial compromise occurs elsewhere.
3. Implement a Robust Patch Management Process: The Clarity research cited in the talk revealed that a significant 23% of medical devices contain at least one known exploited vulnerability. Furthermore, 63% of CISA's Known Exploited Vulnerabilities (KEV) catalog can be found in hospital networks. This underscores the urgent need for a disciplined and timely patch management program. Organizations must identify all vulnerable devices, track available patches, and apply them promptly, even for older or embedded systems, to close known attack vectors.
4. Enforce Authentication and Encryption: Where available, healthcare organizations must actively configure and enable authentication for HL7 communications. While the User Authentication Credential Segment exists, it is not enabled by default. Similarly, TLS encryption should be enforced on all HL7 transport layers. This prevents unauthenticated message sending, protects data integrity, and thwarts clear-text interception and modification attacks like MITM.
5. Avoid Port Scanning Production Medical Devices: Inns explicitly warns against port scanning legacy medical devices in production environments, as this can easily cause them to crash or become inoperable. Security testing of such devices should always be conducted in isolated, non-production environments using safe, approved methodologies.
6. Continuous Monitoring and Anomaly Detection: Implement robust network monitoring solutions capable of detecting unusual traffic patterns, unauthorized connection attempts, or suspicious HL7 message flows. Anomaly detection systems can help identify potential attacks that bypass traditional perimeter defenses.
7. Vendor Engagement and Security by Design: Healthcare organizations should advocate for improved security from medical device manufacturers. This includes demanding devices with secure-by-default configurations, easier patching mechanisms, and built-in support for modern security protocols (e.g., TLS 1.3, strong authentication).
8. Security Awareness Training: Educate healthcare staff about common attack vectors like phishing, as it remains a primary initial access vector for ransomware and data breaches. A security-aware workforce is a crucial first line of defense.

By proactively addressing these defensive implications, the healthcare industry can significantly reduce its attack surface, mitigate the impact of cyberattacks, and ultimately safeguard patient data and care.

Key Takeaways

• Healthcare is a Prime Target: The healthcare industry is experiencing a significant surge in cyberattacks, rivaling the financial sector, driven by the high value of patient data and historical underfunding in security.
• Legacy Protocols Pose Critical Risks: Widely used, older protocols like HL7 v2 are inherently insecure by design, lacking fundamental authentication and encryption capabilities, making them vulnerable to easy exploitation.
• Severe Patient Harm is Possible: Exploiting HL7 vulnerabilities can lead to the interception and modification of critical patient data (e.g., allergen information, vital signs), with direct and potentially life-threatening consequences for patient safety.
• Security Testing is Challenging but Essential: HL7 systems are difficult to fingerprint and analyze with standard security tools due to their non-standard nature and clear-text communication. Specialized tools like HL7Magic are crucial for effective security assessments.
• Attack Surface Management is Key: Healthcare organizations must gain a comprehensive understanding of their digital assets, including all medical devices and their communication methods, to identify and prioritize risks effectively.
• Implement Foundational Security Controls: Robust defensive measures, including strict network segregation for medical devices, diligent patch management, and the mandatory implementation of authentication and encryption, are non-negotiable for protecting healthcare infrastructure.

About the Speaker(s)

Katie Inns is the Head of the Attack Surface Management Team at WISecure. Her work often involves keeping a close eye on actively exploited vulnerabilities in the wild, drawing from sources like CISA's Known Exploited Vulnerabilities catalog. While her primary role focuses on attack surface management, healthcare security has been a significant "side project" for her over the past couple of years, leading to this in-depth research. She initially presented this research at Defcon and provided an extended edition for 44CON, demonstrating her commitment to raising awareness and improving security in the healthcare sector. Inns consistently weaves the principles of Attack Surface Management throughout her discussions, underscoring its relevance to healthcare security.