Call it killer malware?
Israeli researchers have developed a new malware that highlights some very critical and dangerous security vulnerabilities in medical imaging equipment, which is commonly used to diagnose serious health conditions like cancer and hypertrophic cardiomyopathy (HCM).
Not only can the malware impact the diagnosis of the imaging equipment but can also compromise the networks responsible for transmitting the images. There could be life-threatening consequences if the vulnerabilities aren’t fixed immediately, researchers Yisroel Mirsky and Yuval Elovici from the Ben-Gurion University’s Cyber Security Research Center explained.
The computer virus is capable of adding tumors to the images received via medical imaging equipment. An attacker can easily manipulate the CT and/or MRI scan reports by adding realistic looking malignant growth before the radiologists can examine the images and diagnose the disease.
Moreover, through exploiting the vulnerabilities attackers can remove the presence of cancerous lesions and nodules so that the radiologist is unable to detect the disease and end up misdiagnosing the issue. The malware can also affect automated screening systems by manipulating the images.
Understandably, this can lead to devastating outcomes as patients would be receiving the wrong treatment. When tested, the malware could change the results of 70 images and three radiologists were fooled into believing that the patient was suffering from cancer.
Researchers also managed to add fake malignant growth to the MRI and CT scans of a patient’s lungs too and could remove real malignant growth within no time. The malware can be used to create a number of serious health conditions including brain tumors, fractures, blood clots, and spinal injuries.
That’s not all; an attacker can manipulate the CT scans of any popular celebrity, politician or public figure to make people believe that they are suffering from a serious illness. This might affect a politician’s chances to become the top candidate during presidential elections or may affect a sportsman or celebrity’s career badly. Furthermore, such manipulated images can be used to conduct insurance fraud.
The vulnerabilities are present in the networks and equipment used to transmit and store MRI and CT scan images, which are then sent to radiology workstations through PACS (picture archiving and communication system). The test was successful because of the absence of digital signatures and encryption on images when they are stored on the PACS networks.
The reason Ben-Gurion University researchers developed such malware is to highlight the potentially dangerous flaws in security protections enabled for medical diagnostic equipment and associated networks. Researchers claim that medical imaging equipment’s scans are quite vulnerable to exploitation because the files aren’t digitally encrypted and any modifications would be difficult to detect for a radiologist or even the physician.
Watch the video demonstration of this malware:
Hospitals need to tighten up the security of their networks and make their diagnosis equipment results secure enough to not get exploited through viruses. As noted by Mirsky in an interview with the Washington Post, which firstly published the research:
“What happens within the hospital system itself, which no regular person should have access to in general, they tend to be pretty lenient about.”
Mirsky stressed upon the need to encrypt the images/scans as well as assign them digital signatures to ensure that the results stay protected from any exploitation.
Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.
