where expertise comes together - since 1996 -

The Largest Open Access Portal of Nondestructive Testing (NDT)

Conference Proceedings, Articles, News, Exhibition, Forum, Network and more

where expertise comes together
- since 1996 -
208 views
Technical Discussions
Wolfgang Bisle
Engineering, R&D
retired (former Aerospace NDT R&D), Germany, Joined Jul 2011, 14

Wolfgang Bisle

Engineering, R&D
retired (former Aerospace NDT R&D),
Germany,
Joined Jul 2011
14
23:35 Dec-04-2019
DICOM/DICONDE Images Have Been Hacked! Now What?

I am just collecting information about software -preferably open source - to deal with DICOM/DICONDE data (writing/processing/displaying). It is interesting what you find even in GITHUB and SourceForge.

Just reading Wikipedia about DICOM (https://en.wikipedia.org/wiki/DICOM - there is no DICONDE entry available, just some lines in the DICOM article, that's sad) Wikipedia offers a short paragraph about vulnerability of the DICOM data format, which is not really good news for medical IT as well for NDT.
I was than following a link leading to Univ. of South Carolina that took me via PubMed to a headline "DICOM Images Have Been Hacked! Now What?" - https://www.ncbi.nlm.nih.gov/pubmed/31770023" - full text here: https://www.ajronline.org/doi/full/10.2214/AJR.19.21958

I wonder if "Vulnerability" is now an aspect to discuss and improve DICONDE use and implementation even as DICONDE is only a very simple adaptation of the medical data format DICOM and the vulnerabilities discussed in the cited paper seem to exist in DICONDE too. DICONDE being supported by the MAI - Metals Affordability Initiative managed by the Air Force Research Laboratory (AFRL) vulnerability must be an important task to be addressed in military and aeronautic applications.

Today remote maintenance assistance is a hot topic and therefore inspection data go around the world via Internet crossing firewalls, the IT fences around companies often show a lot of holes - and frequently those holes are unknown to the admins. While having been involved in data security concept development and vulnerability analysis when leading a project to develop a NDT teleconferencing tool for remote maintenance assistance in aerospace I had the chance to follow the test of several systems offered in the market, which worked with rather lousy server concepts implementing nearly no vulnerability / intrusion protection.

My question: is the NDT community aware of the danger of vulnerability of such data formats especially in distributed systems and remote clouds?

I haven’t found any information about activities to harden the DICONDE data format. Also the published papers I found did in no way address the need of vulnerability protection.

As in NDT industry less money is earned than in Medic, I would guess that the IT developing capacities in equipment companies too is weaker and less willing to invest into really safe code. Experience with IoT equipment and communication safety speaks for itself: often features are more important than intrusion protection and safe code.
Especially the tendency to use code libraries from various sources in the internet, which are not understood by the programmer, lead to solutions being inherent unsafe.
Do we need an NDT data safety initiative?
Could the big NDT conferences put this topic on the table? It could be interesting to invite maybe people from the famous CCC (Chaos Computer Club) for a Keynote to make the NDT community aware of the challenges being hacked.
What do you think?

 
 Reply 
 
Wolfgang Bisle
Engineering, R&D
retired (former Aerospace NDT R&D), Germany, Joined Jul 2011, 14

Wolfgang Bisle

Engineering, R&D
retired (former Aerospace NDT R&D),
Germany,
Joined Jul 2011
14
01:19 Dec-05-2019
Re: DICOM/DICONDE Images Have Been Hacked! Now What?
In Reply to Wolfgang Bisle at 23:35 Dec-04-2019 (Opening).

Just some more publications about that topic:
• Hacked DICOM Images Can Contain Malicious Executables - https://www.healthcareittoday.com/2019/04/29/hacked-dicom-images-can-contain-malicious-executables/
• Scary hacking threat: editing x-ray-images to add or remove https://www.pcmag.com/news/367598/scary-hacking-threat-editing-x-ray-images-to-add-or-remove
• CT-GAN: Malicious Tampering of 3D Medical Imagery using Deep Learning - https://arxiv.org/pdf/1901.03597.pdf -
• Malware Can Be Hidden in DICOM Medical Imaging Files, DHS Warns - https://www.securityweek.com/malware-can-be-hidden-dicom-medical-imaging-files-dhs-warns
• NCCIC is aware of a public report of a vulnerability in the DICOM (Digital Imaging and Communications in Medicine) standard with proof-of-concept (PoC) exploit code https://www.us-cert.gov/ics/alerts/ICS-ALERT-19-162-01, https://www.dicomstandard.org/wp-content/uploads/2019/05/Press-Release-DICOM-128-Byte-Preamble-Posted1-2.pdf
• New Malicious Medical DICOM Image Files Cause HIPAA Headache https://www.bleepingcomputer.com/news/security/new-malicious-medical-dicom-image-files-cause-hipaa-headache/
• FDA issues warning on medical devices that are vulnerable to takeover from hackers https://www.cnbc.com/2019/10/01/fda-issues-warning-on-medical-devices-that-are-vulnerable-to-cyberattacks.html
• How I got into hacking ultrasound machines: Part 01 https://morphuslabs.com/how-i-got-into-hacking-ultrasound-machines-part-01-432fce2e3ca7
• How I got into hacking ultrasound machines: Part 02 https://morphuslabs.com/how-i-got-into-hacking-ultrasound-machines-part-02-3b16b799974c
• How I got into hacking ultrasound machines: Part 03 https://morphuslabs.com/how-i-got-into-hacking-ultrasound-machines-part-03-b954cb7dd8e8

 
 Reply 
 

Product Spotlight

SONOAIR - air-coupled Phased Array Ultrasonic Inspection System

For highly attenuating materials, the performance of the system is critical. The ultrasonic sensors,
...
the scanning area and the system settings should be flexibly adapted to the test task and the material. These high expectations are met with the new and modular testing system SONOAIR. With the world’s first air-coupled phased-array UT inspection system SONOAIR we developed a technology that works with up to 4 transmitter and receiver channels with freely configurable square wave burst transmitters as wells as low noise receiving amplifiers.
>

NovaScope 6000

The all-digital Novascope 6000 is a portable, ultra-high precision thickness gauge for high-speed
...
thickness measurement. Novascope 6000 has unmatched capabilities and unique features including: •Superior Resolution with high contrast, high-speed color RF display •High pulser voltage •Real-time video output •Increased internal/external data storage •Programmable SetUp features •Battery & AC Powered
>

Varex Imaging Large Field of View (FOV) Digital Detector Arrays (DDAs)

A larger FOV DDA can reduce the space and volume of the X-ray inspection system on the factory floor
...
, enable faster scanning times, better throughput and better resolution images at a lower dose. Customers can also save time and money. With these benefits in mind, Varex Imaging has designed a family of large FOV detectors (4343HE, XRD 1611, 4343DX-I, 4343CT) for our industrial imaging customers.
>

Research Center IDEKO develops an ultrasonic train wheel inspection system for CAF

The Basque Research centre IK4-IDEKO has developed a state-of-the-art ultrasonic inspection system f
...
or the train wheel. This system secures a sound condition of train wheels and is thus a significant contribution to rail transport safety. The device was delivered to CAF recently and its use allows the manufacturer to become an approved supplier of rolling stock in Italy, as it meets the demanding homologation standards of this country. \\\\r\\\\n
>

Share...
We use technical and analytics cookies to ensure that we will give you the best experience of our website - More Info
Accept
top
this is debug window