Detecting Evil DICOM: Tools and Best Practices for HospitalsMedical imaging underpins modern diagnostics. DICOM (Digital Imaging and Communications in Medicine) files and Picture Archiving and Communication Systems (PACS) are core infrastructure in hospitals — and they’re increasingly a target. “Evil DICOM” refers to malicious or malformed DICOM files and related behaviors that can corrupt images, disclose sensitive data, or be used as an attack vector against imaging systems. This article explains why Evil DICOM matters, how to detect it, which tools help, and practical best practices hospitals can implement.
Why Evil DICOM is a serious risk
- DICOM files contain both pixel data (images) and rich metadata (patient identifiers, device settings, acquisition context). That combination makes them attractive for abuse: metadata can leak PHI, while crafted pixel or header content can trigger software bugs.
- Imaging modalities and PACS are often on segmented but not fully isolated networks and may run legacy software with known vulnerabilities.
- Radiology workflows rely on automated ingestion and processing; a single malformed file can propagate errors across systems, delay care, or be leveraged as a foothold for lateral movement.
- Regulatory and privacy consequences: exposure of Protected Health Information (PHI) can lead to legal penalties and reputational harm.
Types of Evil DICOM incidents
- Malformed headers that crash or confuse DICOM parsers.
- Payloads containing hidden or steganographic data (exfiltration).
- Manipulated image pixels (tampered studies used to mislead diagnosis).
- Files carrying exploits targeting viewer/PACS vulnerabilities.
- Misconfigured DICOM servers exposing studies publicly (open PACS).
Detection goals and indicators of compromise (IoCs)
Primary goals:
- Detect malformed or anomalous DICOM files before they reach clinical viewers.
- Identify suspicious metadata that suggests exfiltration or misuse.
- Detect behavioral anomalies in imaging systems and network traffic.
Common IoCs:
- Unexpected or malformed DICOM tags (nonstandard VRs, reserved tags used).
- Extremely large or unusually small file sizes for given modality.
- Repeated transfer retries or parser errors logged by PACS/viewers.
- New AE titles, unexpected IPs, or connections from unusual network segments.
- Changes in series/patient identifiers inconsistent with hospital naming conventions.
- Presence of encrypted/obfuscated payloads or image regions with steganographic signatures.
Tools for detecting Evil DICOM
Below is a practical list of tools spanning file inspection, network monitoring, PACS hardening, and specialized scanners.
-
DICOM parsers and validators:
- dcm4che (dcm2dcm, dcmqr, dcm2json): robust Java toolkit for parsing and validating DICOM. Useful for batch validation and conversion.
- pydicom: Python library for reading/writing DICOM; suitable for scripting checks and automating metadata inspections.
- GDCM (Grassroots DICOM): C++ library with command-line utilities for validation and conversion.
-
File scanners and integrity tools:
- ClamAV or other AV engines with DICOM-aware rules (limited but useful as part of layered defense).
- Custom scripts using pydicom to validate tags, check for forbidden private tags, and verify pixel data shapes.
- Yara rules tailored for known malicious payload patterns within files.
-
PACS and viewer-focused tools:
- Vendor-supplied logging and audit features — enable and centralize logs for DICOM association, C-STORE operations, and failures.
- DICOM proxy/guard solutions that validate and sanitize DICOM before insertion into PACS (commercial and open-source options exist).
- Modality Worklist and Archive access controls to limit which devices can send/receive.
-
Network and behavior monitoring:
- IDS/IPS tuned for DICOM/PACS protocols (e.g., Zeek/Bro with DICOM scripts, Suricata with DICOM-aware rules).
- NetFlow/PCAP capture for forensic analysis of DICOM transfers.
- SIEM integration to correlate PACS logs, modality events, and network alerts.
-
Image forensic and tamper detection:
- Tools for pixel-level integrity checks: compute and compare cryptographic hashes per-instance or per-frame.
- Perceptual hashing or image similarity tools to detect unexpected changes between acquisitions.
- Specialized research tools for detecting image manipulation or synthetic content.
Practical detection workflows
-
Ingest validation pipeline
- Route incoming C-STORE operations through a DICOM proxy that:
- Parses and validates required tags.
- Rejects non-conforming transfers (return appropriate DICOM status).
- Logs rejections and flags anomalous metadata.
- Use pydicom or dcm4che in the proxy for flexible inspection and transformations.
- Route incoming C-STORE operations through a DICOM proxy that:
-
Metadata and PHI auditing
- Extract metadata to a central index (Elasticsearch or similar).
- Apply rules to detect unusual tag usage (private tags, oversized patient names, unusual formatting).
- Alert on bulk exports, unusual search patterns, or patient ID mismatches.
-
Pixel integrity checks
- Compute hashes on pixel data at ingestion; store and periodically verify.
- For critical studies, store signed manifests or use digital signatures to detect tampering.
-
Network anomaly detection
- Monitor for unusual DICOM AE associations, unexpected source IPs, and abnormal volumes of C-STORE operations.
- Correlate failures and retries — repeated parser errors may indicate malicious files.
-
Forensic capture
- Maintain short-term PCAP capture windows on imaging VLANs for rapid forensic retrieval after suspicion.
- Retain full DICOM object logs (source AE, destination AE, SOPInstanceUID, timestamps).
Integration with hospital security stack
- SIEM: centralize PACS/viewer logs, proxy logs, and IDS alerts. Build correlation rules tying DICOM parser errors to device endpoints and user accounts.
- EDR: monitor imaging servers and viewer workstations for suspicious processes or lateral movement following a DICOM-related crash.
- Vulnerability management: prioritize imaging software and PACS for scanning and patching.
- Backup & recovery: ensure immutable backups for PACS and image archives; test recovery procedures to restore trusted image sets.
Hardening measures and prevention
- Network segmentation: place modalities and PACS on a dedicated, controlled VLAN with strict ACLs. Require approved gateways to reach PACS.
- Access controls: enforce strong authentication for modality configuration and PACS admin consoles. Limit AE title registrations and whitelist IPs.
- DICOM protocol restrictions: disable unnecessary services (e.g., DICOM web if unused), restrict C-ECHO/C-FIND permissions.
- Update and patching: maintain vendor software updates; test patches in isolated labs before production rollout.
- Least privilege: imaging workstation accounts should run with minimal privileges; avoid use of generic admin accounts for routine workflows.
- Data minimization: remove or redact unnecessary PHI from exported DICOM objects; enforce policies for de-identification where appropriate.
- Digital signing: where supported, enable DICOM Digital Signatures to detect tampering.
Operational best practices
- Baseline and inventory: maintain an accurate inventory of imaging devices, AE titles, and software versions.
- Logging and retention: ensure detailed logs for DICOM transfers and parser errors are retained long enough to investigate incidents.
- Incident response playbook: define a playbook specific to imaging incidents (isolate device, preserve DICOM files and PCAPs, validate integrity).
- Tabletop exercises: run scenario-based exercises (malformed DICOM causing viewer crash, mass exfiltration via private tags) with IT, radiology, and security teams.
- Staff training: teach radiology techs and PACS admins to spot suspicious studies, reporting channels, and safe-handling procedures for unknown media.
- Vendor engagement: include vendors in security testing and require secure configuration guidance and timely patching commitments.
Example checks and code snippets
Below are concise examples (Python/pydicom) to illustrate common detection checks.
- Validate required tags and detect private tags: “`python from pydicom import dcmread from pydicom.tag import Tag
ds = dcmread(“study.dcm”, stop_before_pixels=True) required = [Tag(0x0010,0x0010), Tag(0x0008,0x0020)] # PatientName, StudyDate missing = [str(t) for t in required if t not in ds] private_tags = [t for t in ds.iterall() if t.is_private]
2) Check pixel data shape and size: ```python ds = dcmread("image.dcm") rows, cols = int(ds.Rows), int(ds.Columns) expected = rows * cols * (ds.BitsAllocated // 8) actual = len(ds.PixelData) if actual != expected: print("Pixel size mismatch") - Extract and flag unusual tag values:
suspicious = [] if len(ds.PatientName) > 128: suspicious.append("LongPatientName") if "http" in str(ds.get((0x0010,0x0010), "")): suspicious.append("URL in patient name")
Detection limitations and challenges
- False positives: legitimate vendor-specific private tags or unusual patient naming conventions can trigger alerts; tune rules carefully.
- Performance: inline validation at scale can introduce latency. Balance between synchronous validation and asynchronous scanning.
- Legacy systems: older modalities may be incompatible with modern proxies or signing; incremental rollouts and compensating controls are necessary.
- Resource constraints: smaller hospitals may lack dedicated SOC resources; leverage managed services or lightweight open-source stacks.
Recommendations — prioritized roadmap
- Inventory and baseline: identify devices, AE titles, and PACS software versions. (High priority)
- Enable and centralize logging for PACS and modality associations. (High)
- Deploy an ingestion DICOM proxy to validate and sanitize incoming studies. (High–Medium)
- Integrate DICOM logs into SIEM and build correlation rules for parser errors and unusual transfers. (Medium)
- Implement network segmentation and strict ACLs for imaging networks. (High)
- Start hashing critical-study pixel data and implement periodic integrity checks. (Medium)
- Conduct tabletop exercises and staff training. (Medium)
- Work with vendors to enable digital signatures and apply timely patches. (Ongoing)
Conclusion
Detecting Evil DICOM requires a layered approach: validate and sanitize files at ingestion, monitor metadata and network behavior, harden PACS and modality configurations, and integrate findings into the hospital’s broader security operations. Practical tooling—pydicom/dcm4che, DICOM proxies, IDS rules, SIEM correlation—combined with strong operational practices (inventory, logging, incident playbooks, segmentation) will significantly reduce risk and improve detection.
Leave a Reply