Is That Really My X-Ray? Measuring Internet-Exposed DICOM Services in the Presence of Deception
Cryptography and Security
Summary
The authors studied how medical imaging systems using the DICOM protocol are exposed to the internet without proper security, risking patient data leaks. They improved methods to filter out false alarms caused by fake or unusual network responses, finding that many systems lack encryption and have known vulnerabilities. Their scans also showed that many exposed systems are not maintained over time, and warnings to operators often lead to only short-term fixes. Using passive monitoring, they observed that many probing activities stop before any real data theft, suggesting attackers test systems and back off if they detect traps. Overall, the authors show that current measurements can be misleading, but real risks to patient privacy remain widespread.
Authors
Ricardo Yaben, Karina Elzer, Alberto Maria Mongardini, Emmanouil Vasilomanolakis
Abstract
DICOM is the dominant protocol for exchanging medical images, yet many Internet-facing deployments lack basic security controls, exposing sensitive patient data to unauthorized access. Accurately measuring this exposure is complicated by honeypots, network telescopes, and other measurement artifacts that inflate published estimates. This paper presents a noise-aware study of Internet-facing DICOM services, combining active IPv4-wide scanning with passive honeypot deployments. We scan common DICOM ports using an ethics-constrained probe limited to association negotiation and C-ECHO. Then, we introduce a reproducible false-positive filtering method that identifies honeypots, telescopes, malformed responders, and other deception artifacts, reducing apparent exposure by 39%. After filtering, we identify 3,979 vulnerable DICOM deployments, all of which lack encryption and accept unauthenticated connections; 1,782 run outdated or deprecated software, and 1,551 carry known remotely exploitable vulnerabilities. Follow-up scans reveal that approximately 50% of exposed services show no evidence of maintenance over 5 months of observation, and that responsible disclosure led to only modest, short-term remediation. On the passive measurement, we deploy Dicompot and find that its raw session logs overstate activity by up to 83% due to generic TCP noise being incorrectly logged as DICOM sessions. After filtering, we observe a reconnaissance gap: Most actors issuing C-ECHO probes never escalate to data exfiltration, consistent with sophisticated actors fingerprinting the honeypot and disengaging before proceeding. Our results show that DICOM exposure measurements can be significantly distorted by deception and logging artifacts, but once corrected, reveal widespread risks to patient privacy and healthcare security that existing deception systems are insufficient to capture.