1. EXECUTIVE SUMMARY
NCCIC is aware of a public report of a vulnerability in the DICOM (Digital Imaging and Communications in Medicine) standard with proof-of-concept (PoC) exploit code. The DICOM standard is the international standard to transmit, store, retrieve, print, process, and display medical imaging information. According to this report, the vulnerability is exploitable by embedding executable code into the 128 byte preamble. This report was released without coordination with NCCIC or any known vendor.
NCCIC has notified some of the affected vendors who may utilize the DICOM Standard (primarily in the healthcare industry) about the report to confirm the vulnerability and to identify mitigations. NCCIC is issuing this alert to provide notice of the report and identify baseline mitigations for reducing risks of these and other cybersecurity attacks.
The report included vulnerability details and PoC exploit code for the following vulnerability:
| Vulnerability Type | Exploitable Remotely | Impact |
|---|---|---|
| Input Validation | No—Requires Local Access | Possible Embedded Malware in Portable Medical Imagery |
Please report any issues affecting medical systems in critical infrastructure environments to NCCIC.
DICOM is widely used throughout the Healthcare and Public Health Sector for portability in medical imaging; it uses the .dcm file extension.
Successful exploitation of this vulnerability could allow an attacker to embed executable code into image files used by medical imaging devices. The severity of any attack varies depending on the type and intent of the executable code embedded within the preamble. It is important to note this code can be embedded in a way that allows the code to be a functioning Windows executable while not interfering with the readability and functionality of the DICOM imagery.
The vulnerability was discovered by Markel Picado Ortiz of Cylera Labs and has been issued CVE-2019-11687.
2. MITIGATIONS
NCCIC is currently coordinating with multiple stakeholders to identify any potential mitigations.
The DICOM Security Group has provided a statement for user strategies on how to mitigate the risk titled:
DICOM STATEMENT ON REPORTED MALWARE VULNERABILITY
DICOM SECURITY GROUP PROVIDES USER STRATEGIES TO MITIGATE RISK
This statement is found at the following location: https://www.dicomstandard.org/dicom-in-the-news/
NCCIC recommends that users affected by the vulnerability in the DICOM Standard implement an AV (Antivirus) solution on all medical imaging systems. NCCIC recommends that affected users reach out to their specific AV vendor to determine if their solution properly scans for the affected file type. In the situation where an AV solution cannot be installed, affected users should take steps to make sure that they have processes and procedures in place to scan portable/removable media for suspicious files before introducing the media into their medical networks.
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Source:
https://ics-cert.us-cert.gov/alerts/ICS-ALERT-19-162-01