Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A billion medical images are exposed online

techcrunch.com

Post reply on HN
Print view View original

171–180 of 201 posts

Re: A billion medical images are exposed online

#171

Post by [deleted] »

matz1 wrote: post #163
kjs3 wrote: post #159

Earlier quoted context omitted.

Yes, everyone has to participate in ensuring security; how completely divorced from reality do you have to be to think otherwise. And we need security professionals to remind everyone that security is important and we all have to be part of ensuring it.

Sure but if it become annoying then most people, including me will choose convinience over security every time. That's where I critize security professional. They often disregard this end user pain. You have to find frictionless solution and shouldn't impact their productivity.

[deleted]

Re: A billion medical images are exposed online

#172

Post by martyvis »

matz1 wrote: post #163
kjs3 wrote: post #159

Earlier quoted context omitted.

Yes, everyone has to participate in ensuring security; how completely divorced from reality do you have to be to think otherwise. And we need security professionals to remind everyone that security is important and we all have to be part of ensuring it.

Sure but if it become annoying then most people, including me will choose convinience over security every time. That's where I critize security professional. They often disregard this end user pain. You have to find frictionless solution and shouldn't impact their productivity.

As recently as maybe 20 years ago we learned a lot patient infection in hospital was caused by patient-to-doctor-to-patient transfer. Things like disposable gloves and hand cleaning stations at every bed were resisted by doctors initially as being over the top. Now they are ubiquitous once the benefits were proven. Maybe the same approach for IT as for germ security can be demonstrated, and that everyone needs to participate.

Re: A billion medical images are exposed online

#173

Post by jacquesm »

gambiting wrote: post #116
txcwpalpha wrote: post #31

Earlier quoted context omitted.

I’ve been the IT vendor in this scenario. While I’m sure there are plenty of inept vendors not doing their part to ensure the systems they implement are secure, a big part of it is doctors and their work culture. Many doctors see themselves as too important to deal with security. They have an attitude of “I went to school for medicine, not computers! How dare you ask me to use a computer.” They are not only technolog…

On the other hand(and I'm really not trying to excuse this behaviour) some doctors are almost daily in situations where "if I had a little bit more time or did this thing a day earlier maybe the patient would still be alive". If you run into those kinds of situations frequently, then obviously any slowdown(like having to remember or type in a password) is obviously stupid. And only they understand it, no IT employee…

That is why plenty of medical systems have an override in place for emergency situations allowing you to bypass all but the most basic authentication and segmentation. You will usually need to explain your override afterwards.

Re: A billion medical images are exposed online

#174

Post by jacquesm »

kjs3 wrote: post #148
matz1 wrote: post #144

Earlier quoted context omitted.

Yes password are annoyance, friction and waste of time. Not to mention 2FA that is worse. For the Dr, his upmost concern is to treat the patient not deal with extra layer of annoyance. As an IT or security personel your job is to support them and assure security without creating extra friction or productivity loss. Yes it is hard but that is the challenge. This is what a often neglected by security professional and j…

Hey, thanks for the condescension. You know what else our job as "security personel" (sic) is? Other than literacy, it's matching controls to risk. The guy who talked about "people dying" was a urologist; I can assure you the no one was going to die in his office because of passwords. So, yes, we should reduce friction where it's appropriate, but unless you understand the actual risk model, maybe you should keep your…

> The guy who talked about "people dying" was a urologist; I can assure you the no one was going to die in his office because of passwords.

I know of exactly one case where you would have been completely wrong. Emergency surgery straight from the urologists office is what saved the patient. Some people simply go to the hospital much too late when they have issues.

Re: A billion medical images are exposed online

#175

Post by gambiting »

jacquesm wrote: post #173
gambiting wrote: post #116

Earlier quoted context omitted.

On the other hand(and I'm really not trying to excuse this behaviour) some doctors are almost daily in situations where "if I had a little bit more time or did this thing a day earlier maybe the patient would still be alive". If you run into those kinds of situations frequently, then obviously any slowdown(like having to remember or type in a password) is obviously stupid. And only they understand it, no IT employee…

That is why plenty of medical systems have an override in place for emergency situations allowing you to bypass all but the most basic authentication and segmentation. You will usually need to explain your override afterwards.

I'm not talking about emergencies - I'm talking about situations where someone comes in for a "routine" blood test, but it shows they have cancer, and you as a doctor end up blaming yourself for not spending 10 minutes more to look at the test the day before, and the most obvious thing to blame for not having those 10 extra minutes is anything in IT that slows you down and takes those 10 minutes away. Even if it's irrational(maybe that person would have died even if you did look at the test slightly earlier) the guilt can be very real.

Re: A billion medical images are exposed online

#176

Post by quasarj »

jasonlaramburu wrote: post #82

Could this data be anonymized and open-sourced for training diagnostic algorithms? It’s hard to put the genie back in the bottle so why not at least make some use of the images?

Possibly, though with only the images you'd be missing some useful info, like the actual outcome. Also they are likely not "high quality" images on average.. so for example, if there is cancer present, it may not be identified in the image.

See https://www.cancerimagingarchive.net/ for some examples of carefully curated data.

Re: A billion medical images are exposed online

#177

Post by quasarj »

pg_bot wrote: post #30

DICOM is a standard that does too much. They should scrub everything related to networking and focus solely on encoding/decoding medical images.

As someone who deals with it every day, I completely agree. In fact, I mostly pretend the networking part doesn't exist anyway, and do all networking the normal way..

Re: A billion medical images are exposed online

#178

Post by quasarj »

salad77 wrote: post #54

From the article : "We’re not naming the affected organizations to limit the risk of exposing patient data." However, a google inurl:dicom search sure shows up the affected organizations on the first page (and plenty pages after that). And the sites are still fully open. Absolutely zero hacking required. A lot of organizations had better get to work fast on this. (edit: no images were viewed in the making of this pos…

It's hard to know what Google returns for a different person these days, but inurl:dicom does not return anything suspect for me.

It's also worth noting that the types of systems mentioned in the article (unsecured PACS) would not show up on Google anyway. They must be accessed using one of the DICOM network protocols.

Re: A billion medical images are exposed online

#179

Post by OrgNet »

jasonlaramburu wrote: post #82

Could this data be anonymized and open-sourced for training diagnostic algorithms? It’s hard to put the genie back in the bottle so why not at least make some use of the images?

Does it need to be anonymized since it is now public? maybe just don't publish identifying information in your results

Re: A billion medical images are exposed online

#180

Post by dopamean »

arminiusreturns wrote: post #141
moviuro wrote: post #7

% curl -L 'https://techcrunch.com/2020/01/10/medical-images-exposed-pacs/' curl: (7) Failed to connect to guce.advertising.com port 443: Connection refused WTF? I have a lying DNS server, and it's getting ridiculous. Here's the outline for people who care about privacy/tracking/GDPR, etc. https://outline.com/Ep5u4K

Just curious, but why are you using "-L"? Without it just doing -o to an .html opens fine in the browser for reading. I feel like I'm missing something here.

From the man page

-L, --location (HTTP) If the server reports that the requested page has moved to a different location (indicated with a Location: header and a 3XX response code), this option will make curl redo the request on the new place. If used together with -i, --include or -I, --head, headers from all requested pages will be shown. When authentication is used, curl only sends its credentials to the initial host. If a re- direct takes curl to a different host, it won't be able to intercept the user+password. See also --location-trusted on how to change this. You can limit the amount of redirects to follow by using the --max-redirs option.

              When  curl  follows a redirect and the request is not a plain GET (for example POST or PUT), it will do the following request with a GET if the HTTP response was 301, 302, or 303. If the response code
              was any other 3xx code, curl will re-send the following request using the same unmodified method.

              You can tell curl to not change the non-GET request method to GET after a 30x response by using the dedicated options for that: --post301, --post302 and --post303.
Post reply on HN