Is That Really My X-Ray? Measuring Internet-Exposed DICOM Services in the Presence of Deception

2026-07-17

AI Summary

This study addresses the widespread lack of basic security protections in internet-exposed DICOM services, which poses significant risks of sensitive patient data leakage. Existing measurement approaches substantially overestimate the true scale of exposure due to interference from honeypots and network telescopes. To mitigate this, the authors propose the first noise-aware methodology for measuring DICOM exposure, combining active IPv4-wide scanning with a passive honeypot system (Dicompot). Their ethically constrained probing performs only C-ECHO interactions and incorporates a reproducible false-positive filtering mechanism to eliminate deceptive traffic. Empirical analysis identifies 3,979 genuinely exposed services—none encrypted and all accepting anonymous connections—with nearly half appearing unmaintained and 1,551 vulnerable to known remote exploits. The findings reveal an 83% overestimation by raw measurements and demonstrate that attackers often terminate their reconnaissance activities prematurely.

Abstract

DICOM is the dominant protocol for exchanging medical images, yet many Internet-facing deployments lack basic security controls, exposing sensitive patient data to unauthorized access. Accurately measuring this exposure is complicated by honeypots, network telescopes, and other measurement artifacts that inflate published estimates. This paper presents a noise-aware study of Internet-facing DICOM services, combining active IPv4-wide scanning with passive honeypot deployments. We scan common DICOM ports using an ethics-constrained probe limited to association negotiation and C-ECHO. Then, we introduce a reproducible false-positive filtering method that identifies honeypots, telescopes, malformed responders, and other deception artifacts, reducing apparent exposure by 39%. After filtering, we identify 3,979 vulnerable DICOM deployments, all of which lack encryption and accept unauthenticated connections; 1,782 run outdated or deprecated software, and 1,551 carry known remotely exploitable vulnerabilities. Follow-up scans reveal that approximately 50% of exposed services show no evidence of maintenance over 5 months of observation, and that responsible disclosure led to only modest, short-term remediation. On the passive measurement, we deploy Dicompot and find that its raw session logs overstate activity by up to 83% due to generic TCP noise being incorrectly logged as DICOM sessions. After filtering, we observe a reconnaissance gap: Most actors issuing C-ECHO probes never escalate to data exfiltration, consistent with sophisticated actors fingerprinting the honeypot and disengaging before proceeding. Our results show that DICOM exposure measurements can be significantly distorted by deception and logging artifacts, but once corrected, reveal widespread risks to patient privacy and healthcare security that existing deception systems are insufficient to capture.

Problem

• DICOM
• Internet exposure
• honeypots
• measurement artifacts
• medical imaging security

Innovation

• noise-aware measurement
• DICOM security
• honeypot filtering
• false-positive reduction
• medical imaging exposure