HL7Magic: Medical Data Hacking Made Easy
Katie Inns introduces HL7Magic, an open-source Burp Suite extension enabling security researchers to intercept, decode, and tamper with legacy HL7 medical device traffic.
Summary
The Insecurity of Legacy Healthcare Protocols
While modern healthcare APIs adopt HTTP-based FHIR standards, critical hospital systems and embedded diagnostic devices still rely universally on legacy Health Level Seven (HL7) protocol formats.
The Lack of Tooling for Proprietary Medical Protocols
HL7 messages utilize bespoke non-HTTP framing that cannot be natively inspected, parsed, or modified by standard commercial penetration testing suites.
Introducing the HL7Magic Burp Suite Extension
Katie Inns presents HL7Magic, an open-source extension that intercepts raw TCP HL7 socket streams, decodes segment delimiters, and integrates seamlessly into Burp Suite's Repeater and Intruder.
Demonstrating Medical Device Vulnerabilities
Live demonstrations illustrate how tampering with HL7 patient identifiers and telemetry payloads can misattribute medical records, highlighting patient safety risks in clinical environments.
Related talks
Main Stage·43 min
Ricky Lawshae
Ricky Lawshae explores esoteric non-IP Ethernet protocols across transportation, industrial SCADA, and healthcare networks, demonstrating packet injection vectors.
Biohacking Village·26 min
Mixæl Laufer
Four Thieves Vinegar Collective founder Mixæl Laufer shares open-source medicine projects, decentralized hardware, and grassroots biohacking initiatives.
Biohacking Village·1 hr 29 min
Nina Alli
Biohacking Village Executive Director Nina Alli interviews clinical professionals, patients, and hackers on the future of healthcare security.