Digital Imaging and Communications in Medicine (DICOM)

11.1 DICOM Hacking 247
Chapter 11
DICOM Security
In the innocent era of the 1980s, when DICOM was first introduced, no one
was really concerned with networking security or data protection. Those playing
Space Invaders at the time would never imagine that their own data and privacy
would be invaded a decade later on a much more magnanimous scale. The
sheer complexity of DICOM encoding methods has become the only DICOM
data protection for nearly 20 years. However, this was hardly enough to block
even the least advanced threats.
11.1
DICOM Hacking
Let’s look inside a DICOM file with some generic file viewer such as WordPad,
Notepad, or Word. When you open a DICOM file in WordPad (Fig. 77), you do
not expect to see any images or nicely formatted study information; WordPad
has no idea what to do with the DICOM format. What you will see instead will
be mostly unreadable symbols corresponding to the binary (hexadecimal) contents
of the file. However, look closely and you will see very valuable pieces of
DICOM information and structure.
1. Symbols from 129 to 132 in a valid DICOM 3.0 file should read “DICM” (see
Chap. 10). You can open a file, and search it for DICM. If you find it somewhere
in the beginning, it is a good indication that you are looking at a
valid DICOM file. In fact, this is probably one of the best ways to recognize
a valid DICOM file. Older DICOM versions might not have this, but they
are becoming rarer.
2. The “1.2.840…” prefix is used in all standard DICOM identifier (UID) strings,
and its presence in a file confirms that we are dealing with DICOM. Often,
DICOM files are named after their image UIDs, in which case, DICOM file
names begin with the same prefix.
3. DICOM dates follow the YYYYMMDD format and can be easily identified as
such.
4. Other strings such as patient and physician names, hospital, study, and series
description can always be guessed based on their contents. In particular, the
caret (^) character, used in DICOM as a name separator, helps to locate
names.
Thus, even without help from any DICOM software, one can easily interpret
the textual part of a binary DICOM file. 34 The good news is that this often helps
34 The same is true for the older ACR-NEMA files; see the example in 5.2.