Hospital Security Breached Through Social Engineering
A hacker accessed private medical files by gossiping about a doctor.
1Introduction
Hacker Dahvid Schloss was hired to test a hospital's security. His goal was to access the records room and steal a specific file. However, the room was protected by both an electronic lock and a nurse, making the task challenging.
2Social Engineering Plan
Schloss chose social engineering over picking the lock or stealing an access card. He researched the hospital, wore appropriate scrubs, and prepared a fake security badge that wouldn't work.
3Engaging the Nurse
Schloss approached the nurse at the records room, complained about his badge not working, and gossiped about Dr. Johnson. His story won the nurse's sympathy and trust.
4Access Granted
The nurse believed Schloss's story and let him into the records room. After retrieving the file, Schloss spent another 10 minutes chatting with the nurse, criticizing the security team and listening to her complaints about doctors.
5Other Security Flaws
Schloss discovered serious security flaws in other hospitals he tested. For example, at one hospital, medical devices were on the same network as guest Wi-Fi, and data was unencrypted.
6Conclusion
Schloss emphasized the need for hospitals to improve their security measures. Protecting critical data requires greater vigilance against social engineering attacks.