The popular cyber security expert Luca Bongiorni demonstrated how to hack an X-Ray Machine using his WHIDelite tool.

Recently I bought a X-RAY machine from China to have some ghetto-style desktop setup in order to inspect/reverse engineer some PCBs and hardware implants.

The first thing striked my curiosity, even before purchasing it, was its remote. Which were the odds that the little teeny-tiny remote was just using an ASK/OOK modulation with no replay-attack protection whatsoever?! Very high of course.
c

Nonetheless, I ordered it anyway and used it as an excuse to try again my WHIDelite and the new toy that Joel sent me over (EvilCrowRF).

But first let’s follow a more-systematic approach with HackRF and URH:

• Frequency is confirmed being set around 315MHz

After recording a packet we can confirm that it is using an ASK/OOK modulation.

After creating a simple substitution decoding, we get exactly the same values that both EvilCrowRF & WHIDelite showed during the initial tests.

 This crap is absolutely NOT secure! 

Just for the sake of confirmation, I did replay the packet with both HackRF, WHIDelite & EvilCrowRF. In all cases, the forged packet was successfully received and decoded by the unit, which fired X-RAYs like it was a Marie Curie’s party 

Here a quick video review of the whole replay attack:
https://youtu.be/RIdf2yIPB84

Some resources related to the tools and devices used:

https://github.com/whid-injector/whid-31337

https://github.com/joelsernamoreno/EvilCrow-RF

https://github.com/eried/portapack-mayhem

https://github.com/jopohl/urh/

In case of more cool hacking stuff, do follow @whid_ninja on Twitter! 

P.S. Disclaimer, if you are planning to buy this model of Dental X-ray Machine… keep in mind that is NOT considered safe in Europe. The Health Protection Agency from UK, even released a report regarding these devices coming from China. Be prepared to use sheets of lead, dosimeters and protective vests.

The expert published a video PoC of the attack:

Author Biography:Luca Bongiorni is working as Head of Offensive Security. He is also actively involved in InfoSec where his main fields of research are: Radio Networks, Reverse Engineering, Hardware Hacking, Internet of Things, and Physical Security. He also loves to share his knowledge and present some cool projects at security conferences around the globe.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, X-Ray Machine)

[adrotate banner=”5″]

[adrotate banner=”13″]