Skip to content
attack.paths
Connexion
← RegistryDossier · 5 steps · 4 edges

MITM HL7 v2 → tamper lab orders / results

HL7 v2 over MLLP is plaintext pipe-delimited. From the same VLAN as the lab analyser ↔ EHR link, MITM and rewrite OBX result segments — changes the patient's documented test result.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: hospital network where HL7 endpoints (lab analysers, imaging, EHR integration engine) share a VLAN or pass through an unsegmented switch. No TLS on HL7 / MLLP.

§ Steps

  1. 01
    Foothold on hospital LANInitial Access
    T1078— Valid Accounts
  2. 02
    ARP spoof analyser ↔ EHRCredential Access
    N-ARP-SPOOF— ARP Spoofing / Cache Poisoning
  3. 03
    Falsified results enter EHR recordImpact
    T1565— Data Manipulation
  4. 04
    Capture HL7 v2 messagesCredential Access
    T1040— Network Sniffing
  5. 05
    Inject / modify OBX segmentsImpact
    HC-HL7-INJECT— HL7 v2 Message Injection

§ References

§ Frequently asked

What is the "MITM HL7 v2 → tamper lab orders / results" attack path?
HL7 v2 over MLLP is plaintext pipe-delimited. From the same VLAN as the lab analyser ↔ EHR link, MITM and rewrite OBX result segments — changes the patient's documented test result. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Foothold on hospital LAN (T1078) — a initial access primitive. Assumed environment: hospital network where HL7 endpoints (lab analysers, imaging, EHR integration engine) share a VLAN or pass through an unsegmented switch.
What is the final impact of this kill-chain?
The final step lands on Inject / modify OBX segments (HC-HL7-INJECT), which falls under Impact. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers