Playing with FHIR: Hacking Healthcare APIs
Alissa Knight and IU Health CISO Mitch Parker demonstrate exploiting FHIR and mobile health APIs, detailing offensive kill chains and defensive remediation.
Summary
The Rapid Adoption of FHIR and Mobile Health APIs
Fast Healthcare Interoperability Resources (FHIR) APIs power modern patient portals, mobile health apps, and electronic health record (EHR) data exchanges.
Deconstructing the Healthcare API Kill Chain
Alissa Knight demonstrates systemic vulnerabilities across leading mHealth apps—including Broken Object Level Authorization (BOLA), hardcoded developer keys, and unauthenticated endpoints.
Exfiltrating Protected Health Information (PHI) at Scale
Exploiting flawed API endpoints allows attackers to dump millions of patient records and medical histories without triggering perimeter WAF alarms.
Defensive Architecture and API Governance
Mitch Parker presents strategic and tactical defense maneuvers for healthcare CISOs to enforce token validation, continuous API discovery, and data integrity monitoring.
Related talks
Biohacking Village·26 min
Mixæl Laufer
Four Thieves Vinegar Collective founder Mixæl Laufer shares open-source medicine projects, decentralized hardware, and grassroots biohacking initiatives.
Biohacking Village·1 hr 29 min
Nina Alli
Biohacking Village Executive Director Nina Alli interviews clinical professionals, patients, and hackers on the future of healthcare security.
Main Stage·22 min
Katie Inns
Katie Inns introduces HL7Magic, an open-source Burp Suite extension enabling security researchers to intercept, decode, and tamper with legacy HL7 medical device traffic.