Your vulnerability scanners might show clean reports, your patching schedule could be on track, and your compliance audits may look good. Scanners identify outdated components, but they can’t reveal if password reset, MFA recovery, or help desk procedures can be exploited to enable account takeover.
As penetration testers, we don’t just look for missing patches. We focus on logic errors and process gaps that let us walk right in. After over a decade of testing healthcare systems, we’ve noticed a pattern: most breaches don’t come from unpatched systems. Instead, attackers exploit the hospital’s biggest strength—its culture of helpfulness and urgency.
If you’re unsure how your identity recovery, delegated permissions, or external assets would hold up under adversarial testing, that uncertainty itself is the signal.
Hospitals are designed to say “yes” to clinicians so they can save lives. If a surgeon is locked out of their EMR, the priority is to get them back in immediately.
During a recent engagement, a controlled social engineering call to the help desk, using publicly available information to validate our identity and leaning into a ‘broken phone’ excuse, our tester built enough trust for the help desk to send an MFA reset QR code to a personal Gmail account controlled by our team. No technical exploit needed.
The question then becomes: if you need to reset your password or your multi-factor authentication device, what’s the process a user would go through to regain access? If your recovery process relies on human discretion rather than strict technical verification, it’s a high-risk entry point.
Physical security in hospitals is also uniquely challenging because hospitals are open to the public. Anytime you have to let the public in, it’s a huge challenge. Attackers will look to exploit any “trust layer” they can.
To illustrate this, during one assessment, we initially encountered a rock-solid security guard who denied us access to a restricted elevator because we didn’t have a badge. However, we noticed a floor with heavy construction that would give us access to the restricted area. We took advantage of it and, with confidence, walked through the construction space to the other side, then took an unguarded elevator up from there. At the final access point, the guard buzzed us in without looking up from their phone, assuming we must have been cleared by the second layer of security.
This highlights a common vulnerability: Attackers look for temporary gaps in the physical perimeter, whether it’s a construction zone, a service hallway, or a temporary work site. This raises the question: If someone bypassed a checkpoint using one of these non-standard routes, would your controls prevent it, or would they rely on trust and urgency?
Just as we bypass physical checkpoints via temporary routes to test the ‘trust’ of your staff, we bypass digital perimeters to test the ‘trust’ of your internal network logic. While perimeter controls receive a lot of attention, the internal network often becomes a “rat’s nest” of legacy permissions. Over years of use, AD permissions can become layered with inherited rights, creating unintended privilege paths.
In one hospital, we found that the “Everyone” group had been granted “Generic All” permissions across the entire domain. Because every user was in that group, it effectively meant every account in the building was a Domain Admin. This was a huge risk that had been there for 10 years because it doesn’t show up in a vulnerability scanner.
To identify these privilege escalation paths, we perform a structured analysis of AD permissions:
In a medical environment, you can’t just start hacking. It requires a methodical approach, because launching a tool at it could have a negative impact. In healthcare, speed is not the objective. Safety and fidelity are.
We often start by asking a simple question: “If someone performed a DCSync attack inside your network right now, would you detect it?”
In over a decade of testing hospital environments, we’ve only seen one hospital detect this internal attack behavior in real time. Most organizations are so focused on outbound malware beacons that they miss the “loud” behavior of a targeted attacker on the inside. We work together to figure out how you will alert on that, tuning your tools to get high-confidence triggers.
The diagram below shows how we suggest conducting penetration tests. We’re leveraging infrastructure the same way a remote attacker would. This is important because it allows you to fully flesh out your defenses. An attacker’s going to leverage malware and, once they establish internal access, use command-and-control (C2) to communicate with a management server that controls the endpoint.
That’s why we suggest a hybrid approach for hospitals to include penetration testing and purple team integration. In the last few days of the test, we’ll go through and emulate stealthy attacker techniques and map them back to the MITRE ATT&CK framework with timestamps. We then work alongside your team to identify exactly which activities were detected and which went unnoticed.
To reduce exposure before a full engagement, we recommend starting with these areas.
Establish a Verified External Asset Inventory
One of the bigger risks, generally speaking, is that when we conduct a hospital pentest, they don’t know what they have on the internet. We’ve seen printers, medical IoT devices, and a medical app used for messaging doctors and nurses online, just to name a few. Because you’re getting attacked and scanned 24-7, 365 days a year, it’s critical to understand your footprint. That’s the first challenge.
Perform a Structured AD Review
If your Active Directory has never undergone a privilege path analysis, there’s likely accumulated risk embedded in delegated rights and inherited permissions. Conduct a review of “delegated administrative rights” and “privilege escalation chains”. The goal is to determine if a “low-privilege user can directly or indirectly modify, reset, or control higher-privilege accounts”.
Test Identity Recovery and Account Management Processes
Walk through your processes objectively to test whether your help desk relies on a “name and confidence” approach to bypass technical controls. If identity recovery depends heavily on “discretion or urgency,” it deserves a redesign.
Audit Public-Area Network Ports
Hospitals are open environments. That’s the reality. Walk through your waiting rooms, conference areas, and even construction zones. Are there switch ports accessible, and are they locked down? Without locking down those ports in public areas, an attacker can plug into the wall, circumvent all the external controls, and land on the internal network. It doesn’t require a sophisticated exploit. Just access.
A well-executed penetration test isn’t a surprise inspection. It is a controlled validation of how your environment performs under realistic adversarial conditions.
Vulnerability management identifies known weaknesses. Adversary simulation evaluates how identity, logic, and process can be chained together to create access.
Protecting patient data and life-supporting systems requires more than patch discipline. It requires testing how your environment behaves when someone is actively trying to misuse it.
If you’d like to see a technical walkthrough of these scenarios, watch our full session with Health-ISAC here.
If you want a clear view of what your organization exposes externally without disruption, contact us for a complimentary external attack surface snapshot based solely on passive reconnaissance.
In our testing, attackers most frequently exploit identity recovery processes rather than technical vulnerabilities. Help desk procedures that rely on human discretion, such as resetting MFA based on a phone call, create high-risk entry points that don’t require any technical exploit to abuse.
A DCSync attack allows an attacker with sufficient Active Directory privileges to extract password hashes for any account in the domain, including Domain Admins. In over a decade of testing hospital environments, we have seen only one hospital detect this behavior in real time. Most organizations miss it entirely.
Privilege escalation in Active Directory occurs when a low-privilege account can directly or indirectly modify, reset, or control higher-privilege accounts through inherited permissions, delegated rights, or misconfigured group memberships. These paths often go undetected for years because they don’t show up in vulnerability scanners.
Hospitals are open to the public by design, creating layers of trust that attackers exploit. Common entry points include construction zones, service hallways, and temporary work sites that bypass standard checkpoints. In one assessment, our team accessed a restricted area through a construction floor and was buzzed through a final checkpoint without verification.
Start with four areas: establish a verified external asset inventory so you know what is exposed on the internet, perform a structured Active Directory privilege path analysis, test your identity recovery and help desk processes against social engineering scenarios, and audit network ports in public-facing areas like waiting rooms and conference spaces.
**Update 15 December 2021: Updated guidance for Log4j updates/upgrades can be found here.
Christmas came early for some hackers while creating a nightmare scenario for defenders. CISA and its partners through Joint Cyber Defense Collaborative recently published some data regarding the vulnerability in Apache’s Log4j software. The vulnerability, CVE-2021-44228 / “Log4Shell”, allows for a critical remote code execution (RCE) vulnerability by an unauthenticated attacker. The Log4j software is embedded within a significant number of popular applications – including the Mars 2020 Helicopter Mission! The prevalence and dependence on this software likely means that this vulnerability will be hanging around well after this holiday season.
CISA has responded by creating a web page for guidance as well as a community sourced repository that provides status descriptions and a software list of vendor-supplied advisories.
BPL has a long history of providing robust cybersecurity solutions in various work environments: remote, in person, and hybrid and are prepared to address this recent vulnerability. We have been hard at work ensuring our customers are secure while doing what we do best to build, protect, and learn from this recent incident.
Whether you have been affected, or are not sure if you have been, we can help. Reach out to us today to help you respond.
