Report: Cyber Attackers Could Add Fake Cancerous Nodules to Medical Imaging Scans

Researchers in Israel attest they have developed malware that would let cyber attackers add fake cancerous nodules to CT or MRI scans before radiologists and doctors examined them, thereby leading to leading to potential misdiagnoses, according to a story this week in the Washington Post.

The reporter, Kim Zetter, wrote in her story that the researchers “say they have developed such malware to draw attention to serious security weaknesses in critical medical imaging equipment used for diagnosing conditions and the networks that transmit those images — vulnerabilities that could have potentially life-altering consequences if unaddressed.”

Zetter’s report added, “The malware they created would let attackers automatically add realistic, malignant-seeming growths to CT or MRI scans before radiologists and doctors examine them. Or it could remove real cancerous nodules and lesions without detection, leading to misdiagnosis and possibly a failure to treat patients who need critical and timely care.”

The four researchers from the Ben-Gurion University Cyber Security Research Center in Israel who created the malware noted that one motivation for the attackers could be to target a presidential candidate or other politician to trick him or her into believing he or she has a serious illness, thus leading to a withdrawal from the race.

For the study, researchers used deep-learning to add or remove evidence of medical conditions from volumetric (3D) medical scans. “Although the body is complex and 3D medical scans are very large, CT-GAN achieves realistic results which can be executed in milliseconds,” the researchers said in the study abstract. They added, “To evaluate the attack, we focused on injecting and removing lung cancer from CT scans. We show how three expert radiologists and a state-of-the-art deep learning AI are highly susceptible to the attack.”

The study specifically involved real CT lung scans, 70 of which were altered by their malware, according to Zetter’s piece. What’s more, the researchers were able to “trick three skilled radiologists into misdiagnosing conditions nearly every time.” Amazingly, “in the case of scans with fabricated cancerous nodules, the radiologists diagnosed cancer 99 percent of the time. In cases where the malware removed real cancerous nodules from scans, the radiologists said those patients were healthy 94 percent of the time,” according to the story.

Zetter’s report continued, “Even after the radiologists were told that the scans had been altered by malware and were given a second set of 20 scans, half of which were modified, they still were tricked into believing the scans with fake nodules were real 60 percent of the time, leading them to misdiagnoses involving those patients. In the case of scans where the malware removed cancerous nodules, doctors did not detect this 87 percent of the time, concluding that very sick patients were healthy.”

The study focused on lung cancer scans solely, but according to Yisroel Mirsky, one of the researchers who developed the malware, the attack would work for brain tumors, heart disease, blood clots, spinal injuries, bone fractures, ligament injuries and arthritis, the Washington Post reported.