In my next job there was also a “secure” access card system. But if I dialed the shared packet data switch control port at the stock market, which was protected by an impressive zero-character long password, I could configure a connection into any other firms’ internal network, or impersonate their trading terminals. Then I saw that the broker’s X25 ports, which cost something like 10k$/month for a 19.2kB/s service, made network management very difficult because of the rigid closed user groups. The cards were based on magnetic stripes, so all you had to do to get in was to dissimulate in the code a literal back door recognizing as valid some random old credit card found on the street, and of course add a “goto” statement jumping over the logging section. IIRC, the access control and logging software was a childish BASIC application running on an IBM PC, and you could easily figure out what data was obtained from the reader, and what port controlled the door magnet. The readers were controlled by an accessible serial port, and I could show how one could get into the computer room. Twenty-five years ago I pointed out to my boss that the expensive access card gimmicks he got installed were nothing but a joke. Tags: disclosure, locks, patching, physical security, safes, vulnerabilities ![]() I expect the same things to happen with Internet-of-Things companies. Before then they ignored security vulnerabilities, threatened researchers, and generally behaved very badly. The computer industry learned its lessons over a decade ago. Although Brinks could disable driver software associated with the USB port to prevent someone from controlling the safes in this way, or lock down the system and database so it’s not running in administrative mode and the database can’t be changed, but so far the company appears to have done none of these.Īgain, this all sounds familiar. They notified Brinks about the vulnerabilities more than a year ago, but say the company appears to have done nothing to resolve the issues. They also haven’t learned the lessons of full disclosure or rapid patching: ![]() And that’s the problem with Internet-of-Things security: it’s often designed by people who don’t know computer or Internet security. If it sounds like the people who designed this e-safe ignored all of the things we’ve learned about computer security in the last few decades, you’re right. “You plug in this little gizmo, wait about 60 seconds, and the door just pops open,” says Petro. The researchers created a malicious script that, once inserted into a safe on a USB stick, lets a thief automatically open the safe doors by emulating certain mouse and keyboard actions and bypassing standard application controls. “There is a full operating system…that you’re able to…fully take over…and make do whatever you want it to do.” “Once you’re able to plug into that USB port, you’re able to access lots of things that you shouldn’t normally be able to access,” Petro told WIRED. This, unfortunately, creates an easy entrypoint for thieves to take complete, administrative control of the devices. Nothing about these vulnerabilities is a surprise to anyone who works in computer security:īut the safes have an external USB port on the side of the touchscreens that allows service technicians to troubleshoot and obtain a backup of the database. The hack has the makings of the perfect crime, because a thief could also erase any evidence that the theft occurred simply by altering data in a back-end database where the smartsafe logs how much money is inside and who accessed it. Vulnerabilities found in CompuSafe Galileo safes, smart safes made by the ever-reliable Brinks company that are used by retailers, restaurants, and convenience stores, would allow a rogue employee or anyone else with physical access to them to command their doors to open and relinquish their cash…. Despite being sold as a more secure safe, it’s wildly insecure: Brink’s sells an Internet-enabled smart safe called the CompuSafe Galileo.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |