Slashdot Mirror
Backdoor In RuggedOS Systems: Infrastructure, Military Systems Vulnerable
FhnuZoag writes "A backdoor has been found in Canadian based RuggedCom's 'Rugged Operating System', providing easy access to anyone with the devices's MAC address — something often publically displayed. Rugged OS is being used in a wide range of applications, including traffic control, power generation, and even U.S. Navy bases. The backdoor was first found over a year ago, and RuggedCom have so far refused to patch out the exploit."
The exploit is trivial: each device has a permanent "factory" user, and an automatically generated password derived from the MAC.
There's a difference between "Nothing is 100% secure" and "Why yes sir, I will lay out the welcoming mat for you".
Unchangeable default password = MEGAFAIL
"When information is power, privacy is freedom" - Jah-Wren Ryel
Never play cards with a man called Doc. Never eat at a place called Mom's. Never sleep with a woman whose troubles are worse than your own.
Never trust an OS with the 'Rugged' in it's name.
Faster! Faster! Faster would be better!
Using this device would mean you would fail PCI-DSS and probably a few other widely used standards (ISO-27001 for example). One of the first requirements in these standards is that default vendor passwords be changed. You can't change it or even disable it.
Oolite: Elite-like game. For Mac, Linux and Windows
Their website had a default password, sorry, couldn't help myself.
---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
Looks like to exploit this, you need the MAC addrs.
1) One way is to be on the same LAN segment and watch a sniffer. This means you're already dead because you've lost physical security.
2) Another way is to telnet (FREAKING telnet in 2012?) into the device and the MAC is in the MOTD. This means you're already dead because you've lost all network security. What kind of madman allows telnet traffic thru a firewall in 2012? What kind of a madman allows unrestricted internet access to an embedded control device?
3) If you manage to somehow own a plain ole PC on a scada network, now you can own embedded control devices. But having an owned PC on your network means you're dead anyway.
I'm still struggling to figure out how a live, well run network could be in danger. What I mean is to implement this exploit takes a system that is already more screwed up than anything you could do with the exploit.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Nothing is 100% secure. Nothing. At. All.
Especially those things with a factory supplied backdoor. Regardless of the complexity of the password, regardless of how the marketing guys try to spin it as a "maintenance portal" or whatever they are calling it (assuming of course customers knew it was there), such a thing is essentially a backdoor.
Hopefully this was something that customers were aware of and something that customers could disable. Or more optimistically a debugging feature customers would have to enable for a session while in direct communication with the factory. Even so a hypothetically generate-able password is troubling.
The obvious correct hardware design was a simple switch (on the device) that allows usage of a default password. That way, you ensure both that you can put maintenance to the device in the future, whilst maintaining daily security.
>>>the failure to address it.
I suppose this is why OSS advocates claim closed-source is bad? You can't fix the problem yourself, and if the company refuses to do it, then you're stuck.
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
never get involved in a land war in Asia Never go against a Sicilian when death is on the line
Okay, this feature has its use. Let's say Beardo works for the city for 15 years and puts a password on all the light controllers. That's only sane, right? You don't want some asshole changing the light pattern so they get a green light every morning at 7:43 when they're on their way to work or disabling the first-responder receiver.
Let's also assume that Beardo got passed over for a raise AGAIN and decided, "okay, that's it, I'm leaving." Five years later they have to change the timing for some reason, let's say more traffic at the intersection or something, and Beardo is nowhere to be found. He's got a new job in Bermuda and you'll never hear from him again. (I actually did have a co-worker get a job in Bermuda and to this day I am unable to determine if he is alive or dead.)
Or let's just say Beardo forgot the password. "Oh, I think it was a seven-digit prime number... I don't think I wrote that down anywhere..."
You've got to either find the password or send the unit back to the factory to get it reset to the blank factory default (automation direct will do this) People forget passwords. I'm sure once we switch to biometrics people will forget their thumbs or something.
HOWEVER this feature should require some kind of dongle from the manufacturer or some kind of wetwork. Well, then I guess the exploit then becomes "anyone with $175 to buy a NRD-1298 from Rugged can run a Perl script". Even if there was a master password list in the factory then someone could break in or bribe their way into the system. Maybe this password should only work on a direct link like the serial port.
What I guess the company could have done is add the PO number or customer number to the MAC address and then use a more robust password generator to figure it out. I'm not entirely sure what they could do to make it a secure way of getting into your legitimately owned, but inadvertently locked, machine.
Hell, if you get two keys for a master-locked system you can narrow down the master key to one of 17 possibilities. We don't go around telling people that their doors aren't going to work.
Also, I hate to mention this, but I've said it before, the military uses weaponry to enforce their system security. If you're sitting on a rowboat with a parabolic dish, the frigate is going to shoot bullets at you.
---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
Perhaps. With power control systems and traffic systems using this stuff it's also possible that I may have a power outage at my office and a *very* quick trip home, where all the lights my way are green. Possibly.
Look up the term "defense in depth." You do not stop at establishing perimeter security, an appropriate security architecture involves many layers of security thus ensuring you aren't screwed if someone decides to install a DSL line in the plant. Or a cellular modem connected to the serial port of this device in an electric substation. Or in case Bob the IT genius decides to punch a telnet hole through the firewall to make remote admin easier.
It means "covered with carpet", right?
I think you're giving them far too much credit.
A password generated using an externally visible attribute of the device is pure incompetence and making stupid decisions.
This isn't about Beardo going away and losing the password, it's about someone making one of those shockingly stupid decisions about convenience over security which leads to security through obscurity.
As TFS says, this is bordering on a trivial exploit since you can likely hack any and all devices running this OS merely by figuring out its MAC address.
This is just blatantly moronic. If you're marketing yourself for "mission critical", don't do something this stupid.
Lost at C:>. Found at C.
Hmmm....I happen to have some iocane here....care to partake in a battle of wits?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Never bet on a pool game against anyone named after a state.
"(I) have this unfortunate condition that causes me not to believe a single thing any politician says when a mic's on.
HOWEVER this feature should require some kind of dongle from the manufacturer or some kind of network.
Or, you could do what every $35 Internet router in the history of Best Buy does: put a little 5-cent button on the back of the device that restores its default settings (or bypasses the password check, or whatever).
I don't care if it's 90,000 hectares. That lake was not my doing.
It was supposed to be RiggedOS.
My other car is a 1984 Nark Avenger.
Or let's just say Beardo forgot the password. "Oh, I think it was a seven-digit prime number... I don't think I wrote that down anywhere..."
Why on earth would he set the password to 8675309? That's just silly.
Never get involved in a software project where the team leader says either "agile" or "scrum" in every second sentence.
XML is a known as a key material required to create SMD: Software of Mass Destruction
Right, which means anyone with a pair of overalls can change the light controller.
---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
wetwork
Is this some sort of computer security term? "Wetwork" is slang for "murder" in the espionage world.
Random Thoughts From A Diseased Mind (Not For Dummies)
Never say never
Once you have physical acccess, it's game over.
Never beat off after chopping up scotch bonnet peppers.
-- I ignore anonymous replies to my comments and postings.
It beats a remote exploit. And the necessary reset should raise red flags.