Vulnerable terminal servers could let bad guys hack stoplights, gas pumps
Industrial control systems, traffic signal controllers, fuel pumps are easily hacked via poorly configured serial port systems, Rapid7 says
Computerworld - Thousands of older systems, including those used to manage critical industrial control equipment, traffic lights, fuel pumps, retail point-of-sale terminals and building automation are vulnerable to tampering because they're insecurely connected to the Internet via terminal servers.
A terminal server, or a network access server, basically provides an easy way to connect any equipment that has a serial port to the Internet.
In a recent study, security firm Rapid7 found more than 114,000 terminal servers on the Internet configured in a way that could allow anyone to gain access to the underlying systems. Most of the systems were from Digi International and Lantronix, two leading manufactures of terminal server devices.
About 95,000 of those servers connected to the Internet via cellular mobile connections and 3G network cards, making them hard to protect, monitor and secure, according to H.D. Moore, the chief research officer at Rapid7 and the author of the study.
Among the systems was one responsible for monitoring humidity and temperature in oil pipelines, another designed to notify the public of emergencies and one used to control temperature and ventilation systems in a building. In one instance, the company discovered a terminal server that provided direct Internet access to confidential payment information contained in a server belonging to a national chain of dry cleaners.
The exposed systems run the gamut from corporate VPNs to traffic signal monitors, Moore said. In more than 13,000 cases, the terminal servers provided a way for anyone on the Internet to gain some form of administrative control of the attached device.
The problem largely involves how organizations configure terminal servers to connect to the Internet, Moore said. They can connect to the Internet via Ethernet, 3G and 4G wireless modems, GSM and satellite connectivity.
Terminal servers allow remote access to connected devices and allow administrators to manage a connected device, monitor it or to extract information from it. In some cases, terminal servers are used to provide an extra "out-of-band" way to access a system or network component in the event of disruption or outage.
Many organizations appear to be unaware of the security risks they face using terminal servers, Moore said, noting that they haven't paid enough attention to authentication measures to control access to the servers and connected systems.
For instance, while terminal servers support authentication, that authentication often applies only to the terminal server itself -- not to the attached serial port, he said. So organizations may have a mistaken sense of security over access to serially attached ports, he said.
Serial port enabled devices also often require users to actively log off a system once they are done. If a user fails to do so, the service console is left in an authenticated state and can be used by an attacker to take control, Moore said.
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- The Business Value of Continuous Delivery Download this whitepaper to learn more about the business value of Continuous Delivery and see why it could be a game changer for...
- Ten Factors Shaping the Future of Application Delivery Download this research report conducted by Enterprise Management Associates (EMA) to learn how those that are seeking to accelerate application delivery are leveraging...
- Software Asset Management: Ensuring Today's Assets Today's trends like BYOD and SaaS are new and exciting in terms of how they will help make our jobs more productive but...
- On-demand webinar - 7 Keys to Service Catalog Implementation Success Watch this webinar to learn 7 crucial keys to make your service catalog a success!
- Transform Your IT Service Management Watch this webinar, to learn how EasyVista can increase IT productivity & efficiency and deliver streamlined & integrated IT Service & Asset Mgmt. All Malware and Vulnerabilities White Papers | Webcasts