Vulnerable terminal servers could let bad guys hack stoplights, gas pumps
Industrial control systems, traffic signal controllers, fuel pumps are easily hacked via poorly configured serial port systems, Rapid7 says
Computerworld - Thousands of older systems, including those used to manage critical industrial control equipment, traffic lights, fuel pumps, retail point-of-sale terminals and building automation are vulnerable to tampering because they're insecurely connected to the Internet via terminal servers.
A terminal server, or a network access server, basically provides an easy way to connect any equipment that has a serial port to the Internet.
In a recent study, security firm Rapid7 found more than 114,000 terminal servers on the Internet configured in a way that could allow anyone to gain access to the underlying systems. Most of the systems were from Digi International and Lantronix, two leading manufactures of terminal server devices.
About 95,000 of those servers connected to the Internet via cellular mobile connections and 3G network cards, making them hard to protect, monitor and secure, according to H.D. Moore, the chief research officer at Rapid7 and the author of the study.
Among the systems was one responsible for monitoring humidity and temperature in oil pipelines, another designed to notify the public of emergencies and one used to control temperature and ventilation systems in a building. In one instance, the company discovered a terminal server that provided direct Internet access to confidential payment information contained in a server belonging to a national chain of dry cleaners.
The exposed systems run the gamut from corporate VPNs to traffic signal monitors, Moore said. In more than 13,000 cases, the terminal servers provided a way for anyone on the Internet to gain some form of administrative control of the attached device.
The problem largely involves how organizations configure terminal servers to connect to the Internet, Moore said. They can connect to the Internet via Ethernet, 3G and 4G wireless modems, GSM and satellite connectivity.
Terminal servers allow remote access to connected devices and allow administrators to manage a connected device, monitor it or to extract information from it. In some cases, terminal servers are used to provide an extra "out-of-band" way to access a system or network component in the event of disruption or outage.
Many organizations appear to be unaware of the security risks they face using terminal servers, Moore said, noting that they haven't paid enough attention to authentication measures to control access to the servers and connected systems.
For instance, while terminal servers support authentication, that authentication often applies only to the terminal server itself -- not to the attached serial port, he said. So organizations may have a mistaken sense of security over access to serially attached ports, he said.
Serial port enabled devices also often require users to actively log off a system once they are done. If a user fails to do so, the service console is left in an authenticated state and can be used by an attacker to take control, Moore said.
- Using Cyber Insurance and Cybercrime Data to Limit Your Business Risk This paper examines the challenges of understanding cyber risks, the importance of having the right cyber risk intelligence, and how to use this...
- 5 Tips to Secure Small Business Backdoors in the Enterprise Supply Chain This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to... All Cybercrime and Hacking White Papers | Webcasts