Vulnerable terminal servers could let bad guys hack stoplights, gas pumps
Industrial control systems, traffic signal controllers, fuel pumps are easily hacked via poorly configured serial port systems, Rapid7 says
Computerworld - Thousands of older systems, including those used to manage critical industrial control equipment, traffic lights, fuel pumps, retail point-of-sale terminals and building automation are vulnerable to tampering because they're insecurely connected to the Internet via terminal servers.
A terminal server, or a network access server, basically provides an easy way to connect any equipment that has a serial port to the Internet.
In a recent study, security firm Rapid7 found more than 114,000 terminal servers on the Internet configured in a way that could allow anyone to gain access to the underlying systems. Most of the systems were from Digi International and Lantronix, two leading manufactures of terminal server devices.
About 95,000 of those servers connected to the Internet via cellular mobile connections and 3G network cards, making them hard to protect, monitor and secure, according to H.D. Moore, the chief research officer at Rapid7 and the author of the study.
Among the systems was one responsible for monitoring humidity and temperature in oil pipelines, another designed to notify the public of emergencies and one used to control temperature and ventilation systems in a building. In one instance, the company discovered a terminal server that provided direct Internet access to confidential payment information contained in a server belonging to a national chain of dry cleaners.
The exposed systems run the gamut from corporate VPNs to traffic signal monitors, Moore said. In more than 13,000 cases, the terminal servers provided a way for anyone on the Internet to gain some form of administrative control of the attached device.
The problem largely involves how organizations configure terminal servers to connect to the Internet, Moore said. They can connect to the Internet via Ethernet, 3G and 4G wireless modems, GSM and satellite connectivity.
Terminal servers allow remote access to connected devices and allow administrators to manage a connected device, monitor it or to extract information from it. In some cases, terminal servers are used to provide an extra "out-of-band" way to access a system or network component in the event of disruption or outage.
Many organizations appear to be unaware of the security risks they face using terminal servers, Moore said, noting that they haven't paid enough attention to authentication measures to control access to the servers and connected systems.
For instance, while terminal servers support authentication, that authentication often applies only to the terminal server itself -- not to the attached serial port, he said. So organizations may have a mistaken sense of security over access to serially attached ports, he said.
Serial port enabled devices also often require users to actively log off a system once they are done. If a user fails to do so, the service console is left in an authenticated state and can be used by an attacker to take control, Moore said.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Cybercrime and Hacking White Papers | Webcasts