Backdoor In RuggedOS Systems: Infrastructure, Military Systems Vulnerable 154
FhnuZoag writes "A backdoor has been found in Canadian based RuggedCom's 'Rugged Operating System', providing easy access to anyone with the devices's MAC address — something often publically displayed. Rugged OS is being used in a wide range of applications, including traffic control, power generation, and even U.S. Navy bases. The backdoor was first found over a year ago, and RuggedCom have so far refused to patch out the exploit."
The exploit is trivial: each device has a permanent "factory" user, and an automatically generated password derived from the MAC.
Nothing is 100% secure. (Score:1)
Re:Nothing is 100% secure. (Score:5, Funny)
Re: (Score:2)
You are correct. The issue isn't how easy it is to exploit, but rather how easy it would have been to not have this "feature", and the failure to address it.
Re:Nothing is 100% secure. (Score:5, Funny)
Never play cards with a man called Doc. Never eat at a place called Mom's. Never sleep with a woman whose troubles are worse than your own.
Never trust an OS with the 'Rugged' in it's name.
Re:Nothing is 100% secure. (Score:5, Informative)
Re:Nothing is 100% secure. (Score:4, Funny)
Hmmm....I happen to have some iocane here....care to partake in a battle of wits?
Re:Nothing is 100% secure. (Score:4, Insightful)
Never bet on a pool game against anyone named after a state.
Re:Nothing is 100% secure. (Score:5, Insightful)
Never get involved in a software project where the team leader says either "agile" or "scrum" in every second sentence.
Re:Nothing is 100% secure. (Score:5, Funny)
Never say never
Re: (Score:2)
Not so sure on that. I won a lot of money off of a guy named Vermont Average Build.
Re: (Score:3)
Re:Nothing is 100% secure. (Score:5, Insightful)
>>>the failure to address it.
I suppose this is why OSS advocates claim closed-source is bad? You can't fix the problem yourself, and if the company refuses to do it, then you're stuck.
Re:Nothing is 100% secure. (Score:5, Informative)
Okay, this feature has its use. Let's say Beardo works for the city for 15 years and puts a password on all the light controllers. That's only sane, right? You don't want some asshole changing the light pattern so they get a green light every morning at 7:43 when they're on their way to work or disabling the first-responder receiver.
Let's also assume that Beardo got passed over for a raise AGAIN and decided, "okay, that's it, I'm leaving." Five years later they have to change the timing for some reason, let's say more traffic at the intersection or something, and Beardo is nowhere to be found. He's got a new job in Bermuda and you'll never hear from him again. (I actually did have a co-worker get a job in Bermuda and to this day I am unable to determine if he is alive or dead.)
Or let's just say Beardo forgot the password. "Oh, I think it was a seven-digit prime number... I don't think I wrote that down anywhere..."
You've got to either find the password or send the unit back to the factory to get it reset to the blank factory default (automation direct will do this) People forget passwords. I'm sure once we switch to biometrics people will forget their thumbs or something.
HOWEVER this feature should require some kind of dongle from the manufacturer or some kind of wetwork. Well, then I guess the exploit then becomes "anyone with $175 to buy a NRD-1298 from Rugged can run a Perl script". Even if there was a master password list in the factory then someone could break in or bribe their way into the system. Maybe this password should only work on a direct link like the serial port.
What I guess the company could have done is add the PO number or customer number to the MAC address and then use a more robust password generator to figure it out. I'm not entirely sure what they could do to make it a secure way of getting into your legitimately owned, but inadvertently locked, machine.
Hell, if you get two keys for a master-locked system you can narrow down the master key to one of 17 possibilities. We don't go around telling people that their doors aren't going to work.
Also, I hate to mention this, but I've said it before, the military uses weaponry to enforce their system security. If you're sitting on a rowboat with a parabolic dish, the frigate is going to shoot bullets at you.
Re: (Score:1)
Nice over-architected solution. Sorry you took so long to type out such an insanely complex impossible to implement solution. Maybe RuggedCom has a job for you!
Alternate option: Simply make a bootrom option such that someone at the console during a power cycle can bypass the authentication. Cisco implemented this. It's not hard. No magic calculations, PO numbers, customer numbers.
http://www.cisco.com/en/US/products/hw/routers/ps259/products_password_recovery09186a0080094675.shtml
Re:Nothing is 100% secure. (Score:4, Insightful)
Right, which means anyone with a pair of overalls can change the light controller.
Re:Nothing is 100% secure. (Score:4, Insightful)
Re: (Score:3)
It beats a remote exploit. And the necessary reset should raise red flags.
Re:Nothing is 100% secure. (Score:5, Insightful)
I think you're giving them far too much credit.
A password generated using an externally visible attribute of the device is pure incompetence and making stupid decisions.
This isn't about Beardo going away and losing the password, it's about someone making one of those shockingly stupid decisions about convenience over security which leads to security through obscurity.
As TFS says, this is bordering on a trivial exploit since you can likely hack any and all devices running this OS merely by figuring out its MAC address.
This is just blatantly moronic. If you're marketing yourself for "mission critical", don't do something this stupid.
Re: (Score:1)
Yup, but it's /marketed/ as "mission critical".
Just saying that if you're /buying/ "mission critical" kit, then you're the moron for not having thorough standards it must meet, that includes a method of proving it does meet these.
This was outsourcing responsibility. This is buying a warranty, buying an insurance package you'll have to go to court to attempt to collect.
If you're outsourcing a "mission critical" aspect of your business, then you're not in that business. Then you're just a middleman.
Re: (Score:2)
And here I thought that was a normal Friday night in Texas. ;-)
Re: (Score:2)
Oh, he's not alive. He's not dead either. He went for a boat ride and he's just.... gone.
Re: (Score:3)
HOWEVER this feature should require some kind of dongle from the manufacturer or some kind of network.
Or, you could do what every $35 Internet router in the history of Best Buy does: put a little 5-cent button on the back of the device that restores its default settings (or bypasses the password check, or whatever).
Re: (Score:2, Funny)
Or let's just say Beardo forgot the password. "Oh, I think it was a seven-digit prime number... I don't think I wrote that down anywhere..."
Why on earth would he set the password to 8675309? That's just silly.
Re: (Score:2)
That's all well and good... But maybe instead of using an back door account that is easily derived from the MAC address, they should have installed a public key?
Re:Nothing is 100% secure. (Score:4, Informative)
wetwork
Is this some sort of computer security term? "Wetwork" is slang for "murder" in the espionage world.
Re: (Score:2)
Solder in a jumper or resistor.
Re: (Score:2)
Ah, thanks! Now if I ever meet an electrical engineer who is also a spy, I can humorously confuse him!
Re: (Score:2)
Have the master password database at the manufacturer strongly encrypted, then have the password for that database on a couple of smartcards (one for use in recovery, one held elsewhere as a backup in case the first is rendered unusable). The database is only at risk if the smartcard's contents are intercepted by malware on that machine, up to (but not beyond) the point where the database is re-encrypted under a new key. If the machine is properly secured, the risk of this is close to zero.
OR
Have the master
Re: (Score:2)
Maybe it IS a feature, so they hate to have to remove that. Don't rumors about NSA backdoors surface every now and then?
Not implementing a likely trivial patch to a gaping security hole hasn't many other credible explanations.
Re: (Score:2)
There's a difference between "Nothing is 100% secure" and "Why yes sir, I will lay out the welcoming mat for you".
Indeed. But the concept of "degree" is something beyond quite a few people. For them it is always black and white. Stupid really, but widespread. If the world were black and white, there would be zero point in risk management. Instead it is one of the most important supporting disciplines for technology. And one quite a few people do not get at all.
Especially things with factory supplied backdoor (Score:5, Insightful)
Nothing is 100% secure. Nothing. At. All.
Especially those things with a factory supplied backdoor. Regardless of the complexity of the password, regardless of how the marketing guys try to spin it as a "maintenance portal" or whatever they are calling it (assuming of course customers knew it was there), such a thing is essentially a backdoor.
Hopefully this was something that customers were aware of and something that customers could disable. Or more optimistically a debugging feature customers would have to enable for a session while in direct communication with the factory. Even so a hypothetically generate-able password is troubling.
Re: (Score:2)
Nothing. At. All.
Absolutely correct, but building in a back door with a password easily derived is almost, but not quite, entirely unlike security.
This makes me wonder how many other OS variants used in control systems have "factory" users built in.
Re: (Score:1)
Cue the platitudes that could be generically posted into half the articles on /. without reference to the article supposedly being commented on.
Oh, I see you're way ahead of me. Carry on...
STUPID (Score:3, Informative)
Unchangeable default password = MEGAFAIL
Re: (Score:2)
Re: (Score:2)
Very nice, I remember that one :)
Before someone mistakes you for a troll, I guess I'd better link to an explanation [cnet.com]. 14 years ago, somebody at Microsoft left a dangerous backdoor in Frontpage 98, with the phrase "Netscape engineers are weenies!" as the key. People were fired over this, and so should the persons responsible for the SNAFU at Rugged.
Wish I could mod you up. I'd almost forgotten about that.
Re: (Score:3)
It is acceptable in exactly one scenario: A physically secured access port. But in all others, it is cheap and convenient. Quote stupid, really. My guess is that the people designing these things just have zero imagination and never expected their systems to come under attack.
Re: (Score:2)
My guess is that the people designing these things just have zero imagination and never expected their systems to come under attack.
A company called RuggedCom. That makes military equipment. That had the foresight to install user accounts and passwords in the first place.
What usually happens in these situations is that someone clever implements the security properly and them some idiot creates a backdoor for convenience. Say the technicians got annoyed by having to find out the admin username/password for every device they needed to work on so demanded a backdoor, or a random PHB just kept forgetting his password and looked like a dick
Whois JC CREW? (Score:1)
What's this JC CREW organization that supposedly discovered this backdoor? Is it a corporation? group of hackers? single individual? in the US? International?
i went to their site at www.jccrew.org and it's just a picture of a burned out car. I don't get it. This is huge, but I can't find anything about the research person or organization.
Re:Whois JC CREW? (Score:5, Funny)
Their website had a default password, sorry, couldn't help myself.
Re: (Score:2)
They are probably (rightly) paranoid that reporting security defects like this will make them liable for criminal prosecution, and would prefer to remain anonymous. It's not like it hasn't happened before.
Re: (Score:2)
and would prefer to remain anonymous
I knew Anonymous had to be behind this! ;)
Re: (Score:2)
They probably don't want to get sued.
Re: (Score:1)
Straight from TFA:
> "[...]" said Justin W. Clarke, the author of the full-disclosure advisory who said he notified company officials of the backdoor 12 months ago.
Justin Clarke. JC.
Clothing company? (Score:1)
I think they sell clothing - JCrew has lots on their website. :-)
Re: (Score:2)
i went to their site at www.jccrew.org and it's just a picture of a burned out car. I don't get it.
Ah, well, that's a picture of what used to be a vehicle full of hacking equipment and anabolic steroids that subsequently blew up for no good reason.
PCI-DSS and others (Score:5, Interesting)
Using this device would mean you would fail PCI-DSS and probably a few other widely used standards (ISO-27001 for example). One of the first requirements in these standards is that default vendor passwords be changed. You can't change it or even disable it.
Re:PCI-DSS and others (Score:5, Interesting)
From what I have seen, the PCI audit company would pass you anyway or the company would find another that would pass them. This is the main problem with PCI. As the entity that is being certified pays for the service they choose an auditor that will pass them. The correct way to do it would be if the industry paid for this service.
Re: (Score:2)
The correct way to do it would be if the industry paid for this service.
Which "industry?" The industry of the auditor? The industry of the auditee? The industry of the equipment manufacturer?
You're leaving the realm of "standards" and "fees" and entering the realm of "regulations" and "taxes."
Re: (Score:2)
The credit card industry itself. Meaning that to get to PCI compliance certified you and all others who are certified would pay into a pool that pays the auditors to audit, with randomly assigned auditors and the same payment pass or fail. These auditors would then take some sort of financial risk if you were to fail a future audit.
Re: (Score:2)
There is no real incentive for the CC companies to make audit compliance difficult. Remember that when a charge-back happens the seller pays.
Really the financial to do a good job and really be PCI compliant already falls on the merchant. For the most part PCI standards make sense. If you as business don't implement PCI properly and then find some rubber stamp audit firm to sign off its disservice to yourself. Just ask Sony; I bet they wish they'd have taken PCI more seriously!
It might be a hassle for y
Re: (Score:2)
If you pass a PCI audit, and then get credit card data stolen because of an uncompliant practice that the auditors missed, then you're fracked (i.e., fully liable) anyway. THAT is the point of PCI - to ensure that the industry pays for nothing, and both compliance costs and fraud costs are on your (merchant) shoulders.
You wouldn't even get a refund from the auditors for not checking most basic things, they tend to have their legal homework done perfectly even if they are sloppy in the
Re: (Score:1)
Re: (Score:2)
Ah, but it's not a "default vendor password". It's machine generated, and is unique per device.
I've seen plenty of devices with generated root passwords be certified, and even when they were audited by bloodhounds sent in by an irritable customer. If those passed, well, so would this.
Re: (Score:2)
These boxes are NERC certified, so I doubt PCI is a problem. These are the boxes we used to protect SCADA systems at the network level.they were generally considered more robust than Cisco equipment.
Re: (Score:2)
Security certifications are pretty useless and have no significant impact on actual security. Sad but true. The only reasons why these certifications are so in demand is that the serve as CYA for now. I hope that goes away and vendors become liable if their devices are insecure, regardless of certification and with only sound practices, competent personnel, sound architecture, design, implementation and external _competent_ review limiting their liability.
Well, maybe it will be fixed (Score:2)
RuggedCom have so far refused to patch out the exploit.
Perhaps when Siemens [cleanbreak.ca] moves in new management, the problem will be fixed. After having the egg of Stuxnet on their face, they might be a bit more proactive about these sorts of things.
Re: (Score:2)
What makes you think there was any failure? Stuxnet was a success. How do you know that Siemens were not complicit in the creation of Stuxnet?
Re: (Score:2)
Exactly. Siemens might well be next up for the Nobel Peace Prize. They stopped (or at least deferred) Nuclear Armageddon.
Just remember that when you're developing your new super secure application or device....
Just who's side are you really on, anyway?
Re: (Score:2)
Or brought it about. Unless you're really good at reading tea-leaves, you cannot possibly know what the probability of a nuclear confrontation with Iran is now versus what it would have been. So far, every country on the US' naughty list that has lacked WMD has been attacked and those on the list that have had WMD have not been attacked. If Stuxnet was indeed an attack, then Iran has recent experience of the former, which lends itself to the idea that it might prefer to be in the latter group.
Possibly. But,
Re: (Score:2)
Because for every instance of terrorism that the FBI/CIA/Mossad/Pentagon stops there are dozens (hundreds?) of instances of industrial espionage carried out. No one in their right mind would ever install Siemens hardware or software in their plant again if they suspected that there was a back door built in for their US competitors to sniff around through.
Re: (Score:2)
I have to wonder about the Siemens issue here. Sounds like this could rapidly move into the hands of lawyers unless the CERT communications were disclosed during the transaction.
RuggedCom's management held $55.8 million (CAD) worth of stock, so pocketed handsomely from this takeover. Would RuggedCom still be worth $33/share this morning?
not an exploit (Score:1)
exploit (Score:5, Insightful)
Looks like to exploit this, you need the MAC addrs.
1) One way is to be on the same LAN segment and watch a sniffer. This means you're already dead because you've lost physical security.
2) Another way is to telnet (FREAKING telnet in 2012?) into the device and the MAC is in the MOTD. This means you're already dead because you've lost all network security. What kind of madman allows telnet traffic thru a firewall in 2012? What kind of a madman allows unrestricted internet access to an embedded control device?
3) If you manage to somehow own a plain ole PC on a scada network, now you can own embedded control devices. But having an owned PC on your network means you're dead anyway.
I'm still struggling to figure out how a live, well run network could be in danger. What I mean is to implement this exploit takes a system that is already more screwed up than anything you could do with the exploit.
Re: (Score:2)
A MAC adress is only 6 bytes which is easy to bruteforce.
Re:exploit (Score:5, Informative)
It really isn't 6 bytes either. Since RuggedCom has two registered MAC OUIs [ieee.org] (grep for "RuggedCom"), it's only 24 bits to brute-force over two possible 3-byte manufacturer prefixes.
Yeah. Fail-flavored failure-stuffed failure topped with fail gravy.
Re: (Score:2)
Or in other words 25 bits. This will unfortunately not stop marketing-math from claiming 24 bit space + another 24 bit space = 48 bits.
This easy violation of #1 above Still requires epic fail of #2 and/or #3 above to be applied, and if you have failed #2 or #3 you don't need to brute force anyway.
Because you need telnet access to haxor the thing, and the telnet MOTD supposedly tells you the MAC, I have absolutely no idea why you'd brute force the thing instead of just a simple expect script and a regex on
Re:exploit (Score:5, Insightful)
Barring rate limiting, or other protection mechanisms (unlikely on a SCADA device) I'd estimate that a brute force attack on a 100mb/s link is going to be done and dusted in a matter of minutes rather than hours or days.
Re: (Score:2)
Actually, it is 3 Bytes if you know the 3-Byte vendor part. Much less, if you have an idea how the vendor assigns MAC addresses.
Re:exploit (Score:4, Informative)
Cain and Abel can do an ARP sweep for every possible MAC on a 10mbps link in a handful of minutes.
That number isn't as large as you think it is.
Re: (Score:2)
Are you sure you don't mean sweep for every possible IP? In case of a private network, that would be 16 million addresses (1.6 * 10^7) which is a lot less than 2.81 * 10^14. Unless it filters MAC addresses somehow, exhausting the entire range would require going through 2.81 * 10^14 addresses. If that were possible using just 1 bit of traffic per address, it'd still take 2.81 * 10^14 / 10^7 (10Mbps) = 2.81 * 10^7 seconds which is just over 325 days.
That number is large.
Re:exploit (Score:5, Insightful)
4) brute force the password, knowing that only 3 bytes are unique to the device.
It's far easier than that. No guessing required. (Score:2)
4) brute force the password, knowing that only 3 bytes are unique to the device.
You don't have to guess. The password is computable from the MAC address using this short Perl program. [seclists.org]
The factory password is, literally, "factory". It cannot be disabled and its password cannot be changed.
Someone should go to jail for this. It may fall under criminal negligence, sabotage, or even providing material aid to terrorists.
Re: (Score:2)
1. is pretty easy to do. I walk into your office with a clipboard. I unplug an unused PC and away I go. If need be I clone that PCs network address. How many places actually encrypt their wired network?
Re: (Score:2)
1. is pretty easy to do. I walk into your office with a clipboard. I unplug an unused PC and away I go. If need be I clone that PCs network address. How many places actually encrypt their wired network?
I walk up to you, don't recognize you as an employee so I figure you're a tech from one of our vendors. I start hinting around for toys and freebies.
Boy, you'd better be able to deliver or you're in a heap of trouble.
Re: (Score:2)
Not a problem I tell you, you will be getting a free Cisco/Dell/HP/Verizon thing as soon as I am done. It is out in the truck parked in the garage a couple blocks over.
Re: (Score:3)
From TFA - the MAC is displayed in the MOTD.
As for telnet - you don't need telnet through the firewall. You just need something on the other side of the firewall, like say, an infected
Re: (Score:2)
The US Army thought it was a good idea to give enlistees access to tons of classified data and a DVD burner. Morons abound when expediency is valued more than security.
Re: (Score:2)
"I'm still struggling to figure out how a live, well run network could be in danger."
Keywords: "well run".
Re: (Score:2)
I'm still struggling to figure out how a live, well run network could be in danger. What I mean is to implement this exploit takes a system that is already more screwed up than anything you could do with the exploit.
Directly no, but that is not really the issue at all. The way to win in security is consistency, consistency, and consistency. You do the right things every time, every where you know of in hopes that it might save in the places you don't.
I have seen command and control shell codes that look enough like plain Jane http to not get flaged by most ids, and the target is not in everyones URL filters yet that is getting past the firewall and over the proxy. Couple that with a little social engineering and som
Re: (Score:2)
MAC addresses are only 24 bits if you know the vendor. May be far less if you have some idea about the device and/or its year of manufacturing.
And, yes, telnet, snmp, http are still pretty popular even for remote management over the Internet.
Re: (Score:2)
That's very interesting. What other standard safety measures do you find useless? Have you short circuited all the circuit breakers in your house? Remove the safety railing next to your stairs? Cut the seat belts out of your car? Thrown away the life jackets on your boat?
yes, yes, no (it never came with them), and I wish I had a boat...
(kidding of course, it is absurd how people rely on one thing to protect them and assume it will never fail.)
Re: (Score:2)
This reminds me of the periodic epic haxor discovery that if you have physical access to a cisco router and know the "config register hack" then you can pown any router. Its one of those "duh" moments where if you don't have physical security, then you have no security at all.
scanners scripties (Score:2)
Does this mean that there will now be another set of noise with script kiddies trying to create automated scanners to locate these devices, thus adding more junk for me to look through in the logs?
Re: (Score:3)
Perhaps. With power control systems and traffic systems using this stuff it's also possible that I may have a power outage at my office and a *very* quick trip home, where all the lights my way are green. Possibly.
This word, "rugged" (Score:1)
I do not think it means what you think it means.
Re:This word, "rugged" (Score:5, Funny)
It means "covered with carpet", right?
Re: (Score:2)
Apparently it's what they sweep the security flaws under.
Not an issue at all (Score:1)
Re: (Score:2)
It is a device for industrial manufacturing. In the past the terminals and switches were accessible to anybody allowed into that area. It is an access problem. The network in a manufacturing plant should be inaccessible from outside.
Why is that even news?
Because morons DO allow access (physical and Internet) to these "secure" areas.
Re: (Score:2, Informative)
Look up the term "defense in depth." You do not stop at establishing perimeter security, an appropriate security architecture involves many layers of security thus ensuring you aren't screwed if someone decides to install a DSL line in the plant. Or a cellular modem connected to the serial port of this device in an electric substation. Or in case Bob the IT genius decides to punch a telnet hole through the firewall to make remote admin easier.
Re: (Score:1)
Re: (Score:2)
Well, that sounds fine, but totally unrealistic. You have in an industrial plant thousands of these control devices. Maintaining a password list for all these is just not going to work.
The devices don't need individual passwords, they need individual keys. Passwords are not keys. And deriving secure unique keys from a master key is a solved problem. You can use master key injection systems (like DUKPT). Or you can have the devices automatically create them when they are introduced to the network (like Z-Wave).
So builder Bob will have a default password and Joe the mechanic has one. And you the operator have to know who installed this piece of hardware.
Role based authority is also a way to ensure that the right people have the necessary access. You never give them the raw keys, you give them an access mechanism that uses the keys
Re: (Score:2)
I am all for defense in depth, but to be honest this equipment is usually in place because of known limitations in lower layers. There is only one higher layer on most systems, and there are plenty of attack vectors that would bypass this. I am not a network engineer, but I really can't come up with ways to make a functional SCADA system if you can't trust VLAN level security at some point in the system for compartmentalization of systems.
So, when the pols start bitching about 'cyberwar' (Score:2)
I'm certain the inevitable legislation to come from this will fairly and accurately reflect that fact...
Engineers overlooking the obvious design (Score:4, Insightful)
The obvious correct hardware design was a simple switch (on the device) that allows usage of a default password. That way, you ensure both that you can put maintenance to the device in the future, whilst maintaining daily security.
Re:Engineers overlooking the obvious design (Score:5, Insightful)
Also when the switch is flipped it should not perform its normal work.
That way it cannot be left in that mode.
Re: (Score:1)
You would soon find corporate procedure revised to require the switch to be always on because it saves $100k+ in downtime costs when the vendor pushes two updates in a month. You also have to make the switch prevent SCADA output and signal failure if left on.
Re: (Score:2)
I don't think you're understanding what the other poster proposed: a well designed system, like they said, would have a user-modifiable root password (that you can set to whatever and change according to your password guidelines) *AND* a hardware switch that allows a default password to be used instead (so that if you lose your root password you can fix things without having major downtime).
The other poster's addition of flipping the switch = the device does not work (save for maybe a "change the password"
It was a typo. (Score:5, Funny)