Bruce Sterling - SANS says your computer back door is wide open
Hundreds of millions of devices are being placed on networks with built-in back doors. Printers, routers, computers, control systems, storage systems, medical devices, nearly every automated device has them.
The manufacturers of these systems never told you how vulnerable you are. One victim said "It's as if the people who are supposed to help me put a big sign on my door saying 'the key is under the mat by the back door,' and anyone can come in and violate me and my family." These vulnerable back doors were installed to allow remote management; they are fully functioning processors with network connections, operating systems, and memory. In addition to being able to disable the device, in many cases they provide remote back-door access to the main CPU and storage of the computer or other device. They may not be logged or monitored and therefore can be attacked repeatedly without fear of being caught.
[...]
Similar functions are provided on UNIX systems, and on printers and medical devices and other appliances but are often not called BMCs. This research project is designed to develop detailed technical procurement language that organizations can use to ensure these back doors are "closed and locked" when the devices are delivered. These back doors have already been implicated as attackers in successful denial of service tools and can be used to access and change the data being processed by the devices.
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment