Hacking Google's HVAC Systems
cylance.com
Hacking Google's HVAC Systems
1–10 of 46 posts
Re: Hacking Google's HVAC Systems
#2I'm surprised there aren't botnets running on these embedded devices... yet. Probably because most people don't leave it openly available on the internet.
There are millions of rarely updated devices... printers, security systems, fire alarms, cameras, etc... the list goes on and on.
Re: Hacking Google's HVAC Systems
#3Interesting related story from July 2012: http://www.washingtonpost.com/investigations/tridiums-niagar...
“We’re not going to say Niagara is secure”
What I find most worrisome about this is that it can enable attackers to access internal video feeds. Seems like an excellent vector to grab someone's credentials.
Also, ironically, one of the people mentioned in the WaPo article who discovered these vulnerabilities used to work for Google.
edit: Aaron's reading comprehension is evidently VERY LOW today ;)
Re: Hacking Google's HVAC Systems
#4This is not a part of the vulnerability rewards program? Why?
Re: Hacking Google's HVAC Systems
#5This is not a part of the vulnerability rewards program? Why?
It's not in scope, because it's not a "Google operated web service."
http://www.google.com/about/appsecurity/reward-program/
(I work for Google.)
Re: Hacking Google's HVAC Systems
#6I'm surprised there aren't botnets running on these embedded devices... yet. Probably because most people don't leave it openly available on the internet. There are millions of rarely updated devices... printers, security systems, fire alarms, cameras, etc... the list goes on and on.
>I'm surprised there aren't botnets running on these embedded devices
That's a pretty bold assumption :)
Re: Hacking Google's HVAC Systems
#7The way they probably located these devices is using the following Shodan search (27286 results at the moment): http://www.shodanhq.com/search?q=niagara
Re: Hacking Google's HVAC Systems
#8I'm surprised there aren't botnets running on these embedded devices... yet. Probably because most people don't leave it openly available on the internet. There are millions of rarely updated devices... printers, security systems, fire alarms, cameras, etc... the list goes on and on.
>I'm surprised there aren't botnets running on these embedded devices That's a pretty bold assumption :)
I think this was posted on HN a few months ago:
http://internetcensus2012.bitbucket.org/paper.html
They ran their own botnet to map the internet, and then discovered other malware already running on insecure home routers.
Re: Hacking Google's HVAC Systems
#9[deleted]
Re: Hacking Google's HVAC Systems
#10You don't need a "custom exploit" or a "custom developed tool" to access a public file called config.bog and base64 decode the user:pass. This Tridium exploit was well publicized in the past year but too many people (including this contractor who installed it) failed to upgrade the security or install the patches.