Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default?
1–9 of 9 posts
Re: Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default?
#2123
Re: Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default?
#3"and other Internet-facing Simatic HMI systems .."
I love that ThreatPost wedged that one in there -- anyone who has worked with SCADA systems knows the second rule is "don't expose your HMI's." (The first rule is "don't believe the vendor.")
Re: Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default?
#4123
The actual password was "100".
http://support.automation.siemens.com/WW/llisapi.dll/4581536...
Re: Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default?
#5Re: Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default?
#6> couldn't confirm that a default, three digit password hard coded into an application used to control the company's SCADA software played a role.
Isn't that as good as saying "yes, the default password is always 100"?
Re: Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default?
#7should have shipped with custom password. Assuming the sysadmin could read.
Re: Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default?
#8I don't know the details of this specific system, but I have seen some systems that would break (utter and complete failure) upon password change. Some vendors would go so far as to threaten that support contracts would not be honored if passwords were changed. That was 12 years ago, but I imagine that some vendors still hard-code passwords and rely on them not changing. It'll take lawyers and contracts and court battles to sort those vendors out.
Re: Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default?
#9That's not a hack, that's opening a door locked by a piece of tape.