It Is Shocking What You Can Find On the Internet

If you know how to do some creative looking around on the Internet, it is truly shocking just how much access you can get to systems without really trying.  Recently an Internet Security Expert Paul McMillan (@PaulM) build a tool to scan for machines which were exposed to the Internet and which didn’t have any security in place so that if you knew they were there would simply allow you to access them.  What was found, and the screenshots which were published are a shocking display of systems security failure.

You would think that various colleges around the US would have a better idea of network security, but apparently not.  Now these aren’t really all that important, and it would slightly embarrassing at worst if someone started making changes to these.  However not everything that was found was so.

A kiosk at a college

A kiosk at a college

Something else at a college

Something else at a college

Display board of a college library

Display board of a college library

A desktop at a college

A desktop at a college

There’s some stuff that could have a direct impact on peoples day to day lives.  Such as the controls for a grain silo, which I could be told to dump all the grain from the silo onto the ground, which would ruin the grain and cost the farmer a lot of money.

Appears to be a Grain Silo

Appears to be a Grain Silo

Or we could lock down the pumps at this gas station.

A large Gas Station

A large Gas Station

Ever wanted to control a car wash?

A Car Wash Control System

A Car Wash Control System

How about a movie theater?

Cinema City Movie Theater Control System

Cinema City Movie Theater Control System

Or maybe we could screw around with the Parking ticket Kiosk for the city of Oakland, California, USA.

City of Oakland Parking Ticket Payment System

City of Oakland Parking Ticket Payment System

There were a large number of people’s desktop computers just sitting there available.  In this one the person is writing code for an application.

Someone actively writing code

Someone actively writing code

It isn’t just small companies that have their systems exposed to the Internet for no reason at all. Here’s the Double Tree hotel in Boston, MA (a member of the Hilton family of hotels).  This system happens to be the display board for what’s going on in the conference rooms on the day the screenshot was taken.

The Boston Double Tree's conference room TV

The Boston Double Tree’s conference room TV

So far all of these systems have been pretty harmless.  But there are some pretty big control systems online as well.  Here’s the control systems for a hydro-electric plan which is producing around 480kw or power.

Some sort of Hydro-electric plant generting about 480kw of power

Some sort of Hydro-electric plant generating about 480kw of power

Here’s what appears to be another power plant.

My best guess is a power plant

My best guess is a power plant

Or if coal mining is more your speed, this appears to let us control the loaders, belts, trains, etc. for an active coal mine.

Coal Mine Control System

Coal Mine Control System

Here’s the control systems for a few more power plants, all of which are available to anyone who knows how to look for them.

A Power Plant

A Power Plant

Another Power Plan

Another Power Plan

Yet another power plan

Yet another power plant

I’m not really sure what this controls, but it looks pretty important.

Something very industrial looking

Something very industrial looking

I wonder what kind of wells these are that we can shutdown?  Water, oil, could be anything.

What appears to be a well monitoring system

What appears to be a well monitoring system

Maybe there’s someone important hooked up to this heart monitoring system at a hospital.

Heart Monitor for a hospital bed

Heart Monitor for a hospital bed

Every one of these systems can be connected to, and controlled from anywhere in the world because they don’t have even the most basic network security setup on these devices.  Do any of these devices need to be connected to the public Internet?  No, there’s no valid reason for a single one of these to be on the Internet, but they are.

Companies who run these systems need to take better care of their networks, because eventually someone who is looking to do some actual damage is going to stumble across the tools and techniques which are used to find and access these systems.  And once that happens it’s to late.  Thankfully Paul McMillan was just doing research, imagine if his plan was to do actually do damage.  I’ve shown you just some of the power plants, hospital equipment, and food storage locations which he found.  It would have been a simple task to just shutdown all those systems one by one as he found them and no one would have had any idea that it was him, or even what happened.  According to all the logs at the power plants someone would have issued the shutdown command from which ever control system that Paul was connected to.

Someone needs to get the message out to these companies, utilities, etc. that they need to fix these problems BEFORE it’s to late, not after.

Denny

Special Thanks to Paul McMillan for doing the hard work of scanning all these systems, and to Information Security Expert Dan Tentler (@Viss) for sifting through and finding some of the interesting ones and sharing them with me for this post.http://basicsofdigitalprivacy.com

Target Breach Proves That We Can’t Trust Companies

The news for Target is just getting worse and worse for Target and their customers.  Over the weekend it was announced (original announcement from Target is here) that Target has joined an elite club, specifically called the 100 Million club.  This club is a clubtarget that no company ever wants to be a part of because it means that people have stolen data on more than 100 million people from the company.

In the case of the target breach the first information which was known to be stolen was information for around 70 million credit and debit cards which were used in Target stores (which included one of my cards, which I’ve since canceled).  In this new finding (which to be clear was part of the same data theft, but was just found) another 70 million customers information has been taken.  But the data which was taken this time is very different from the credit card data.  This time it was what is called Personally Identifiable Information such as names, addresses, phone numbers, etc.  The exact information which someone would need to attempt to open credit cards in another persons name.

As part of Target's ongoing forensic investigation, it has been determined that certain guest information - separate from the payment card data previously disclosed - was taken from Target. This theft is not a new breach, but was uncovered as part of the ongoing investigation. At this time, the investigation has determined that the stolen information includes names, mailing addresses, phone numbers or email addresses for up to 70 million individuals.

This information is invaluable to data thieves as they can now begin matching this data up against other credit card data which they have in order to build a better profile about the specific credit cards to make it easier to use the stolen card numbers as well as sign up for more credit card accounts.

The breach notification from Target doesn’t give a whole lot of technical information about the breach or if the data which was taken was encrypted or not, but based on the fact that Target announced the breach this tells me that the data wasn’t encrypted which means that Target did not to a proper job securing the data.  This leads me directly to what I wrote in Chapter 1 of “Basics of Digital Privacy” where I talk specifically about knowing how the companies which we trust with our data actually secure that data so that we know for sure that the information which we trust them with is fully secured.

For the companies out there, they need to be reading books on data security from both the IT Professional side (such as my book “Securing SQL Server“) as well as from the consumer side (such as my book “Basics of Digital Privacy“) so that these sorts of things can be stopped before they happen.

Denny

http://basicsofdigitalprivacy.com