Backdoors in embedded devices are REAL !

CloneRanger · Jun 3, 2013

Not the only one either !

Advisory (ICSA-13-136-01)
TURCK BL20 and BL67 Programmable Gateway Hard-Coded User Accounts

This advisory provides firmware mitigation locations associated with TURCK’s BL20 and BL67 Programmable Gateways vulnerabilities.

Researcher Rubén Santamarta of IOActive has identified hard-coded user accounts in TURCK’s BL20 and BL67 Programmable Gateways. Exploitation of this vulnerability would allow an attacker to have remote administrative access to the device. This vulnerability affects programmable gateways deployed in the agriculture and food, automotive, and critical manufacturing sectors.

*

This vulnerability allows an attacker to remotely access the device by using hard-coded credentials. After gaining administrative access, the attacker can create false communication between remote I/Os, PLCs, or DCS systems. Those false communications could cause adverse actions within the control system, possibly including process shutdown.

*

Difficulty

An attacker with a low skill would be able to exploit this vulnerability

http://ics-cert.us-cert.gov/advisories/ICSA-13-136-01
Click to expand...

TURCK backdoor

The TURCK backdoor is similar to other backdoors that I discussed at Black Hat and in previous blog posts. The common denominator is this: you do not need physical access to an actual device to find its backdoor. All you have to do is download device firmware from the vendor's website. Once you download the firmware, you can reverse engineer it and learn some interesting secrets.

For example, consider the TURCK firmware. The binary file contains a small header, which simplifies the reverse engineering process:

*

Stringfighter

So how can one collect intelligence from strings in less time? The answer is an analysis tool we created and use at IOActive called Stringfighter.

http://blog.ioactive.com/2013/05/identify-back-doors-in-firmware-by.html?m=1
Click to expand...

elapsed · Jun 4, 2013

I wonder if someone is making a list of hardware to avoid.

Log in or Sign up

Backdoors in embedded devices are REAL !

CloneRanger Registered Member

elapsed Registered Member

Log in or Sign up

Backdoors in embedded devices are REAL !

CloneRanger Registered Member

elapsed Registered Member

Useful Searches