<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 03/21/2013 03:41 PM, Jim Kinney
wrote:<br>
</div>
<blockquote
cite="mid:CAEo=5PyP615B8WNfkoqN++tUR2Xz9POVM3-GwPC+oBog74S=hA@mail.gmail.com"
type="cite">in short: embeded system MUST be locked down or fully
upgradeable.<br>
<br>
Basically this guy found a zillion embedded Linux devices and they
were all set up stupidly. Crap like telnet running with a root
password of root and just boneheaded stuff like that.<br>
<br>
It's one of the blowbacks from rapid Linux adoption - idiots make
devices with a full OS installed and -WHAM- you've a got a
root-bot.<br>
<br>
Embedded devices are hard to get really right. Probably impossible
to get totally secure. SCADA security woes are based on a zillion
embedded windows 98 and XP devices that run utilities and water
treatment plants and industrial processes. Full of security holes
and not fixable without a hardware refresh (at 4x the cost of the
original device).<br>
<br>
</blockquote>
Could the telnet and related packages be removed without causing
any problems? <br>
<br>
Also, how many of these devices need to be connected to the
Internet? <br>
<br>
One of the problems with the SCADA devices is that the older devices
were never intended to be connected to something like the Internet.
If they were connected to any devices, it was to be a local,
independent control network with no outside connections.<br>
<br>
<blockquote
cite="mid:CAEo=5PyP615B8WNfkoqN++tUR2Xz9POVM3-GwPC+oBog74S=hA@mail.gmail.com"
type="cite">
<div class="gmail_quote">On Thu, Mar 21, 2013 at 2:56 PM, Ron
Frazier (ALE) <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:atllinuxenthinfo@techstarship.com"
target="_blank">atllinuxenthinfo@techstarship.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Hi all,<br>
<br>
This just came out on the Security Now podcast. I thought I'd
pass it along. I'll freely admit I don't understand
everything discussed. However, you guys more up on security
stuff will be able to research this and act appropriately.
I'll explain this the best I can based on what I heard on the
podcast.<br>
<br>
The podcast is entitled Telnet-pocalypse, and he reports on a
very serious report by an anonymous White Hat researcher about
vulnerable devices. I have not attempted to verify this
information other than what's stated in Steve's podcast and in
the report cited, but it appears to be legitimate.<br>
<br>
<a moz-do-not-send="true"
href="http://twit.tv/show/security-now/396" target="_blank">http://twit.tv/show/security-now/396</a><br>
<br>
</blockquote>
</div>
</blockquote>
<snip><br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Jay Lozier
<a class="moz-txt-link-abbreviated" href="mailto:jslozier@gmail.com">jslozier@gmail.com</a></pre>
</body>
</html>