Archive for June 2008
Stumbling upon Security Issues
Posted by: Tom
Seriously...I don't go looking for web site security issues or vulnerabilities but sometimes you do "stumble" upon them. :-P
Several weeks ago I was looking for an online schedule of events at one of the local community centers where I live so I did what anyone would do and typed in the URL of the city's web site into my browser, but without typing "www" first. The actual URL starts with "www" but many times just by typing the URL without "www" will take you to the web site. So to my surprise instead of getting the main index page of the city's web site I get a web form prompting for login credentials to what looked like an HVAC system attached to the Internet! The header of the page had some information about a system version so I did what any other security guy would do and launched a Google search to find out more details about this system. Yep, it was an HVAC system alright. So I thought no big deal right....out of curiosity I hit the 'enter' key thinking that there was no way that there was an anonymous login on this baby...low and behold, it logged me in! I was able to view the HVAC system configuration and potentially manage the HVAC for not only the community center but the city hall and other facilities. Looked like I could have caused some mischievous outages like changing the temperatures and even shutting down the HVAC system. At this point many scenarios entered my head, including why someone would put an HVAC system that should be on the company "Intranet" on the "Internet" with an anonymous administrator level account...nahh...I'm a pen tester so this isn't shocking to me at all!
Being the ethical person that I am I emailed the city that manages this domain letting them know of the issue...today a received an email that said they were looking into the issue and it should be resolved shortly. So here are the questions. What would you have done (put your non-evil hat on please...yes, methodically messing with the temperature in the mayors office would be a blast...)? Do you just forget that you stumbled upon this vulnerability or do you believe in more of a full disclosure policy to the people running the web site? In talking to some others...attempting to contact the site owners is the best option (which I agree with) yet some others may take a different approach. Some "grey-hat" hackers might even resort to causing havoc with the HVAC system just to prove a point, then disclose the vulnerability the right way. Thoughts from the community?
Several weeks ago I was looking for an online schedule of events at one of the local community centers where I live so I did what anyone would do and typed in the URL of the city's web site into my browser, but without typing "www" first. The actual URL starts with "www" but many times just by typing the URL without "www" will take you to the web site. So to my surprise instead of getting the main index page of the city's web site I get a web form prompting for login credentials to what looked like an HVAC system attached to the Internet! The header of the page had some information about a system version so I did what any other security guy would do and launched a Google search to find out more details about this system. Yep, it was an HVAC system alright. So I thought no big deal right....out of curiosity I hit the 'enter' key thinking that there was no way that there was an anonymous login on this baby...low and behold, it logged me in! I was able to view the HVAC system configuration and potentially manage the HVAC for not only the community center but the city hall and other facilities. Looked like I could have caused some mischievous outages like changing the temperatures and even shutting down the HVAC system. At this point many scenarios entered my head, including why someone would put an HVAC system that should be on the company "Intranet" on the "Internet" with an anonymous administrator level account...nahh...I'm a pen tester so this isn't shocking to me at all!
Being the ethical person that I am I emailed the city that manages this domain letting them know of the issue...today a received an email that said they were looking into the issue and it should be resolved shortly. So here are the questions. What would you have done (put your non-evil hat on please...yes, methodically messing with the temperature in the mayors office would be a blast...)? Do you just forget that you stumbled upon this vulnerability or do you believe in more of a full disclosure policy to the people running the web site? In talking to some others...attempting to contact the site owners is the best option (which I agree with) yet some others may take a different approach. Some "grey-hat" hackers might even resort to causing havoc with the HVAC system just to prove a point, then disclose the vulnerability the right way. Thoughts from the community?