RuggedCom to close industrial networking hardware backdoor
Canadian communications equipment specialist and Siemens affiliate RuggedCom has confirmed that its products based on the Rugged Operating System (ROS) contain an undocumented backdoor. According to RuggedCom VP of Marketing, Jim Slinowsky, versions 3.2.x and earlier of ROS allow backdoor access to the serial console, Secure Shell (SSH), web access (HTTPS), telnet and remote shell (rsh) services; ROS 3.3.x and above disabled telent and rsh. Read more...
Backdoor in industrial networking hardware
ROS is designed for service with electricity suppliers and in the transport and defence sectors The Rugged Operating System (ROS), an operating system created by the developers at RuggedCom, contains an undocumented backdoor. RuggedCom, a Siemens subsiduary, specialises in industrial grade networking equipment for "harsh environments" and recommends its switches and servers for use in power plants, oil refineries, military environments and traffic monitoring systems.
A posting on a security mailing list has now documented that all ROS systems have a "factory" user account that, the author says, cannot be disabled. Its password is derived from the hardware address of the network interface; a small Perl script demonstrates how a MAC address of00-0A-DC-00-00-00 turns into a password called 60644375. Read more...