Pharmacy chain's Cisco edge firewall used 'password' as enable password; audit and IT clashed over severity because of bonuses
A pen tester, Dahvid Schloss (COO of Suzu Labs), audited the network devices of a large, unnamed US pharmacy retailer and found that an internet-facing Cisco edge firewall used the enable (administrator) password "password". The password was stored as Cisco IOS type 7, a reversible encoding with a publicly known key, so he could recover it from the configuration file without guessing. He rated the finding "high". The internal audit team agreed and the IT team argued it was only "medium", leading to a call of more than an hour that left Schloss unable to finish presenting his findings. He later learned that any "high finding" would eliminate the IT team's bonuses, which explains the dispute. The client kept asking him to re-explain the finding for three years. No exploitation or breach is reported.
Detalhes técnicos
- The weak credential was the enable password on an internet-facing Cisco edge firewall.
- It was stored as Cisco IOS type 7, which is reversible encoding rather than a hash.
- An attacker with normal user access, for example via SSH or an exploit, could escalate to administrator and, for example, cut off outbound traffic from the intranet.
Remediação
- Do not use dictionary words or defaults as administrative passwords.
- Do not rely on type 7 encoding; use stronger password storage.
- Align incentives so that tying compensation to security findings does not push teams to downplay severity.
Linha do tempo
-
Pharmacy chain's Cisco edge firewall used 'password' as enable password; audit and IT clashed over severity because of bonuses
ler a análise desta fonte ocultar
A pen tester, Dahvid Schloss (COO of Suzu Labs), audited the network devices of a large, unnamed US pharmacy retailer and found that an internet-facing Cisco edge firewall used the enable (administrator) password "password". The password was stored as Cisco IOS type 7, a reversible encoding with a publicly known key, so he could recover it from the configuration file without guessing. He rated the finding "high". The internal audit team agreed and the IT team argued it was only "medium", leading to a call of more than an hour that left Schloss unable to finish presenting his findings. He later learned that any "high finding" would eliminate the IT team's bonuses, which explains the dispute. The client kept asking him to re-explain the finding for three years. No exploitation or breach is reported.
Technical Details
- The weak credential was the enable password on an internet-facing Cisco edge firewall.
- It was stored as Cisco IOS type 7, which is reversible encoding rather than a hash.
- An attacker with normal user access, for example via SSH or an exploit, could escalate to administrator and, for example, cut off outbound traffic from the intranet.
Remediation
- Do not use dictionary words or defaults as administrative passwords.
- Do not rely on type 7 encoding; use stronger password storage.
- Align incentives so that tying compensation to security findings does not push teams to downplay severity.