Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default?

http://threatpost.com/en_us/blogs/was-three-character-password-used-hack-south-houstons-water-treatment-plant-siemens-default-11

by TheloniusPhunk • 15 years ago

18 8 15 years ago

threatpost.com

faragon• 15 years ago

123

gue5t• 15 years ago

The actual password was "100".

http://support.automation.siemens.com/WW/llisapi.dll/4581536...

pavel_lishin2• 15 years ago

I would have guessed 007.

swdunlop• 15 years ago

"and other Internet-facing Simatic HMI systems .."

I love that ThreatPost wedged that one in there -- anyone who has worked with SCADA systems knows the second rule is "don't expose your HMI's." (The first rule is "don't believe the vendor.")

pavel_lishin2• 15 years ago

> couldn't confirm that a default, three digit password hard coded into an application used to control the company's SCADA software played a role.

Isn't that as good as saying "yes, the default password is always 100"?

nomdeplume• 15 years ago

should have shipped with custom password. Assuming the sysadmin could read.

16s• 15 years ago

I don't know the details of this specific system, but I have seen some systems that would break (utter and complete failure) upon password change. Some vendors would go so far as to threaten that support contracts would not be honored if passwords were changed. That was 12 years ago, but I imagine that some vendors still hard-code passwords and rely on them not changing. It'll take lawyers and contracts and court battles to sort those vendors out.

AJ007• 15 years ago

That's not a hack, that's opening a door locked by a piece of tape.

Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default?

Related Stories