cross-posted from: https://feddit.org/post/3122226
Chinese state-sponsored spies have been spotted inside a global engineering firm’s network, having gained initial entry using an admin portal’s default credentials on an IBM AIX server.
Binary Defense’s Director of Security Research John Dwyer said the cyber snoops first compromised one of the victim’s three unmanaged AIX servers in March, and remained inside the US-headquartered manufacturer’s IT environment for four months while poking around for more boxes to commandeer.
It’s a tale that should be a warning to those with long- or almost-forgotten machines connected to their networks; those with shadow IT deployments; and those with unmanaged equipment. While the rest of your environment is protected by whatever threat detection you have in place, these legacy services are perfect starting points for miscreants.
[…]
This particular company, which Dwyer declined to name, makes components for public and private aerospace organizations and other critical sectors, including oil and gas. The intrusion has been attributed to an unnamed People’s Republic of China team, whose motivation appears to be espionage and blueprint theft.
[…]
using an admin portal’s default credentials on an IBM AIX server.
I think that there are two ways to solve that.
The first is to have the admins actually complete setups.
But, humans being humans, maybe the second is a better approach:
When creating a computer system, don’t let a system be used, at all, until all default credentials have been replaced with real ones. If you do, someone is invariably gonna screw it up.
Your directions may say “Before pulling lever 2, pull lever 1 so that machine does not explode”. And maybe you feel that as the manufacturer, that’s covered your hind end; you can say that the user ignored your setup instructions if they get into trouble. But instead of doing that, maybe it’s better to not permit for a situation where the machine explodes in the first place; have pulling lever 2 also trigger lever 1.
