ID: IRCNE2014022098
Date: 2013-02-09
According to "computerworld", the massive Target breach led to revelations that many companies use Internet-connected heating, ventilation, and air conditioning (HVAC) systems without adequate security, giving hackers a potential gateway to key corporate systems, a security firm warned Thursday.
Cloud security service provider Qualys said that its researchers have discovered that most of about 55,000 HVAC systems connected to the Internet over the past two years have flaws that can be easily exploited by hackers. In Target's case, hackers stole login credentials belonging to a company that provides it HVAC services and used that access to gain a foothold on the company's payment systems.
HVAC vendors and other third parties often have remote access right to these systems for administrative and support purposes.
Hackers can exploit these systems to gain access to enterprise networks and leapfrog onto other corporate systems, Qualys said.
The recent breach at Target, which resulted in the theft of data on 40-million credit and debit cards, is believed to have occurred in this way.
"The Sochi system doesn't even require a password, so if you know the IP address, you're in. We've contacted the integrator to warn them of this problem," Rios noted.
Often, the companies that have remote access to HVAC systems fail to realize that the systems can be used as a gateway to sensitive corporate networks. So they typically tend to have lax security measures, he said. For instance, many HVAC management companies use the same password to access systems belonging to multiple customers, he said.
- 2