Hacker pwns police cruiser and lives to tell tale As a penetration tester hired to pierce the digital fortresses of Fortune 1000 casinos, banks and energy companies, Kevin Finisterre has hacked electronic cash boxes, geologic-survey equipment, and on more than one occasion, a client's heating, ventilation, and air-conditioning system. But one of his most unusual hacks came …
Same old story, the managers demand the staff cut corners. The IT techs complain saying this is not right and should be done properly but managers tell them to STFU and get it done or else find another job.
Lost count of the number of times some prick has asked me to dump DB data to a flat file and simply FTP to some third-party vendor's public FTP site, not even a vague attempt at security with SFTP, pure open FTP! I also lost count the number of times I have refused on the grounds of company security only to have some upper management twat tell me to just do it and stop being difficult. I simply refuse and ask them to ask one of my colleagues to perform the operation so when it does go wrong I can prove full denial.
The admins at the police dept probably had nothing to do with this. The systems were bought by some official and installed in the cars - probably by the vehicle maintenance dept.
Think about how much computer kit there is in your building that the sysadmins aren't in charge of. Do you security audit the phone system, CCTV, fire alarm, photocopiers, HVAC?
What about your CEO's cell phone, or the hands free kit in his company car?
I can configure HVAC, if you mean frequency converters. And I can check if the alarmsystem has a master password. Yes I do check firealarms 1 time a year.
And it doesn't matter who made the purchase. If the admins would care, they would check it, and report such heavy mistakes. A reason to get some moneyback, don't you think?
The problem is that lamersdont care. They lie, simulate and get salary.
"I am impressed that Verizon's network can support live streaming from a PVR. Would be nice to get that kind of HSUPA bandwidth in London."
Well, Verizon's not a GSM carrier, they are using CDMA (for voice, and EDGE-style low speed data fallback) and EVDO (for 3G, data only). EVDO looks antiquated on paper -- 3.1mbps down, 1.8mbps up peak. But, it's pretty common to actually CONSISTENTLY get 50% of this peak.
Partially VZW spends huge wads of cash on their network (adding backhaul, adding additional capacity, they are pretty careful about network tuning).
Partially, since the CDMA and EVDO channels are only 1.25mhz down and 1.25mhz up, they can fire up another EVDO channel more easily.. for instance, with 20mhz of spectrum, they have room for 8 channels total. Since HSPA uses a 5mhz width, a GSM carrier with 20mhz has a choice of all GSM/EDGE, 1 channel of HSPA and the rest GSM, or 2 channels of HSPA but having to shut down GSM/EDGE entirely. (In reality, the likes of VZW or AT&T have more like 60mhz of 850mhz + 1900mhz in big cities, but it still makes things easier).
And partially, to be honest, Qualcomm has crack engineers, they are good about considering real-world RF conditions and not just ideal lab conditions.
VZW's now rolling out LTE in the 700mhz band. Peak speeds of 60mb/sec; of course nobody gets that speed, but I've seen a couple speed tests of 35-40mbps (uncommon though), some at about 25mbps, and plenty at 15-20mbps. Worst case seems to be 6-10mbps. VZW did tests under load, and say to expect 5-12mbps. Since this is pretty new I seriously doubt the PD is using LTE already. Obviously, that'd stream a DVR pretty easily.
Way I would read this is that the equipment wasn't at fault, it was the guys who set it up didn't know what they were doing. Any IT guy worth his or her salt knows that:
Routers and other devices have default passwords. They have to, or you wouldn't be able to set them up in the first place. You don't, however, leave them like that.
If you forward an inbound port, you also create a firewall rule to restrict the IPs that port can be seen from. Or, if you want the port to be globally accessible you implement some form of strong encryption.
Since the router or DVR equipment manufacturer can't predict exactly how the kit will be used, it would be unreasonable to expect them to warn that a certain combination of kit, with unsuitable settings, will create a security risk.
But you're assuming that the defaults were changeable. We don't know that. I turned down an offer of equipment from my telephone company because the password was set in stone and not changeable (it's possible that the the equipment had unique passwords per box; I didn't ask; but it's still not something I'm willing to accept). And frankly, it was sheer luck that I asked the right questions first and found out about it.
The PD IT people probably didn't get to have that level of interaction with the sales reps.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
