Are smart safes secure? Not after we've USB'd them, say infosec bods

I wish I could say

I find this unbelievable but I don't. When it comes to embedded computers idiocy of monumental proportions is not uncommon.

Waiting for...

...the official memo released by Brinks advising customers to squeeze a tube of super glue into the USB port. Or more likely, Brinks Secur-O-USB Brand Sealant, which is the same thing but costs $500 an ounce and requires a highly trained service technician to apply.

Unbelievable

As much as I may get slated for saying it, I'm not shocked - or even object - to the use of Windows as the OS for this sort of device. Windows, as well as Linux, BSD, QNX and others would be fine for the job. All of the above platforms are used in embedded environments, including safety critical appliances.

However, using one that is so, so old is unforgivable. On top of that, using vanilla USB is plain stupid, and I'm also assuming that the OS is set to autorun when the stick is inserted. Unless they are doing something clever and essentially bypassing the OS or exploiting a vulnerability then the reason this can be achieved is because of one thing - piss poor configuration.

I don't care what OS they are using, but if it's set to auto-execute anything plugged into the UNIVERSAL serial bus, and the environment is running privileged then it's totally irrelevant what platform the vendor has used. If it's a vuln in the OS then the vendor should be using a patched and up to date platform, and also additional measures should be in place regardless.

Even if you get into the OS and can spin up a shell or GUI, then why should that just give away access to the safe? Maybe after hours and hours, but by getting into the existing / current session should not be enough anyway. The control software should be secure, require all sorts of authentication and authorisation....

It's very easy to slate Microsoft, but actually I fail to see how it's the fault of the OS here. The vendor is exposing USB, on a platform built 14 years ago, without good security best practice once you have a session.

Shit security by shit design.

@ The Original Steve

Yes, but still, I know no modern OS that still have this huge stupidity set by default: auto-executing of removable storage. Apart from Windows.

OS X doesn't do that, no Unix I've approached (and I've seen quite a bit) do that. QNX, I'll admit I have no idea.

It's totally baffling to see Windows devs never learnt from the 80s viruses on Amiga (and probably other platforms, Atari ST ?), which primary vector was indeed the autoexec of removable storage, aka floppies in this age.

When you haven't learnt from the mistakes of people 30 years past, it's really hopeless.

I worked with an electronic safe company on some of their designs.

This is nothing.......

A safe with a USB port?

What could possibly go wrong? What moron thought up this idea!

Is it just me?

Or is anyone else reminded of the Thunderbirds episode "Vault of Death"?

"Nosey" Parker breaking into the electronic Vault at the Bank of England with just a hairpin.

That electronically controlled vaults was a bad idea is something they worked out in 1965!