Unpatched Windows 7 server gave tester control of factory network
A penetration tester gained control of a factory’s network through an unpatched Windows 7 server connected to CNC milling machines. The administrator’s password was a strong, insulting message aimed at hackers, but it did not protect the network from a vulnerability in the outdated machine.
The company had been breached six months earlier and had disconnected many servers from its domain, limiting the tester’s options. One server remained connected and vulnerable to EternalBlue; credentials recovered from it included the administrator’s password, which turned out to be genuine. The account gave the tester full network control, underlining that patching and managing legacy systems mattered more than the password’s strength.
In short
- An unpatched Windows 7 server opened the factory network.
- The administrator’s password was strong but real.
- Legacy systems can undermine other security measures.
Explained simply
CNC milling machines are computer-controlled tools used to cut and shape materials in manufacturing. They can be linked to a company network so staff can manage designs and production, but that connection can also expose factory systems to risks found elsewhere on the network.
Windows 7 is an older version of Microsoft’s operating system, and unsupported or unpatched computers may remain vulnerable to known security flaws. EternalBlue is the name given to one such vulnerability, which can allow an attacker to access a computer if it has not been properly updated.
A penetration tester is hired to look for security weaknesses by attempting to access a company’s systems. In this case, the reported route involved an old server that was still connected to the network; the episode illustrates why organisations must account for legacy equipment and keep software updated, even when they use strong passwords.
Read the full article at the source →
Originally published by The Register as “Admin dropped the F-bomb in a password to show hackers who was really 1337”.