I'd hazard a guess that unless the vendor can provide over-the-air updates and every system which plugs into these telematics units can also be easily upgradeable to incorporate the new added auth functionality, it might be better just to make everyone aware of the issue?

Ultimately this blog post doesn't describe any rocket science at all: anyone wanting to cause trouble on the internet is well aware of Shodanning for exposed ICS systems that fail to even implement authentication.

I'd be pretty wary of pushing information like this out in the open without first making sure the vendor had time to alert their customers that his is about to hit the streets. Who knows what kind of vehicles we're talking about and under what conditions they operate. Of course it isn't rocket science, but that doesn't mean you need to advance your stature in the security community by blindsiding some manufacturer on Sunday evening.

Anyway, call me old-fashioned, I don't think this is the way it should be done.

FWIW I'm aware of a SCADA system that is widely deployed that is just about as secure as this system here and I'd be the last person on the planet to publish the details of it because I know for a fact that it is used to control HVAC equipment and other building infrastructure in hospitals and prisons. These things are not toys and being aware of them does not actually allow you to play god. (In that particular case as far as I know the systems are so old that fixing them with an update is not even an option).

> I'm aware of a SCADA system that is widely deployed that is just about as secure as this system

Yes, you and a cool bunch of Chinese and Russian government-hired hackers, too.

I think you might be late to the party. It's widely known that these systems don't have any kind of security at all. The potential criminals already had this information for a long time.

The SCADA System or the underlying protocol?IEC6180(Layer2 Goose)or DNP3 dont define any auth or securtiy while OPC_UA does.

Would it be "ethical hacking" to DDOS any website hosting or linking to this article?

No, of course it wouldn't be.

Are you unsure of the answer?

It's a thought question.

If releasing irresponsibly a vulnerability puts people in real danger, is it worth it to suppress the release of that vulnerability?

> unless the vendor can provide over-the-air updates

http://www.neweagle.net/ProductDocumentation/Telematics/Tele... mentions "Remote Flashing" so I guess they fix that.

Well the OP includes details of commands that can be sent including "update" so perhaps someone has already updated all of them to add a backdoor.

What was "disclosed"? The page simply demonstrates some of the remote administrative features of these units.

What should be interesting is to see that now the company(s?) producing them must now about this new interest in the details of their devices whether they have contacted all their clients today to warn them of potential issues.

I'm going to go with "no". Companies that admit their failings to their customers are probably pretty rare, particularly "companies that will fail to attempt to secure their computer systems but will actively engage their customers when an issue becomes the focus of unwanted attention" must be close to zero in number.

Agreed, but I would not actually be surprised if they did not learn anything yet. The embedded hardware world is not quite as well connected in that sense as the web start-up scene. It could take a few days before the circle of the people that know about this and the circle of the people involved in that company intersect.

Which makes me wonder, is network traffic profiling common. Like, will the local network admins be getting alerts for traffic spikes on port 23 (SNORT and the like do this sort of intrusion detection I think?)?

I am hoping this an advisory for those implementing these devices. The device does what it should by publishing everything that it is setup to do. It is leaking information everywhere as designed. There are a lot of things such as public transit that you want this information being broadcast everywhere. You could write the same story for an FTP server with an open connection to the internet.

Yeah, this is kind of ridiculous. You can go from skimming the article to tracking vehicles in 30 seconds...

Yeah, you really have to wonder if this guy even exists or is just an alias. Because how could anyone be this openly reckless?

The people that produce blatantly poor products like this are the only ones to blame.

Absolutely, unfortunately it is their customers that will end up with the fall-out.

You know it's kind of ironic. How is the customer even supposed to know how insecure these systems are without blog posts like this one so they can avoid bad companies?

Actually, unless the customers are as incompetent as the makers of these devices, they should have asked themselves how come they could configure their device with no authentication, and if they could, who else could.

This is not really a bug, this an unfit design.