Changing Road Signs is Dangerous. Zombies are not funny. - The HP Security Laboratory Blog -
Changing Road Signs is Dangerous. Zombies are not funny.

Zombie warning signsLike mentioning a bomb while in the TSA line, there are some things you just don’t joke about. As any sane person with a Zombie Escape Plan (ZEP) will tell you, you’ve got to heed warnings and take immediate and drastic measures to ensure survival—cutting across lanes, the center divider, and heading in the opposite direction would be a good start in this situation.

 

So, I urge these “hackers” to please refrain from putting up messages about zombies. Or robots. Or aliens. Anything else is fair game, including… puppies, kittens and the geniuses behind the “credit default swap.”

 

Well, perhaps a better solution would be to change the default passwords, or locking the control panels up?

 

We’ve been preaching the changing of defaults in the security business for years, and it has finally taken root in the rest of IT and in many cases our business units. But it seems the message isn’t being heard outside office environment. However, end-user education is only one step in the process—manufacturers of all types of equipment need to take security seriously.

 

As more and more traditionally non-computerized equipment is attached to computers (and networks) this type of issue will be on the rise. Sure, a road sign hack seems funny, but what important message was there before? What if a computerized crane were recalibrated in some way to make distance measurements inaccurate? Is there a “secret” string of zeroes that will let you mess with the software running your shiny new hybrid?

 

Who knows the answers to these things… manufacturers, of course! Only by forcing their end-users to change default passwords, or better yet, not having them at all, can we prevent the “easy hack” that allowed the fake zombie warning. After all, you don’t need to educate them if they have no insecure choice.

 

In the meantime (and just like security testing), sane people please adjust your ZEP to account for false positives.  The rest of you: don’t cry zombie.

 

 


Posted 01-29-2009 7:57 PM by Chris Sullo
Filed under:

Add a Comment

(required)  
(optional)
(required)  
Remember Me?

Type the numbers and letters above: