Google left heating, cooling system open to hackers - davenportwornat1995

Hackers could have turned up the heat in one of Google's offices in Sydney. Literally.

Data processor security researchers with Cylance institute that Google's Australia branch was using an unpatched version of Niagara, a software used for managing control systems in buildings.

Billy goat Rios, field of study director and manager of consulting for Cylance, wrote the finding is part of research the company is doing into postindustrial control systems, which involved scanning the Internet for vulnerable devices.

Computer security measur researchers with Cylance found that Google's Commonwealth of Australi branch was using an unpatched version of Niagara, a software arrangement used for managing restraint systems in buildings.

Google's building at Wharf 7—a scenic berth on Sydney's nurse—used a "slightly outdated" version of the Niagara framework, which is developed by Tridium, a company closely-held by Honeywell. Cylance wrote a custom exploit to express a configuration file from Niagara Falls, which contained the user names and passwords for sceptered users.

Although the passwords were encrypted, Cylance used custom tools to decrypt the passwords, opening up the software for takeover.

Cylance didn't do anything malicious and notified Google of the problems, and the company "quickly pulled offline" the system, Rios wrote. But the company's researchers did aim a peek at the organisation, which allowed them to see a third-floor represent of the office revealing its water and HVAC systems.

A Google spokeswoman said on Tues that "we're glad when researchers report their findings to us. We took appropriate natural process to resolve this issue."

It would have been possible for the researchers to "root" the control system, surgery maintain persistent, complete access to it. Google said the access the researchers had would have only allowed them to manipulate the building's heating and cooling.

Industrial control systems, which are widely used in a variety of settings such as factories and utilities, have been found to hold dangerous vulnerabilities that would allow hackers to remotely control raw systems.

The U.S. government runs its own brass, the Industrial Control Systems Cyber Emergency brake Response Team, that is dedicated to studying security issues with the aim of securing critical general infrastructure.

Rios wrote on his web log utmost November that the Niagara industrial control condition system is one of the most widely used ones in the world. He saved other vulnerabilities in the software, which he reported.

After an first slow response, Rios wrote that Tridium and Honeywell eventually gave him special access to review their patches, which fixed a directory transversal issue, a weak academic term job and an issue involving the insecure storage of users' credentials.

Source: https://www.pcworld.com/article/451694/google-left-heating-cooling-system-open-to-hackers.html

Posted by: davenportwornat1995.blogspot.com