| BAA Heathrow airport hacker exposure |
|
| Written by Michael Dogali | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Date: 20/01/2008 Recently Honest (this is the nick of our affectionate user) has discovered per chance that the information system usable by the customers of the London airport is not so secure, that it's easily vulnerable from hacker attacks (in the literally meaning, not in the overused and misinterpreted media one). Let's start from the beginning. Few days ago Honest contacts me to ask if we'd be interested to public an article on what he defines a real "scoop" of the information sector. These computers are, indeed, dedicated to the customers use to surf paying through credit card. It's easy to think, thou, that every user would inset the personal credit card code, log in an email account, digit password and so on; sensitive data that, as the machine's low protection, would be easily grabbed and used for wrongful scopes. Honest assures to be able to provide the necessary acknowledgement to demonstrate what said. Granted that I don't know personally Honest and, before this occasion, we have never been in touch. About him I know just what he has told of himself: Honest is italian and works in information security. For this reason I didn't consider immediately reliable his information, or at least give myself the benefit of the doubt, asking to our "sneak" for more details. Therefore Honest gives me the link of an image on a foreign server that represents a incriminated machine's screenshot; clearly this is not sufficient to give plain credit to his story, that still needs a due check. By that the Honest's curiosity takes soon the upper hand: he starts to verify a set of conditions; at the end of his "exploration" he is totally surprised by the exposition level of a machine that can potentially cause a big damage to the information security of Heathrow. Sure, the machine won't be owned by the airport, but by an external company provider (http://www.spectruminteractive.co.uk) that sells the service, but this doesn't change the responsibility of whom proposes the service to the public of the customers (passengers and airport personnel). Honest, indeed, clears that on the machine used by him it's not only possible "getting around" the access, surfing for free instead that paying, but also installing different type of software, having access to the file system, turning it in a bot to intercept IP traffic or sniff access credential, or in a bridge with the extern. It's important to highlight once again the prime responsibility goes specifically to Spectrum Interactive that has provided the machines and keeps their maintenance. Below it's reported the technical analysis made by Honest with the relative evidences that confirm the vulnerabilities found. File listing: Through Internet Explorer it's possible to access to all the computer files. Information Disclosure: Some of the files used for the system deployment contain useful information in order to conduct more sophisticated attacks. Command execution: It was possible to execute commands on the machine through MsDos window. Indeed, through a Gmail box dialog it's was possible to upload the file, modify a link on the desktop in order to recall the file command.com. Through the MsDos window it was allowed to visualize different computer information: IP address Computer's name Installed softwares Windows Patch Moreover, always by using the internet explorer box dialog, it was possible installing softwares. In the specific this technique permits to install:
Remote Access The public address used by every machine is reachable remotely. This means that external attacks are feasible and also the back door's use can ensure the access by external users. These simple vulnerabilities make these computers completely under control of hypothetical bad-intentioned users and represent a big problem for the privacy of all the unaware internet users within the airport. At the moment of the publication of this article, the security managers of Heathrow and of the service provider company have been already alerted of the case, as Honest affirms. Therefore probably these machines have been just dismissed. Moral of the story: We hope that after the publication of this article Heathrow's management will realize that protecting their users, even from the Information technology point of view, is just as important as ensuring their physical security; therefore we strongly hope that the Spectrum Interactive will increase the level of attention providing their products through adopting more accurate security checks. We consider important editing this article with the aim of warn all those who, through PC whose the level of security is not known or sure, access to their e-mail account or simply introduce sensitive data, like their credit card number, to brows in Internet or make online transactions. Indeed, you may enter your data on computers, such as those ones in Heathrow, which could be used by ICT expert to conduct actions absolutely illegitimate or not legal. It's very important that everyone become aware of the main issues relating to information security and is educated to adopt a greater attention just as it happens in other dangerous situations proper of everyday's life. Our thank is granted to Honest for the opportunity he gave us, through RedOracle.com, to highlight this issue and disclose the information as educational.       
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| < Prev | Next > |
|---|
