Smart fish tank left Casino vulnerable to hackers.

reefwiser · Jul 20, 2017

http://money.cnn.com/2017/07/19/technology/fish-tank-hack-darktrace/index.html

gcarroll · Jul 20, 2017

Wow, I wonder what controller they were running?

reefwiser · Jul 20, 2017

Do we want to know [emoji3]

gcarroll · Jul 20, 2017

Good point. I'm sure that if it was a company that we use they would have sent out a warning to their customers by now.

Jlentz · Jul 20, 2017

gcarroll said:
Good point. I'm sure that if it was a company that we use they would have sent out a warning to their customers by now.

Lol

Jlentz · Jul 20, 2017

Telnet is wide open with default creds on apex. It'd be really surprising that the IT team didn't isolate it on an IOT subnet though.

I'd thought it was a HydraHD light with the built in access point or something similar until they mentioned feeding and "keeping the fish comfortable".

RussM · Jul 21, 2017

Jlentz said:
Telnet is wide open with default creds on apex.

Telnet is not always open *with default credentials*. Telnet in the Apex uses the same credentials as the web-based interface. The only time your statement would be true is if the username and/or password have not been changed.

It's highly unlikely that there was an Apex involved anyway. In all probability, the controller in question is one that uses an open source operating system like Linux or perhaps Android.

Jlentz · Jul 21, 2017

Sorry about that RussM, I had to use telnet to a different, non reef device the same day I was doing some fusion programming last week. That device didn't have a way I could find to change the telnet creds... I wish you guys would kill telnet though.

I take it from the reply that at least you guys haven't been contacted, and may have an idea of exactly which controller was being used, I'd love to hear exactly what happened.

ourcoralreef · Jul 21, 2017

make sure all your devices are up to date thats one thing updates do protect you from exploits in the devices programming

Ps got me curious about what device was exploited and how

Ocelaris · Jul 21, 2017

It's most likely that this was exposed to the internet directly, instead of being behind a firewall like the apex. I wouldn't be surprised if in some fashion most IOT devices would be vulnerable, even if it's a function of not being updated (and the vendor provided patches). This is like a medical device, people don't patch when they don't need to; so it ends up being an easy target. Usually a cyber security firm would notify the vendor first, and only if they didn't have a response would they release the vulnerability to the wider internet. I suspect we're in that stage where the vendor has been notified and they released a sketchy note just to get movement.

RussM · Jul 22, 2017

I obtained a copy of the white paper containing the case study (after multiple emails & evading a fairly hard sales pitch

) It is rather vague. However, it did say that there was a VPN for remote access to the fish tank system involved (leading to my inference that errors by the IT staff were probably made), and the use of a "protocol normally associated with audio and video", which lends further credence to my hunch that a controller with an open source operating system was involved.

Jlentz · Jul 23, 2017

RussM said:
I obtained a copy of the white paper containing the case study (after multiple emails & evading a fairly hard sales pitch ) It is rather vague. However, it did say that there was a VPN for remote access to the fish tank system involved (leading to my inference that errors by the IT staff were probably made), and the use of a "protocol normally associated with audio and video", which lends further credence to my hunch that a controller with an open source operating system was involved.

Can you say what the "protocol normally associated with audio and video" was?

That's my particular profession. I'm really curious now.