Backdoor that threatens power stations to be purged from control system
Found on Ars Technica on Saturday, 28 April 2012
Mission-critical routers used to control electric substations and other critical infrastructure are being updated to remove a previously undocumented backdoor that could allow vandals to hijack the devices, manufacturer RuggedCom said late Friday.
The previously secret account uses the login ID of "factory" and a password that's recovered by plugging the MAC, or media access control, address of the targeted device into a simple Perl script.
RuggedCom devices are frequently installed in electric substations, traffic control cabinets, and other locations where dust, extreme heat and cold, and other difficult environmental conditions take a toll on hardware.
It would be more interesting to know why a undocumented backdoor exists in the first place. It doesn't sound like a simple bug, it looks like RuggedCom deliberately created an option to access the devices even when administrators thought they had locked them down.