Help to close back doors in printers, computers and appliances

Alan Paller, director of research at the SANS Institute, says that hundreds of millions of devices are being placed on networks with built-in back doors. He cites printers, routers, computers, control systems, storage systems and medical devices. “Nearly every automated device has them,” says Paller. “The manufacturers of these systems never told you how vulnerable you are. One victim said ‘It’s as if the people who are supposed to help me put a big sign on my door saying, the key is under the mat by the back door, and anyone can come in and violate me and my family’.” Paller explains that these vulnerable back doors were installed to allow remote management – so they are fully functioning processors with network connections, operating systems and memory. “In addition to being able to disable the device, in many cases they provide remote back-door access to the main CPU and storage of the computer or other device. They may not be logged or monitored and therefore can be attacked repeatedly without fear of being caught.” He’s talking, for example, about BMCs (baseboard management controllers) in Intel-based PCs and servers, used as intelligent controllers for inventory, monitoring, logging and recovery control functions that are independent of the main processors, BIOS and operating system. Similar functions are provided on Unix systems and on printers and medical devices and other appliances. “These back doors have already been implicated as attackers in successful denial of service tools, and can be used to access and change the data being processed by the devices,” states Paller. “This research project is designed to develop detailed technical procurement language that organizations can use to ensure these back doors are closed and locked when the devices are delivered,” he adds. If you want to get involved you can email Alan Paller at apaller@sans.org