Audit Finds Edge Firewall at Major US Pharmacy Chain Protected by the Password 'password'

A penetration tester has described a striking security failure at a large US pharmacy retailer, which he did not name. Dahvid Schloss, COO of Suzu Labs, was asked to audit the company's switches, routers and firewalls, not to break in. During the review he found an edge firewall, the device that faces the internet, with its administrator ("enable") password set to "password".

The enable command on Cisco devices gives a user administrative control over the firewall and the network traffic it manages. According to Schloss, an attacker who gained normal user access, whether through SSH or an exploit, could then escalate to admin and do serious damage, such as cutting off all traffic from the internal network to the outside world. He did not need to guess the password. It was stored as Cisco IOS type 7, which he described as a reversible encoding with a publicly known key rather than a true hash. He said it was best practice even then to avoid it.

Schloss said the password would have been easy to guess even if it had been stored securely. He rated the issue a "high find", meaning a serious weakness that should be fixed right away. The story, from The Register's PWNED column, is introduced as one where misaligned incentives led to an intractable argument between the IT department and auditors. This summary covers only the opening of that article.