3 ms·
Most test equipments, ancient or recent, are not expecting their programming interfaces, let it be an analog voltage, GPIB, RS232, USB or LAN, exposed to the pu
by qwezxcrty 3y ago
Most test equipments, ancient or recent, are not expecting their programming interfaces, let it be an analog voltage, GPIB, RS232, USB or LAN, exposed to the public internet and it would be a extremely stupid thing to do so. The maker of them assume that if one is able to operate them, one should know where they should plug the cables in.
These equipments are simply assuming that anyone can access the interface is not hostile. This is a pretty good assumption in most lab settings that I know, unless the operator is so ignorant. This assumption certainly have made my life much easier in the lab, of course, where every LXI test equipments are connected to a isolated LAN. I would say a lot more f*k in the lab if I have to authenticate myself before sending a SCPI command. I'm happy that most test equipment makers do agree with me.
For example, modern Rohde&Schwartz gears running Windows or Linux (FSV, FSW, FSVA, FSUP, SMA, SMC, ZNL, etc.) have VNC or Windows RDP enabled by default, and have a weak default password shared among the series. Keysight ones too (E5071C, DSOX3000T, maybe not on by default but with a supported way). A hostile user can even screw up a LAN connected, damn simple VxWorks based multimeter like Agilent 34410A badly by sending the calibration commands at the wrong time or some backdoor commands (DIAG:xxxx, haven't tried but looks possible).
Slightly off topic, some Chinese test equipment makers are making hackability as a feature, look at Siglent or Rigol scopes. They can (and they are competent enough to) lock down the system with secure boot like some Tektronix ones. However they don't, so that people with less budget can buy a cheaper model and hack for the bandwidth.
- TheRealPomax 3y agoThen maybe RIGOL should not make assumptions and not release a device with near-trivially insecure firmware.
- jfim 3y agoPeople don't buy Rigol because they want a secure device, they just want a low cost oscilloscope.
- TheRealPomax 3y agoPeople don't buy a fridge because they want a secure device either, that doesn't mean the manufacturer doesn't have a legal duty of care when releasing software with security vulnerabilities.
- technion 3y agoMy issue with these "they don't need to worry about security" issues is that this issue is at its core still an obvious bug. If your password generator puts a ; in your password your attempt to set it will break. I went through a similar argument with an intranet product that "didn't need to worry about SQL because it's on a trusted network" crashed when Bob O'Reilly tried to make an account.
- myself248 3y agoThen it simply should not have a password. If everyone who can access it is benign by definition, simply remove the access control. Having a password implies that it provides some meaningful security. A bad lock is worse than no lock, because it will lead people to put the instrument in inappropriate places.
- Suzuran 3y agoHaving a password makes it less likely that the script that your co-worker got in their email and ran behind your firewall will destroy your stuff as a side effect of scanning your network for things it can destroy.
- qwezxcrty 3y agoI agree to some extent, that's why no one put a password to the telnet based LXI SCPI command interface. But a weak password maybe useful sometimes, to prevent your coworker accidentally connect to the wrong equipment and mess up one's experiment. Here it's never meant to deter a hostile coworker, in that case one reports to one's superior rather than rely on the password which is always stickered to the scope itself (in my lab).