

Was The 3 Character Password at Hacked Water Treatment Plant A Siemens Default? - TheloniusPhunk
http://threatpost.com/en_us/blogs/was-three-character-password-used-hack-south-houstons-water-treatment-plant-siemens-default-11

======
16s
I don't know the details of this specific system, but I have seen some systems
that would break (utter and complete failure) upon password change. Some
vendors would go so far as to threaten that support contracts would not be
honored if passwords were changed. That was 12 years ago, but I imagine that
some vendors still hard-code passwords and rely on them not changing. It'll
take lawyers and contracts and court battles to sort those vendors out.

------
swdunlop
"and other Internet-facing Simatic HMI systems .."

I love that ThreatPost wedged that one in there -- anyone who has worked with
SCADA systems knows the second rule is "don't expose your HMI's." (The first
rule is "don't believe the vendor.")

------
pavel_lishin
> couldn't confirm that a default, three digit password hard coded into an
> application used to control the company's SCADA software played a role.

Isn't that as good as saying "yes, the default password is always 100"?

------
AJ007
That's not a hack, that's opening a door locked by a piece of tape.

------
nomdeplume
should have shipped with custom password. Assuming the sysadmin could read.

------
faragon
123

~~~
gue5t
The actual password was "100".

[http://support.automation.siemens.com/WW/llisapi.dll/4581536...](http://support.automation.siemens.com/WW/llisapi.dll/45815364?func=ll&objId=45815365)

~~~
pavel_lishin
I would have guessed 007.

