Siglent SDS 1202X-E Network Security Issue - Page 1
Forum section: electronics / testgear

author: Dundarave
author_rank: Regular Contributor
timestamp: December 01, 2018, 02:31:26 am
content: TheRegister.co.uk today published an article regarding a network security issue with respect to the SDS1202X-E (and presumably its siblings). My apologies if this has been posted elsewhere on the forum already.https://www.theregister.co.uk/2018/11/30/pwned_via_oscilloscope/"Administrators overseeing lab environments would be well advised to double-check their network setups following the disclosure of serious flaws in a line of oscilloscopes.On Friday, SEC Consult said it had uncovered a set of high-impact vulnerabilities in electronic testing equipment made by Siglent Technologies.In particular, the bug-hunters examined the Siglent SDS 1202X-E Digital line of Ethernet-enabled oscilloscopes and found the boxes were lacking even basic security protections.Among the flaws found by researchers was the use of completely unauthenticated and unguarded TCP connections between the oscilloscopes and any device on the network, typically via the EasyScopeX software, and the use of unencrypted communications between the scope and other systems on the network."Two backdoor accounts are present on the system," the researchers explained. "A Telnet service is listening on port 23 which enables an attacker to connect as root to the oscilloscope via LAN."As a result, anyone who had local network access would be able to get onto the device and tamper with it.Siglent did not respond to a request for comment on the matter.Chalk this up as yet another example of the dangers brought on by the growing market for connected internet-of-things devices.Normally, an oscilloscope would be the last thing an admin would have to worry about, however as new connectivity is bolted onto devices that traditionally operated in isolation, it is inevitable that some otherwise basic security measures will be overlooked.Aside from the obvious dangers of allowing an attacker to use the compromised devices as a starting to point for attacks on other network devices, SEC Consult noted that someone could also use the vulnerabilities to mess with the oscilloscope's own readings - offering a handy route for sabotage."Any malicious modification of measurement values may have serious impact on the product or service which is created or offered by using this oscilloscope," SEC Consult said of the flaw. "Therefore, all procedures which are executed with this device are untrustworthy."That point is particularly noteworthy as observers have noted a marked increase in industrial espionage and IP theft attacks in recent years. It is not beyond the realm of possibility that a company wanting to hamper the progress of a rival, or a state-sponsored group that wanted to disrupt R&D, would look to mess with engineering equipment of a targeted facility."

author: bitseeker
author_rank: Super Contributor
timestamp: December 01, 2018, 05:37:27 am
content: On the one hand, it is good for networked devices to implement best practices when it comes to security. On the other hand, just because a device uses TCP/IP as a means for transmitting commands and data does not mean it should be put onto the Internet (or even a general-purpose Intranet).

author: cprosser
author_rank: Contributor
timestamp: December 01, 2018, 06:21:31 am
content: Yeah, when I got my 1204X-E I was all excited to fire up Kali Linux and work on my pen testing skills. I figured it would be an easy target. In the end, I’ve still been too lazy to even plug in the Ethernet cable.Sent from my iPhone using Tapatalk

author: tv84
author_rank: Super Contributor
timestamp: December 01, 2018, 10:03:32 am
content: Quote from: cprosser on December 01, 2018, 06:21:31 am

author: bd139
author_rank: Super Contributor
timestamp: December 01, 2018, 10:38:03 am
content: Honestly this is more an issue with shitty network design than the devices. The devices have intentionally lax security because they are designed to be frictionless.All your LXI shit should be on a separate physical network. Buy a cheap switch and a NIC and create a private network with these devices on them. They don’t need to be routable to the Internet. Or use the USB cable if you want to be cheap.Literally every single time I’ve seen someone get owned by a network device is was because they did something stupid, not an insecure device even if there were insecure devices present.

author: BillB
author_rank: Unknown
timestamp: December 01, 2018, 03:04:16 pm
content: Dear Siglent,Please don't waste any precious development resources unnecessarily hardening networking interfaces. Instead, continue adding function-related features and fix bugs.

author: bugi
author_rank: Regular Contributor
timestamp: December 01, 2018, 11:06:42 pm
content: If the below looks too long: Unless BillB or bd139 can proof they have some serious merits in security fields, I'd leave their replies partially ignored. (One could also ignore mine, I don't have serious merits on that field, either, but I do have read and learned quite a bit...) Mentions of typically issues being caused by human error/behavior/effect is correct, but trying to eliminate the human error is not enough (and also a futile exercise). Separating things to own networks is also a good advice, but not always possible, and not necessarily enough, either.The longer text:QuoteThere is no need to "harden" much anything. Merely to implement a standard as supposed to. Increasing field length to its intended length is a trivial task. Adding support for both passphrase and hex key is also nearly as trivial.Also, afaik, it is a bug, so, yeah, continue fixing bugs.For bd139. I can say that I have been in the receiving end of a serous computer security break twice (though not on my home machines). One time it was something in the software; the hole used remained unknown, but all the software was being updated often enough, and settings were pretty strict, so yeah, no way to blame the management of the system. The other time it could be blamed part on the software (it did have a hole), part us not doing updates often enough (which left that hole open long enough to be abused), part the network administration (the network was supposed to be our local with a firewall between outside... it wasn't).The first case shows that one can not just blame the human and ignore "minor problems" with software. And the last part shows the fallacy of trusting "safe local network" approach.When it comes to security, the mantra is that you never assume that everything else is working right for you. Instead, one assumes that everything else is broken (as long as possible, one has to make some assumption at some point). Thus, each part of the security must be done to the dot.And if one starts to make assumptions, it should work both ways. If Siglent is allowed to assume all users have safe networks (and the users behave like robots, no errors/laziness/etc normal behavior), we should be allowed to assume all Siglent devices are made properly to follow standards and to be secure (and Siglent engineers behave like robots, no errors/laziness/etc normal behavior). Apparently Siglent engineers are humans. They should assume we are, too. Thus, they should not make any assumptions about our networks or them being secure. Now that their mistake has been shown to them, they should fix it.It is also about trust in general. If I can not trust Siglent to make so simple part ofsecuritycorrectly, or if they assume our networks are always safe and nice, then what else I can not trust them with or what other assumptions they might make? What if they assume our power networks are also always isolated and veeery nice low noise without spikes, and they skip some safety components from power supplies? Etc. etc. Sure, bad stuff with power can kill and maybe they have taken that more seriously, but still, bad network security can cost a lot (no matter where the fault was), so they should take that seriously, too.I can understand the temptation of a full local isolated network, which simply does not have any connection to outside. Sounds tempting, yes, no problems with crappy oscilloscope software or whatnot.And it really is a good thing to aim for.But then, one must take extra precautions to ensure it stays that local way, to the dot. Did you remember to check every single USB slot in every single device every single morning in that "local" network? Perhaps someone put a WLAN stick in there... And the network cables, did you check every cable in every device every morning that they still go where they are supposed to go and there are no extra cables? Perhaps every morning is a bit too much, but at least once per week? Leaves a bit of window for attacker, though, but perhaps manageable risk?In scenarios like above, since the settings in devices have been left at "whatever, doesn't matter", due to the "it is a local safe network" mentality, a single change or hole somewhere, and everything of the security (in that network) goes away...And as others have mentioned, sometimes one can not affect the network to be used. As an example, I know a large company where workers wanted to play network games in the evenings occasionally. That activity was ok. Workers were smart enough that they wanted own separate network for it (i.e. not using the "corporate network"). There were free switches, the outside connection was paid from own budget, there was cable routing available (and there had been similar work just few weeks before, it was known it was possible), etc. etc. Was said, it took months before the corporate bureaucrazy managed to make the network arranged for playing. Imagine an external worker coming to do some scope-stuff there for couple weeks. Yeah, he won't be allowed to the corporate network, it will take way too long to arrange another network, so he will have to use whatever he finds or might be provided with, like the WLAN...I could understand these kinds of issues if the wlan stuff had to be designed and programmed from scratch, but afaik, there are plenty enough of ready code to be used or ported, and it should mostly be about implementing the UI, like a field for a secret key...I think all that shows I'm a bit paranoid when it comes to security/safety. I've seen too many examples where a single "little" thing that was supposed to not be a problem became the way in. So now I always want (security/safety) things done properly when possible, because you never know if justthat"little" thing breaks it all in the end. (Though this Siglent case does not affect me personally, I don't have that scope, I wouldn't use the WLAN even if I had it, etc. but I can see the itch it can cause for others.)

author: bd139
author_rank: Super Contributor
timestamp: December 02, 2018, 12:01:01 am
content: Yes not a clue here. I only spent the last 20 years in defence and financial sectors showing them how to build secure software and architecture. Throw me a technical question if you don't believe me. Literally anything.I'm not going to respond further to your experience other than it had one root cause and that was a lack of a credible ISMS and appropriate clue stick.Security is about compartmentalising and layering trust. If you can't trust a device you isolate it, which was my point. Then if the little problem appears, the scope of the problem is contained and risks are known. This is part of the policy that your org should have implemented but didn't.Go read ISO 27001 and come back enlightened.Siglent are not at fault here. This comes under your ISMS acquisition and risk assessment policy (hey I just did that for you!). Stuff it on its own switch, preferably a Cisco (with L2 port security), stick another NIC into the PC and give it a non routable network with no gateway. Can't add devices, can't route to and from the internet, allows user to do their work.But never let your staff play games on the company network, install their own devices or bring a USB stick into the building and make that a policy that will get their ass kicked out of the door if they do instantly, then execute your ISMS incident management process to handle this outcome that you already had done an RA for. If you did it. And have an employment contract that enforces staff responsibility, and do regular security training.If you did, you'd already have a GPO in place which stops USB ports being accessed or have the PC locked in a cage. Bingo.If you did not, your funeral!I usually get called up and paid a lot of money after that funeral.Edit: also as you're in Finland you are bound by GDPR. Even the smallest organisations need to cover information security properly now. Fancy a massive fine because some asshat at your company ripped off the customer or staff database and contracts, then left it on an unencrypted USB stick on public transport? Whole point of GDPR and supporting frameworks is to stop shit like this happening because all local data protection and security legislation turned out to be a justifiable operational cost or risk to take. Everyone needs to hit themselves with the clue stick or get fined off the planet.Edit 2: let's not single out Siglent here either. Keysight, Agilent, HP, Tektronix and various other vendors run ancient copies of windows on half their kit. Half of the NHS here in the UK runs on expensive bits of kit (MRI/CT scanners etc) plugged into old bits of crap dangling off Windows XP. When my youngest daughter was born 6 years ago, they had an ultrasound machine with a floppy drive running god knows what (looked like HP/UX of some sort), the machine dated 1997. And they all quite happily amble along without any problems because someone with a clue stick has been at it.Look windows 2000 + IE5:

author: vtwin@cox.net
author_rank: Regular Contributor
timestamp: December 02, 2018, 02:26:27 am
content: That’s pretty amusing... a Tektronix scope running windows lol

author: LapTop006
author_rank: Unknown
timestamp: December 02, 2018, 07:37:27 am
content: Quote from: vtwin@cox.net on December 02, 2018, 02:26:27 amMost high-end scopes, from every major vendor, do.It's one reason why I bought the Keysight 6000-X, not the MSO-S, I don't want to deal with that (I'm not anti-windows, the 6000-X runs wince, but I am anti-desktop-windows-in-embedded).

author: awallin
author_rank: Frequent Contributor
timestamp: December 02, 2018, 08:39:57 am
content: among other things there's a 'vendor contact timeline' and more info here:https://seclists.org/fulldisclosure/2018/Nov/68

author: bd139
author_rank: Super Contributor
timestamp: December 02, 2018, 10:06:33 am
content: Thanks for that.Backs up my assertion that you need to isolate this stuff. Most “embedded” vendors aren’t in the mainstream security lifecycle business so getting anything out the door or even a contact is unlikely.They’re one step above the IoT crap though because they’re used in a commercial environment where mitigation is likely.As for an attack vector you’d probably have to be targeted for this to be effective as the deployment of these scopes is minimal. Again, isolation.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 02, 2018, 12:39:52 pm
content: If vendors need to do anything, it's probably just to include clear warnings about potential security issues. Maybe even pop something up onscreen whenever the networks settings are changed.QuoteDo these people have a clue how scopes are actually used ?

author: bugi
author_rank: Regular Contributor
timestamp: December 02, 2018, 01:02:25 pm
content: Quote from: bd139 on December 02, 2018, 12:01:01 amFine by me. I guess your heavy emphasize of network isolation as the solution that seemingly makes everything good mislead me. I have heard so many security experts go more for "do all you can" (including network isolationandgetting software issues fixed).QuoteThe case 2 was more of a communication failure (one worker makes an assumption, nobody confirms it), in a non-critical network. Should not have happened anyway. As a side note, we did get that better isolated sub-network later, because one team was developing low level network stuff, and ended up accidentally DOSing the whole network for half a day once. So they gave us a smaller sub-network to breakI agree on the compartmentalising. The difference apparently is that, imho, one should not left obvious mistakes in security related software just go ignored as "not important, other things (like compartmentalization) will keep us safe". One wants that bug fixed andstillisolate the scope (when possible).QuoteNah. We all have our areas of expertise, my hands are already full with other stuff. Others are paid to handle that monster.QuoteAs the total security of the place where such scope would be used, no. But as having a mistake in their scope's software, Siglent is very much at fault (and the only one who can fix it).QuoteMy current company is big enough that there are "divisions" where that is indeed the way (and their network etc. are even isolated from the rest of the company). But also sections with much less critical setup, like ours. USB sticks are allowed, but only "company ones" (which only go outwards if needed), and no BYOD. (Or well, one can e.g. use own unmanaged mobile phone, but then you can't e.g. get work mail/calendar accessed with it.) Though the USB-things are quickly going out of use due to cloud-stuff (and only company controlled cloud is allowed). And some of us install software in our own PCs, simply because the IT support section whose job it would normally be are simply not capable of doing it properly for developers (the support still lives in the age of "one setup fits all"). Most people can still use the default support-provided installs, but many developers can not. All PCs are remote managed/manageable, though, and on regular automatic checks (for certain settings, anti-malware working, and looking for possible unlicensed or blacklisted software).QuoteYep. We got couple training sessions for everyone about that. Lawyers going around teaching about it, and discussing with developers about how it could be implemented in practice. Some more training for selected ones. I ended up having to go through the code of couple products to look for needed changes to allow being GDPR compliant with them. All the bureaucratic stuff like supporting information requests/deletions needed some extra functionality added, etc. About one man-year of work. That was the easy part. Getting the customers (i.e. companies using our products who are actually the main responsible party and pay the costs) to react, though, aaargh...QuoteAll understandable. But I think using Windows XP or such at the time of designing the product could not be considered a clear implementation mistake. I mean there was nobody saying "Choosing to use Windows XP does not implement a standard correctly"...

author: bitwelder
author_rank: Super Contributor
timestamp: December 03, 2018, 08:40:28 am
content: Reported also on the "Full Disclosure" security mailing list:SEC Consult SA-20181130-0 :: Multiple Vulnerabilities in Siglent Technologies SDS 1202X-E Digital Oscilloscopehttps://seclists.org/fulldisclosure/2018/Nov/68

author: Fungus
author_rank: Super Contributor
timestamp: December 03, 2018, 08:52:55 am
content: Quote from: BillB on December 01, 2018, 03:04:16 pmYou won't be saying that after there's a Bitcoin miner and spambot installed on it.

author: bd139
author_rank: Super Contributor
timestamp: December 03, 2018, 09:22:42 am
content: That’s not going to happen. There’s literally so few of these out there and hardly any of them are network connected and you’d have to be actively targeted and have your network compromised already which means you have massively bigger problems on your hands.Also the CPU doesn’t have enough grunt for it to be a decent target. Checked in AWS credentials and stolen credit cards buying GPU instances in AWS is where that class of dickhead is hanging out.

author: 2N3055
author_rank: Super Contributor
timestamp: December 03, 2018, 09:58:58 am
content: Quote from: bd139 on December 03, 2018, 09:22:42 amI basically do same job as you.I'm so tired of rampant paranoia.If you are not connecting scope directly to Internet without firewall how is somebody will gain access to it. What is your attack vector?If you have malevolent player already inside your private/secure network, you have bigger problems.And no, professionals won't tell you to do as much as you can. They do risk analysis, design protection layers and isolate.Nobody cares for your scope. Malevolent players also attack only what is lucrative. You have state players that are gathering intelligence and install malware for purposes of sabotage/manipulation/information collection. They target government branches, and any civilian contractors. In which case security will be explained to you by professionals.You have cyber criminals that are in for money. Read financial institutions, money exchange, stock market manipulation. Also, security will be taken care of by professionals.Nobody cares about small company that makes aftermarket ECU for car enthusiasts. You have to do basic security, so you can divert script kiddies and amateurs.Forbid use of hacked software and BYOD, lock USB ports and make sure nobody is surfing funny sites... Do cyber security education for EVERYBODY.And stop being paranoid.

author: BillB
author_rank: Unknown
timestamp: December 03, 2018, 01:42:48 pm
content: Quote from: Fungus on December 03, 2018, 08:52:55 amIf it's a choice between poor overworked Ding fixing my scope's MSO functions, or my power supply's ability to use a static IP address vs. him squeezing TLS 1.3 onto the box, then I'll take my chances with securing my own network, thanks.I secure my network and the devices on it so I don't need to rely on device manufacturers who are slapping some NIC and TCP/IP stack into their devices and calling it a day. With the proliferation of network devices of questionable origin, I also protect against a threat that this thread hasn't touched on that any of thesedevices may be the originators of malware themselves.

author: tv84
author_rank: Super Contributor
timestamp: December 03, 2018, 03:10:26 pm
content: Quote from: BillB on December 03, 2018, 01:42:48 pmThey are chinese...

author: bd139
author_rank: Super Contributor
timestamp: December 03, 2018, 03:23:13 pm
content: Not made by Hauwei. Probably ok

author: photomankc
author_rank: Contributor
timestamp: December 03, 2018, 03:44:59 pm
content: I have an isolation VLAN that these things go on. It's only ingress point to the home network is through my firewall and each device gets only what it has to have to function. In this case the scope doesn't need to initiate any traffic, so it's denied anything sourcing from it and only a few systems in the house are permitted to initiate to it. I do the same for any gear like this and other IOT type devices. I really didn't expect that it would be otherwise on these scopes. For wireless cloud dodads, they go on my guest WiFi network.

author: bitbanger
author_rank: Regular Contributor
timestamp: December 03, 2018, 05:30:44 pm
content: I mean I get it, to some degree, no one wants a zombie device on their Network farming bitcoin (or whatever) but...c'mon, fear mongering / "sensational" much?https://www.bleepingcomputer.com/news/security/digital-oscilloscope-comes-with-backdoor-accounts-old-software-components/

author: Kjelt
author_rank: Super Contributor
timestamp: December 03, 2018, 06:22:10 pm
content: Simple, no non IT department maintained equipment should be connected to the corporate network, period.Few years back I did a Wifi AP sweep for fun on the company floor.It was lingering with default password login standard tplink, cisco etc APs for some test setups. There were three that were connected to the corporate network.I reported this to IT security and they acted very fast. They told me next time just login with the default password, disable the radio and change the password. It is just unacceptable.

author: bitbanger
author_rank: Regular Contributor
timestamp: December 03, 2018, 07:29:40 pm
content: Sorry, I searched briefly but missed the thread. Please direct responses to below!Quote from: tautech on December 03, 2018, 07:08:37 pm

author: tautech
author_rank: Super Contributor
timestamp: December 03, 2018, 07:52:59 pm
content: Quote from: bitbanger on December 03, 2018, 07:29:40 pmWhy bother, it's fake news.All manner of other equipment can be similarly compromised and those that have far greater computational capability than an entry level desktop DSO.The factory are already looking at this .............

author: Red Squirrel
author_rank: Super Contributor
timestamp: December 03, 2018, 09:35:04 pm
content: TBH I don't tend to worry too much about security for such items, should I? Upnp is disabled on my firewall, and anything that could pose a potential risk (like torrent machine) is on a separate vlan.

author: johnlsenchak
author_rank: Frequent Contributor
timestamp: December 04, 2018, 02:59:37 am
content: Digital Oscilloscope Comes with Backdoor Accounts, Old Software ComponentsBy Ionut IlascuDecember 3, 2018 10:33 AMSome digital oscilloscopes that can communicate over the network fail to provide a minimum of security protections and allow unfettered access to unauthorized users.Oscilloscopes are laboratory instruments that can measure how an electrical signal changes over time by showing a waveform representation. They are widely considered the center of an electronic lab bench since they are useful to any professional doing repairs on electronic gear. So tampering with the values it measures can do a lot of damage, especially in production environments.https://www.bleepingcomputer.com/news/security/digital-oscilloscope-comes-with-backdoor-accounts-old-software-components/Need Dave's opinion on this one !

author: tautech
author_rank: Super Contributor
timestamp: December 04, 2018, 03:24:46 am
content: Yawn, fake news.https://www.eevblog.com/forum/testgear/siglent-sds-1202x-e-network-security-issue/

author: BravoV
author_rank: Super Contributor
timestamp: December 04, 2018, 03:30:00 am
content: Scaremongering ...Kids these days, will try hard to hook up anything that has ethernet port or wifi enabled device to internet, just to have a social life.Yeah, aware the argument of ... "Hell, I can even check my latest social life update at my fridge ...my oscilloscopeshouldmust be able to do that too ..."

author: calin
author_rank: Regular Contributor
timestamp: December 04, 2018, 03:36:38 am
content: As a guy that work and makes his $ out of cryptography and security in general I can confirm that this is in line with the new wave o so called "security specialists" (/me rolling eyes here). The latest trend in this area is .. "O oo loook . .. there is an device that has an open network port !! I make quick a blog and new website about it and post it on as many sites I can to show how much of a smart a$$ I am !!" without even thinking. I am starting to get tired of these "specialists" which have no F$#^@#*& idea what programming is or what they do but they are "experts". God help us allNow I go in the garage to put my Owon scope online ...

author: johnlsenchak
author_rank: Frequent Contributor
timestamp: December 04, 2018, 04:40:08 am
content: No it's not fake news , the article is on bleepingcomputers.com

author: 0culus
author_rank: Super Contributor
timestamp: December 04, 2018, 04:48:09 am
content: I mean, freakin' Cisco does this all the time with actual networking hardware...so why should an oscilloscope from China be any better?As bitseeker said in that thread linked above: just because it has network connectivity doesn't mean it needs to have an internet connection. If security really matters you minimum have a private LAN (or at least a separate VLAN) for your lab that doesn't have internet access. Firewall in place with rules to prevent the equipment from talking outside the LAN, and allow only authorized inbound connections (from the LAN). If security REALLY matters for what you're doing, your lab ought to be inside a faraday cage and not have any connectivity to the internet.

author: tautech
author_rank: Super Contributor
timestamp: December 04, 2018, 06:24:59 am
content: Quote from: johnlsenchak on December 04, 2018, 04:40:08 amYeah right.So what in the world would they know about test equipment ? Shit all !So it's bash a Chinese product day is it ?Well before you do look closer to home:From the other thread I pointed you to:

author: nctnico
author_rank: Super Contributor
timestamp: December 04, 2018, 08:28:44 am
content: But that old Tektronix didn't need network access to work and didn't support Wifi. If you are making equipment which has functionalities relying on network access (like a remote web interface and Wifi support) then security becomes a lot more important because it is more likely a device is connected to a network. The author of the article raises a few good points on authorisation for example. Saying the article is fake news is sticking your head into the sand.

author: bugi
author_rank: Regular Contributor
timestamp: December 04, 2018, 09:34:16 am
content: All this below half-seriously, just pointing out some things...Quote from: 2N3055 on December 03, 2018, 09:58:58 amAnd yet again, the perhaps rare chance of going to do a job in a place where you're not the one with the power to decide how the scope will be connected (or perhaps using WLAN) is being ignored. (The previous longer text of mine already has more about this kind of case.)QuoteYou do not usually know beforehand who is malevolent. Sometimes you don't even know he got inside.With the scope stuff, he doesn't have to be inside the network; due to the scope he can gain the access to inside that private network (in some cases).QuoteFunny how my experiences have been different (granted, my experiences are from the software side, not networking, although we do touch networking things a bit, too). Oh, they do that risk analysis, design protection etc., but they also say to do as much as you can (within limits, no point in throwing 1M€ on security for a webshop that sells 10k€ a year). What I have meant is that even after network is layered, isolated, risks analyzed, you still also e.g. think about your authentication system, and turn off unnecessary services. If layering and isolation should be enough, _all_ the crap services could always be left running as is, right?... So, so wrong.A longer training session I had gave a nice example on that, though I don't remember the details any more. Everything else seen from outside was put "perfectly", but one seemingly "harmless" fault was left on one software the test system. The "perfect" setup was supposed to keep things safe. Yet that "harmless" fault was used to get one step in, which allowed another step, etc. until the attacker gained ability to run indirect shell commands with root privs, after which, of course, it was game over.That was the biggest "a-ha" for me back then. Nobody of the trainees in that training session had expected such big results; we had expected at most a partial data leak from only the service/software with that "harmless" fault.You just never know beforehand which particular small "harmless" issue/setting/fault/mistake becomes the way in, and often you don't even know about those issues/faults beforehand (unknown bugs in software). And that is why I say "do as much as can"; if one knows of something that can be easily be made safer, do so. Don't just assume everything else already done keeps you 100% safe.QuoteIf the "nobody cares about your ..." would be a valid argument for low risk in general (it can be in specific cases), I wouldn't need a firewall on my home systems. After all, nobody cares about me (in such malevolent sense), either. Yet this assumption can easily be proven wrong simply by looking at the traffic just outside that firewall. The attackers don't always know what is lucrative until they find it, and some damage gets done while they are searching for it.In many cases, the malevolent player does not care about you or what your (or anyone's) device is. As long as the device responds, launch a scanner on it; if one gains access, what OS does it run; can one install software and run at least at some performance... A device is good enough if nothing better can be found in that network. If for nothing more, then a platform to try and scan the rest of that network from inside to find that better target, or for a bit of help in DDOS'ing or whatnot. In such sense, even a smartwatch can be lucrative, as one step for the real target/goal.QuoteImho, the litany above is already starting to approach the "do as much as you can" and being paranoidI mean, doing only couple of those tasks should already be enough, if people behaved and software was without flaws. Because they don't behave and do have flaws, one has to do more, just in case. And it still isn't enough. But, one just tries to make the risks as small as possible, not zero.One thing I do agree, is about doing a risk analysis (even a layman one). For majority of home/hobby users, all this "fake news" is close to that, and it is mostly safe to use any scope in whatever way desired with one's own networks. (As long as one can.)P.S. Careful with the "fake news" term, it is being used in so wrong ways these days. Certain president uses it to claim that some pieces of (correct) news would be a lie (and by doing so has lost his remaining credibility in the eyes of most of the world). It should only be used for information/news which actually is a lie, or is so out of context that it becomes a lie. The articles linked so far, afaik, haven't told lies, but are exaggerating the risks by leaving most of the context out (i.e. how/where scopes are usually used).

author: photomankc
author_rank: Contributor
timestamp: December 04, 2018, 02:47:39 pm
content: The notice is not *completely* fake. There are legitimate concerns within it but the security community often takes the stance that any open operation is a 'flaw'. For instance in my mind, while an open telnet port that allows instant access to run CLI commands is a flaw, the fact that scope screen data is not encrypted is not. Nor is the fact that it may be operated by anyone with access. The latter are points to consider certainly, but they are not inappropriate to the use of the device. I don't need certificate-backed, role-based security on the front panel of my volt meter or my scope. I don't want it either.As the previous post alludes to there is nothing wrong in pointing these things out for people to take precautions they feel match the risk level, but classifying unencrypted scope trafic and unauthenticated access to the controls as a 'flaw' is over-the-top pile-on typical of those that revel in 'finding flaws'. The issues with telnet access are about all I would give them as flaws in the implementation. That's really the only reason much of the rest matters. Without local CLI who cares what kernel you are running?Security teams need to use common sense and help people properly manage the risk, not engage in outrageous "what-if-dinosaurs-attack" scenarios. Put these devices on a lab-only network or an isolated VLAN without access to the network at large or the internet and the risk drops to next to nothing. The device does not need to be a hardened fortress.As for fake-news, that's exactly what I would call demanding the vendor address the flaw of sending unencrypted scope screens, or the flaw of open access to the controls. Those are design choices that are completely reasonable for the product.

author: nctnico
author_rank: Super Contributor
timestamp: December 04, 2018, 03:10:54 pm
content: Quote from: photomankc on December 04, 2018, 02:47:39 pmI don't agree entirely. If a device has a lot of network connectivity some basic security should be in place. It is not beyond reasonable to think these scope can be used to mine crypto currency. Think about a school which has a couple of dozen of these scopes. If files can be transferred onto the oscilloscopes then someone can put a miner on the oscilloscopes. The scopes in itself are not fast but together they can do some hefty number crunching.

author: kerouanton
author_rank: Regular Contributor
timestamp: December 04, 2018, 03:19:41 pm
content: I'm doing Infosec ("cyber") as a job for 20 years, including CISO etc. Nevertheless I don't blame Siglent for their "bad" security.Such devices should and must be on a dedicated, separate LAN, which is what I did with a dedicated PC for the tools. Same issue in Hospitals or factories with their equipments, etc. Unfortunately most organisations don't have a security policy requiring to isolate those SCADA equipments from the main LAN and Internet, so they land in the main corporate network full of PCs (often not patched correctly) that have Internet access... no wonder why there are issues then.Use Vlans, dedicated switches and firewalls for any industrial equipment. Period.My setup is safe for my needs as I have a dedicated Ethernet switch to link my electronic lab devices, and its air-gapped. But I'm probably amongst the few ones.And... adding Wifi on such devices is imho a wrong move from a security standpoint, but marketing is pushing to have it.

author: Fungus
author_rank: Super Contributor
timestamp: December 04, 2018, 03:25:23 pm
content: Quote from: photomankc on December 04, 2018, 02:47:39 pmYep.The people posting here saying "Wellmyoscilloscope is safe" are missing the point: This is an oscilloscope with web interface, you can bet a lot of these are being connected up so that remote viewing is possible from "outside".

author: 2N3055
author_rank: Super Contributor
timestamp: December 04, 2018, 03:48:16 pm
content: Quote from: Fungus on December 04, 2018, 03:25:23 pmWhat do you mean from the outside? People access their network via VPN and connect to the scope?Or they export scope http port to public side of their Internet router, into the wild, in which case they are doing something really, really bad.And I'm being very polite here.

author: photomankc
author_rank: Contributor
timestamp: December 04, 2018, 03:49:10 pm
content: Quote from: nctnico on December 04, 2018, 03:10:54 pmThat's fine. We don't have to agree. As for the school, I just said, "don't do that". There is no reason the scope needs internet access, or indeed access to anything at all. The scopes can be on an isolated switch for physical access, an unrouted VLAN, or a separate WLAN for wireless. If they are not attached to a network routed to or with firewall access to the internet they are not mining anything. Sure, maybe a read-only vs full access password would be a nice thing, but that's really a feature, not a necessity to have a network port.I'd prefer the vendor spend the short device lifetime fixing operational issues and improving features, not implementing encryption and chasing linux kernels and hardware API's around.

author: calin
author_rank: Regular Contributor
timestamp: December 04, 2018, 03:55:14 pm
content: I am not saying is not good to have security on products that are designed for internet connectivity. I saw way too many screw ups with real networking devices like routers and switches. Yes there are always curious minds that want to browse porn on an oscilloscope but that-s pretty much what they are.Yes is not FAKE in the sense that is a lie, it is FAKE in the sense that nobody gives a rats a$$ about it. More of a NON NEWS per say. Test instruments are not designed or intended to be connected to a public network. <period>. I wonder what is next, do you want to bet that the same exact "team" that discovered this buys another cheap scope or test instrument and in a few weeks or months publish another "discovery" ? just watch for it, i saw "the experts" @ work first hand. Another thing to look for is who pays themI really wonder who will have their lab test network open to internet. Everywhere I worked in the last 20+ years I never saw a test instrument linked to Internet or for that matter even to the "corporate" network. Every lab i worked in had an internal TEST network, and not only because of security but because testing means breaking shit ... often. We have to think what is the use case and the reason for a LAN connection on a scope - it is called "instrumentation control" for a reason - designed to replace the clunky old GPIB interface. Like I said the sensationalism these days trumps the common sense. The only thing that these "security experts" will probably manage to fix/screw for us is being able to get into these devices and "tweak" them a bit.

author: photomankc
author_rank: Contributor
timestamp: December 04, 2018, 03:58:02 pm
content: Quote from: 2N3055 on December 04, 2018, 03:48:16 pmOh there is certainly someone out there that does just that. Humans being what they are it's inevitable. That person is also certainly not following any security feeds, news stories of the last two decades, or even really in possession of simple common sense. The rest of us can read this, and take sensible, reasonable precautions based on how it operates.

author: nctnico
author_rank: Super Contributor
timestamp: December 04, 2018, 04:02:50 pm
content: Quote from: photomankc on December 04, 2018, 03:49:10 pmWhat you are proposing is just unrealistic. Like other oscilloscopes the more recent Siglent oscilloscopes offer several features which are centered around having network/internet connectivity. Not allowing to use that is not a solution. Back in the old days with test equipment running Windows just because they needed an OS you didn't really need a network connecting to take full advantage of the piece of test equipment. With more modern test equipment that is no longer the case. You need to classify them a IoT devices and treat them as such.

author: Performa01
author_rank: Super Contributor
timestamp: December 04, 2018, 04:14:17 pm
content: Quote from: nctnico on December 04, 2018, 08:28:44 amThe article is about the SDS1202X-E.The SDS1202X-E certainly doesn't need network access to work and it doesn't support WiFi.It also doesn't have a webserver either.What the expert from SEC Consult demands (among other things) is LXI with authentication and encryption.Which other DSO has that?

author: photomankc
author_rank: Contributor
timestamp: December 04, 2018, 04:20:22 pm
content: What capability of the 1000X-E is centered around internet access? I have mine completely walled off from access to ANYTHING AT ALL and I am able to use all it's network features which only require me to reach it. It is not an IoT device. Nothing it does requires internet access. It is an instrument with a LAN interface to its operation. Since I'm doing it presently my suggestion is not completely impractical.

author: 2N3055
author_rank: Super Contributor
timestamp: December 04, 2018, 04:32:23 pm
content: Quote from: photomankc on December 04, 2018, 03:58:02 pmI agree. The fact is, you cannot be held responsible for muppets.I think oscilloscopes are very dangerous as cold weapons. You can bash somebody's head in with them, you even have a handle.We should consider them dangerous and demand a weapons carry permit for them.... Sheessh...Anything can be misused.What bothers me here is that somebody decided to single out Siglent like they are some bad guys. ALL the scopes are insecure devices.15000 USD Keysight MSOX3104t:Code:PORT STATE SERVICE VERSION21/tcp open ftp oftpd|_ftp-anon: ERROR: Script execution failed (use -d to debug)|_ftp-bounce: no banner23/tcp open telnet Pocket CMD telnetd80/tcp open http ChipPC Extreme httpd (WinCE 6.00)|_http-favicon: Unknown favicon MD5: 5415808C5657E45613A4D0A6BD75D0CD|_http-methods: No Allow or Public header in OPTIONS response (status code 501)|_http-title: MSO-X 3104T Oscilloscope111/tcp open rpcbind 2 (RPC #100000)| rpcinfo:| program version port/proto service| 395180 1 49154/tcp|_ 395183 1 49154/tcp443/tcp open tcpwrapped5850/tcp open unknown5900/tcp open vnc VNC (protocol 3.8)| vnc-info:| Protocol version: 3.8| Security types:| None (1)|_ WARNING: Server does not require authentication49154/tcp open rpcbind| rpcinfo:| program version port/proto service| 395180 1 49154/tcp|_ 395183 1 49154/tcpAnd login is also known. Also for all other scopes. Wintel ones even worse. So it's not fake news. But it is singling out one manufacturers and blowing things out of proportion.

author: bd139
author_rank: Super Contributor
timestamp: December 04, 2018, 04:34:17 pm
content: On network connectivity, it is fine. Internet connectivity is probably not hence why originally said the network should be non routable (no gateway!). Network connectivity should be on demand i.e. when the user requests that it is connected to the network.My first job was wiring bits of HP kit together with HP-IB and driving it from very old 16-bit Visual Basic. I can't think of a single analysis case that actually requires a non host-based private network from direct experience.

author: 2N3055
author_rank: Super Contributor
timestamp: December 04, 2018, 04:43:35 pm
content: Quote from: nctnico on December 04, 2018, 04:02:50 pmIOT devices are by definition connected to Internet in the wild and without Internet connection have no reason to exist..Scopes ARE NOT Internet, but LAN devices. Scopes are not IOT devices, nor they are supposed to be. If some people are misusing it that way, that is not scope's problem.You might as well take your central SQL database of the bank, connect it directly to public Internet and then bitch to manufacturer of SQL server about how their crappy database is not properly secure because people read your data.

author: tv84
author_rank: Super Contributor
timestamp: December 04, 2018, 04:44:14 pm
content: Quote from: 2N3055 on December 04, 2018, 04:32:23 pmI'll bet that they were trying to find some Options licenses but didn't succeed so they rerouted the thesis!

author: Performa01
author_rank: Super Contributor
timestamp: December 04, 2018, 04:51:27 pm
content: I've come across several people who misunderstood the SEC Consult report and think there is an open Telnet port that grants root access.What they actually say is this:QuoteApart from the fact that I'm wondering what an "intentionallywrite-only" file system might be - doesn't sound terribly useful to me - they criticize the fact that a user cannot change the passwords. Of course not, you cannot change a password that you don't know, even if it was not a "write-only" fileHas anyone managed to log into the root account of such a scope - with any of theofficialfirmwares, that is?Anyway, no matter what the answer is, most likely we'll now see something happen what usually happens in such cases: thanks to some lurid headlines, Siglent will be pushed to change a few little things and all the hackers out there will face some new challenges...

author: bd139
author_rank: Super Contributor
timestamp: December 04, 2018, 04:53:03 pm
content: Siglent will do fuck all. Same with Keysight.write-only. Signetics 25120Edit: my father had words of wisdom in this space: "Would you put your dick in the business end of a crocodile? No. Well why would you do anything else without bothering to understanding the consequences of it?".

author: tv84
author_rank: Super Contributor
timestamp: December 04, 2018, 04:56:30 pm
content: Quote from: Performa01 on December 04, 2018, 04:51:27 pm1. It's possible.2. Unless that is contrary to Siglent's marketing scheme.

author: Performa01
author_rank: Super Contributor
timestamp: December 04, 2018, 05:04:37 pm
content: Quote from: bd139 on December 04, 2018, 04:53:03 pmDarn! Now I have to start bitching too! The Signetics 25120 dates back to 1974! I haven't realized that Siglent fits such old and obsolete chips into their gear!At least it seems that WOMs (Write Only Memories) haven't been much of a success ever since.

author: photomankc
author_rank: Contributor
timestamp: December 04, 2018, 05:26:36 pm
content: Quote from: Performa01 on December 04, 2018, 05:04:37 pmWrite-only secures all the things!

author: BillB
author_rank: Unknown
timestamp: December 04, 2018, 05:50:42 pm
content: Quote from: 2N3055 on December 04, 2018, 04:32:23 pmWhen I first read that article, I wondered if the author's secret source was someone who works in Rigol's marketing dept.

author: glarsson
author_rank: Frequent Contributor
timestamp: December 04, 2018, 06:24:12 pm
content: Quote from: Performa01 on December 04, 2018, 05:04:37 pmThe software version, /dev/null, has been very popular in UNIX and copycats for many years.

author: nctnico
author_rank: Super Contributor
timestamp: December 04, 2018, 07:53:57 pm
content: Quote from: 2N3055 on December 04, 2018, 04:43:35 pmThat is old style thinking. In this day and age that is no longer true. People just drool over stuff they can control with their phones and manufacturers know that all too well so they add it to have an edge.

author: 2N3055
author_rank: Super Contributor
timestamp: December 04, 2018, 08:34:34 pm
content: Quote from: nctnico on December 04, 2018, 07:53:57 pmWhat does it has to do with oscilloscopes?No that is security industry thinking. I don't care for people that shoot themselves into the foot.Oscilloscope is perfectly secure device when used as a scope. Once you start using anything outside it's purpose envelope, you're on your own. Have fun. I know many people who exported their networks to Internet. Torrents didn't work so they just disabled firewall...Some of them got owned, some of them didn't even have problems... So Windows 7 was not secure enough when that guy caught trojan...Nope. He got owned because he's a muppet that is doing stuff he doesn't understand. One cheap Microtik router later, he's fine. And everything works.

author: nctnico
author_rank: Super Contributor
timestamp: December 04, 2018, 08:42:46 pm
content: Quote from: 2N3055 on December 04, 2018, 08:34:34 pmBut what is the purpose envelope exactly? If there was no use or desire for internet connectivity (web access) then it wouldn't be on there. Apparantly (unlike you) many other people do feel internet connectivity is useful to them. Which means the purpose envelope has shifted.

author: 2N3055
author_rank: Super Contributor
timestamp: December 04, 2018, 08:52:05 pm
content: Quote from: nctnico on December 04, 2018, 08:42:46 pmIT DOESN'T HAVE Internet connectivity. Siglent doesn't mention it anywhere, nor it is marketed that way.It has LAN remote control function, as a remote control and external screen function. On local network. Which is useful in educational environment, to attach big screen, or as a general remote control when you use it somewhere where operating scope directly is problematic.It is you who insists that networking exists only to connect Internet. It doesn't. Most of the networking in the world is done in LAN, isolated from Internet.

author: tautech
author_rank: Super Contributor
timestamp: December 04, 2018, 08:56:17 pm
content: Quote from: nctnico on December 04, 2018, 08:42:46 pmThere is no, repeat no internet capability for SDS1202X-E, zip, zero.LAN/LXI, yes for connection to EasyScopeX or a similar SCPI command panel interface which can also be accomplished with/via USB connection if internet connection paranoia becomes overwhelming.

author: nctnico
author_rank: Super Contributor
timestamp: December 04, 2018, 08:58:28 pm
content: It is not about this model or manufacturer but about modern oscilloscopes in general.

author: photomankc
author_rank: Contributor
timestamp: December 04, 2018, 09:04:14 pm
content: This will be my last reply. Modern scopes aren’t accessing the internet either and this thread is about the SIGLENT scope which has no use for internet access nor access to ANY other network resource at all. The remote operator connects to it. That is all.

author: hli
author_rank: Frequent Contributor
timestamp: December 04, 2018, 09:05:32 pm
content: Quote from: 2N3055 on December 04, 2018, 04:43:35 pmAnd you think that all LANs out there are not connected, somehow, to the Internet? Welcome to the real world. Even the separated test networks mentioned before were, quite sure, somehow connected to the regular corporate network and then to the Internet. It might not be a connection you know about, but just for management by corporate IT they usualy never have truly disconnected networks. (So far I have heard of exactly one instance of truly disconnected, by air-gap, public and internal networks - and they were just paranoid about their security).And even if the scope is not supposed to be connected to the internet - usually it needs just one device on its LAN to be connected to the outside world, and you have a problem. And when you connect a scope to a network, by definition you want to have other devices talk to it, ship its data around and so on. And its _always_ the weakest link that breaks. Thats where the concept "defense in depth" comes from - always assume the attacker has already broken in.From the description its not clear whether this attack allows to overwrite the firmware on the scope with a tampered one. But if its possible (and I deem this very likely), you cannot trust any of these scopes when it was ever connected to an untrusted network.

author: tautech
author_rank: Super Contributor
timestamp: December 04, 2018, 09:07:18 pm
content: Thank you Simon for merging threads.Quote from: nctnico on December 04, 2018, 08:58:28 pmThen a new test equipment internet security thread is appropriate so members with other brands can chime in with their experiences and checks.Those pieces of equipment running older windows version OS's might be considered higher risk and more lucrative hacking targets for their processing power unlike a tiny desktop DSO.

author: bd139
author_rank: Super Contributor
timestamp: December 04, 2018, 09:09:19 pm
content: The weakest link is the human factor always.If you develop a comprehensive threat model for an organisation this is trivial to mitigate compared to a million other things.We can whine about this wank but at the same time most orgs would be better to invest in 2FA and SSO across the board, device management policies for their phones and laptops, internal GPOs/policies and at the network border.But even with that, IT doesn’t even get a look in until you’ve done the threat model.A malicious employee, fake amazon driver or a plant pot wedged in a door can cause more destruction to a business than any of this. In fact one of the penetration testers walked into a company I worked in dressed in a yellow jacket claiming to be an Amazon driver, poked a USB stick in an unlocked workstation (rubber ducky) and job done.

author: hli
author_rank: Frequent Contributor
timestamp: December 04, 2018, 09:09:59 pm
content: Quote from: photomankc on December 04, 2018, 09:04:14 pmQuite obviously this scope (and other ones) have good use for network connection - their Ethernet port is there for a reason. And since it seems to run Linux (as do quite some other scopes), as soon as you can run your own code on it, _this code_ can access the network.Its not about the regular or intended use case. Such problems are about _whats possible_. You know, all the insecure IOT devices everybody ios screaming about also have no use case of accessing other network resources in your local network. But when they are broken into, they serve as happy jumping point into your network, just because they can.

author: photomankc
author_rank: Contributor
timestamp: December 04, 2018, 09:17:46 pm
content: Quote from: hli on December 04, 2018, 09:09:59 pm(Sigh) Alright once more then I swear I'm done with this circular argument...The scope does NOT REQUIRE ANY ACCESS TO ANY NETWORK RESOURCE to operate. You can connect to it and use it's LAN port in the total absence of any and all other services. Thus there is no reason to allow internet or wider LAN traffic to or from this device at all. It is not an IoT device. I have it on a VLAN where it has absolutely no access to anything else not even DNS. I can reach it, it can reach nothing. It's risk to my network is effectively zero. Zilch. It's network features operate flawlessly in this arrangement.Hopefully this clears up what I mean.

author: nctnico
author_rank: Super Contributor
timestamp: December 04, 2018, 09:25:42 pm
content: Quote from: hli on December 04, 2018, 09:09:59 pmExactly and since many scopes on today's market seem to run on the Xilinx Zync software platform these oscilloscopes are likely vulnerable to the same attack vectors.

author: rsjsouza
author_rank: Super Contributor
timestamp: December 04, 2018, 10:15:31 pm
content: Any Linux-based embedded system will be at mercy of such attacks, especially running a common C-A9 in a popular device such as Zynq. In this case, I echo what others have said about this brouhaha (from my post at the Tektronix facebook group):IMO if you are connecting your oscilloscope to the internet and not to a closed lab LAN, you should review your concepts of security. Even current versions such as this model receive updates at a much lower rate than a desktop/server OS. Also, the root accounts, telnet and serial ports are very helpful to service (and some use it to hack) the equipment. This is not an IoT thingie or cellphone.I will add that this is an equipment that targets the professional market (engineering or technician professionals) and in the vast majority of cases the surrounding network infrastructure will not be conducive to the same attack vectors as an average connected gadget. IMO no T&M manufacturer should break a sweat in closing this gap.

author: 2N3055
author_rank: Super Contributor
timestamp: December 04, 2018, 10:25:30 pm
content: Quote from: hli on December 04, 2018, 09:05:32 pmThat is exactly correct. Propper LAN isolation is pretty much equivalent to total isolation, to the extent of what an employee can perceive.Those not in trade confuse two concepts : attack from the internet to internal network, and malwared device creating havoc on internal network.You cannot attack internal network from the outside if firewalls are done right. You simply cannot establish connection. All you can attack are addresses and ports that are deliberately exported by owner of network.It works so well, that whole malware, social engineering and such branches were invented to trick users to pretty much install crap inside by themselves. And than, if that device has access to Internet proxy that will let it OUT of LAN, it can call home and do damage. Very often there a whole subnets that cannot go to Internet. Even if they want to. And if you fire up browser and try to connect to proxy and to Internet, admin will get warning and will come asking questions. Or system will automatically disable switch port you are connected to.Also, of course that YOU , the owner, can install crap to any computing device with network port and hack yourself. You don't need a scope for that, RPi, or old laptop are even better. For them you have ready made Kali distributions, and hack away.But wait, why would I HACK MYSELF? If you have employee that you suspect will sabotage you, you have a bigger problem.In organizations that are security sensitive, you would have to submit your device for security screening. You would be forbidden to make changes to network config, make firmware updates yourself without recertification and such... Those places buy equipment that support that kind of governance.There are many places where they simply forbid you to plug your scope into network. Or engineers voluntarily give up on that to avoid procedure nightmare.But those are formal government and subcontractors places.In a small company? Pay someone to install small firewall between your LAN and your ISP firewall. Create network segment that can go to Internet, and one that cannot. Don't surf crap, install script blockers, and don't open scam E-mails.If you need remote access implement proper VPN access, where you can connect to as few resources as needed.You'll be fine .

author: 2N3055
author_rank: Super Contributor
timestamp: December 04, 2018, 10:36:12 pm
content: Quote from: nctnico on December 04, 2018, 09:25:42 pmI agree. I will add, that ANY computing device with network interface is the same.ALL of them are dead duck if you have physical access to device.I will repeat. I can access anything and install anything on any of your devices if you let me touch it....That is why computer rooms are protected by armed guards, RFID cards, biometrics, keys, cameras.Most realistic attack vector nowadays, is to receive malevolent E-mail, that runs code on your workstation and installs itself for later...And when I'm inside your network, why would I faff around with your stupid scope when I have all those pretty computers that are so much nicer...Scope cannot be directly attacked from outside because there is no vector. It can be attacked from inside or in person. Not from Internet.If compromised, then it will make a great malware node.

author: ewaller
author_rank: Contributor
timestamp: December 06, 2018, 03:13:43 am
content: Hello,I had not intended this to be my first post, but the topic caught my eye and this seemed like a good place to jump in having just ordered an SDS 1204X-E. I am a EE who started life in automated test equipment out of college 30 years ago, and have been using Linux on my machines exclusively for a decade.I find a strange dichotomy here. Yes, this instrument seems to have violated several best practices when it comes to security. Having read many of of the threads related to this instrument on these forums, it is clear the unit can and has been rooted. The methods I have seen involve attacks on the password system by updating /etc/shadow. Okay, implementing this attack on your own system to which you have physical access provides root access through a now publically available password that is shared by everyone implementing this attack as documented in these forums. In what way does this improve the hardness of the device?Yes, hard coded passwords are a bad idea. Yes, the passwordhashis now publicly known -- but I have seen no evidence that the default password has been successfully brute forced. Replacing that with a well known, shared password seems like a poor choice. A mitigation to this would be to document a mechanism by which the password can be set by the owner of the instrument. I may look into this once I receive my instrument and have had the chance to play with it for a while. Even better, there may even be a way of implementing private/public key pairs to control access via TCP.But, consider this. Be careful what one wishes for. Had Siglent used ssh with certificates in the first place, the -er- entertaining threads on how to hack this instrument would have had no cracks in which to gain a toe-hold.

author: rf-loop
author_rank: Super Contributor
timestamp: December 06, 2018, 09:29:26 am
content: Quote from: ewaller on December 06, 2018, 03:13:43 amOf course after modifications are done everyone change this OSV_wellknown back to original genuine OSV, after then who ever can try brute force it for get door open.---------------------CommonIf one find somewhere in internet network Siglent scope what is publicly in network randomly seen in somewhere he can try brute force. My suspect is that only idiot want loose his life hours for it if he want do some xyz things. Many peoples understand that human have limited time for his life. How to use these hours - well perhaps some want loose them for trying find Siglent scopes connected to network and do some "good or bad" things using poor "security". Who want do some bad things do not give any burned wooden penny for get access to some Siglent scope. There is so much other things in network what give lot of more what attackers want.I have now SDS1104X-Emod connected continuously network. Try find it and after find it try do some what ever bad using this scope. I want give nice present who is first. Of course it is possible also to find other internet connected Siglent scopes around of world. Let's start finding them and do some attack (if there is any so stupid person who want loose his time for nothing.)But lets hysteria and paranoia (and Cisco and Apple gate) continue... many instances need it and are ready to even add it. What is feces for some is food for some others.I'm still waiting and scope is connected to global internet 24/7... how many minutes I need wait someone find it and do some bad things with it. I'm waiting to see someone send his email address to scope screen and I will contact and give this present. What is present is depending how good documents this person can give about all things how he did it. I'm still quite sure that this do not happen in my lifetime or scope lifetime.Yes I know peoples like Hollywood movies but this real life is still bit different.I have not seen yet anybody sent his email contact address to my scope screen... how long time I need wait.

author: ewaller
author_rank: Contributor
timestamp: December 06, 2018, 04:06:35 pm
content: Quote from: rf-loop on December 06, 2018, 09:29:26 amGood point. My thought process had not progressed that farIn truth though, I really am not planning on doing anything other than to explore how it works under the hood.