LifeSafety Power NetLink Vulnerabilities And Problematic Response
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for them need to be considered as well.
Indeed, Security researcher Bashis has discovered various vulnerabilities in LifeSafety Power NetLink devices.
IPVM spoke with both Bashis and executives at LifeSafety Power. Inside, we provide details on this vulnerability including:
- Vulnerabilities overviewed
- Devices affected
- Impact of vulnerability
- Why Life Safety Power failed to respond to multiple reports until IPVM intervened
- What Life Safety Power says they are doing now to improve their cybersecurity process
Related, see IPVM's Cybersecurity Vulnerability Directory
LifeSafety ***** ******* ************* ********
******* ******* *** **** **** ****** controls ******* ** ****** ******* *** control ****** ***** *** ******* ****** regarding ****** ** ******** *********.
Impact ** *************
********' ***** ** ******* ****** *****, *** ******** ** ****, **** several *************** ********* ************ ****** ** clear **** ***********, ** *** ******* from *** *** *****:
***** ******** ** ** *******, ***** are ****** *** **** ** ***** devices, ***** ******* *** ********* **** in ****** ******** ********** ***** ************ of **** *************** ***** ** **** significant.
Patch *** *************
***** **** ******** ******* *********** ******* ******** **** ***** ******* page. *** ***** ******* ******** ******* ******* on ***** *******, *** ********** *** ** ********** ****, *** ** **** ** ****** and ***** ******* ********.
Devices ********
*** ******* ******** ******* *** *** *** NL4 ******* ******** ******** *.**, *.***-** and *.***-***.
Poor ******** ** ******** *************
****** ****** **** ******* ******** ** contact *** ****** **** ******* *********. The ******** ***** ***** **** **** from ******** **** - ***** ****.
******** **, ****: ****** ******** ******** research **** **** **** *** ********, and **** ******* ** ******* *** with *** ******** ******** ***** ** no *****.
******** **, ****: **** ******* *** work ** *** ***** *** *** failed ** *******. **** *** **** few **** ****** ******** ** ******* LSP *******, ***** **** *******, ******* that **** ******* ** *** * phishing *******.
******** **, ****: ** * ***** effort ** ******* *** * ****** to ****** ***** ******** *** ******* before ********** *** ********, ****** ******* out ** ****. **** *** **** to *** ** ***** ********** ***** and ******* **** **** ******.
***** * ****: *** ******** *** released *** ******** ** ****** *** testing.
***** * ****: ****** ********* *** firmware *** *********.
*** ********* ****:
***** *********** ********** ***** *** * ******* **** came ** ******* * ************* *** found ** ******* *** ** ******** ** look **** * ******** ***** *** ** ****’* ***** **. **** *** our *******.
**** ** ****** ***** ** *** security ***** ** ******** (*** **** Honovich ****** ** *****) ** ***** addressing *** ****** **** ***.
Improvements ********** *******
*** **** *** **** **** ** more ******** ***** ******** ********:
***** ******* *** *** *** *** Executive **** **** ** ****** ** *** ************* ******* *********, ** ****** *** source.
**** ****** ********* ************ ** ***** software *********** *******:
*** ***** *** ********** ****** ******** development. ** **** ******** *** **** review **** * ***** ******** ****** and **** **** ** ********** ********** external ***** ***** *******.
Default ******** *******
*** ******** ******* **** **** ******* credentials ***** *** ********** ** ** changed **** * ***-** ******* *** are *** ******** ** ** *******. Due ** *** **** ********** **** Default ***********, **** **** ********* ** ****************** ** ******* ****.
Response ** ******* ******** *****
*** ********** ** ***** ********* ** default *********:
*** ******* ******** ** ******** ******** *** ******* setup *** ******* ** *** ****** (common ******** ** *** ********). ** ****** users ** ***** ****** ********, ** ***** a “***” ******** **** *** ******* ******** is NOT ****** *** ** ****** ** changed to * ******* ******** ******** ********** by *** ******** ** *** **********. *** warning ******* ******** ***** **** ** login ** **** ** *** ******** has *** **** ***** ********. **** a ******** ** ******* ** ** required ** **** * -** ********* with * *** ** *******, **** sensitive *******, *** ******* **********. ** **** conduct * ****** ***** *** ******** base *** *** ** ** ****** have *** ******* ******** ***** ***** to ***** ****** ******** *** ***** time **** *****. ********* ** *** survey *******, ** *** ****** *** firmware ** ***** ***** ** ****** the ******* ******** ***** ***** ***** login.
****: ** ******** ***** ** ***** 'commonly ********' ** ****, ************ ********* have ********** *** ******* ********, ******* users ** *** * ******** ** first ***.
Device ********* *****
*********** ********* ************* *** ** ****, ************ ***** a ****** ** ******* ** * cybersecurity **********, ******* ***** ******, *** using **** ****** **** ***** ** you **** **** ******* ** ******:
Reminder ** ******* *****
**** ** * **** ******** **** as **** ******* **** *** '******** of ******', *************, ***********, *** ***** need ** ** ******** ***** ************* vulnerabilities.
**** ****** **** *** ******* ** cyber-hygiene. ********* ***** ********* ********* ** *** switch ** ******** * ************'* ********. MAC *******/******** **********, ******** **********, ******** turned ***, ***** *********** *** *** help *******/******** ************, **** ** *** absence ** * ***.
***** ****** *** *** ****** ** LSP, **** ** * ******** **** probelm **** *** *-***** ****** *** out ** ***** ** ****** *** comes **** ** **** **** ** the **********.
* ***** **** ** *** ******** of *** **** ********* ** *** who **** ****** ***** ******** ***** (pardon *** ***) *** ********** ************ of *******. * **** **** ** turn **** *** **** **** * cyber ********** *** **** ******* *** else ****** ***** ** #* ******* when ********** ********.
* ******** *** ******** *** ***** now ** *** ******** *** ******* until ***** ** **** ***/*** ********** to ******* ***-****** **** ** ******* else ***** **** ************ ** ***** 3rd *****. * **** *** *** LSP **** *** ******* ******* ** I *** *** *** ******* *** and *** ** *** '"************" ** a ***** ****.
***** *** ** *** ******** *** NETLINK ***** ***** ** **** ***/*** Evaluation ** ******* ***-****** **** ** someone **** ***** **** ************ ** thier *** *****
*** ***** ** ****?
** ******** *** "************ *****" ** allows ** ** **** ** * non-technology ***** (********** **********) *** ***** able ** ****** *** *** ******* Solutions ** ******* ********** *** *********** across *** ********** (**** ***+ ********).
**** ***/*** *** **** ** ******** and **** **** *** ******* *** approves ** ** * "********* ******" then * *** *** **** ** the *** *** **** ********* ** all *** ********** *********.
** ** ***** (********* ************) ********** compliance ** *** **** ** *** game, ** ****** ********** ************ ******! If ** ** "** *******" **** it ******* ******* ***********, **** **** are *** **** ** **** ***** a ******/******** *** ** **** ***** devices.
**** ****** ** **** *** ******* to ************ *** ******* **** ***, its *** ***** *** **** ******** for **, *** **** ****** ** LSP *** **** ******** *** ******* FW ***** **** ************ ** ****.
********** ***** ***** **** ************** *** the ************* ***** ** *** ********** Bashis. ******* *** *** *** ******** third ***** *********** ******* **** ********** had ********** **** ******* ** ** greatly ***** **** ** ***.
***** ********** **** ******, * ******** patch *** **** *** ******** ** him *** ************ ** *********. ****** tested *** ********* ******* (**** ***********) and ** ******** *** *** ******** mid *****.
*** *** ***** *** ********** ** service *** ******** ** *** ********** which *** **** * *** ****** in *** ****** ***** ***** *** beginnings. ** ******* **** ***** ********** our ******** ** *** ***/*** ***** was ********, *********, *** ***** **** within *** *** ** ******** ************. Up ** **** *****, ***** *** been *** ***** ** *** ******** of * ******* **** *** ***/***. That ***** ****** *** ******* ** us, *** ** ******* **************, ** phone ****** *** ** *********** ******** affiliation *** *** ******* ** * manner **** *** *** ****** ********. There ** ** ****** ****** *** plant ** * ******* ********** ** VDOO *** ** **** ***** **** business ****, ** *** ******* **** that *******.
*** **** ******* ***** **** *** word “***************” (******), ****** *** ********** that ***** *** ******** ****** **** the ****** *** **** *** **** changes *** ******* ** “*************” (********). “Vulnerabilities” ** **********. *** ***** ** the *********** ******** ** *** * vulnerability *** *** ****** ** ******** request ** **** ****** ** *** NL ****** *** **-***** ***** *** configuration ******* *** **** ** **** multiple ******** ******* ***** ** *** unit ***** ** **** *** ****. This *** ** ******* ** ********* (or ****) ******* **.
**** ******** *** ******** ** * change ****** *** ** *** ********** involved ** ******** ********** **** **** this **** ** ***** ** ********** and * ****** **** **** ****** in ************* ******* ***** ********.
*** ********** ** ****** ***** *** foremost ** *** **** *** ** will ****** **** ******** ***** *** necessary ** ****** ** *** *** responsibility ** *** *********.
**** *******
** ** ***** *** *********
********** *****
** *********** ********** #*...
*** **** **** ** ****** ******* on ******* *** ******* ** **** comment **** *** ****"***** *** * ****** ****" ***** ****** *** ** *********. ** we **** * *********** ******* *'* not ***** ** * ***** **** to ********** **** *** ******* **, so ****** ******* **. ****** **** (770) ***-****.
* **** ****** **** ****.
*** **** ******* ***** **** *** word “***************” (******), ****** *** ********** that ***** *** ******** ****** **** the ******
***, ****'* ************* *** ***** ******** ***************(******), ** ************ *****:
** *** *** ** **** *** details ** **** ************* *** ****** of ***** *** ********* ********** *** there *** ******** ***************.
******* *** *** *** ******** ***** party *********** ******* **** ********** *** identified **** ******* ** ** ******* value **** ** ***.
** *** *** ******* *** *** include ****** **** ******, **** ** is ******** *** ***** **** **** vulnerabilities **** ****. ******** *** ******* tends ** ****** ***** ** ******* for ***** ******** *** ****** ****** like *** ********* ** **** ************.
** **** *** ******* ******** ****** code *******, **** *** ****** ******** ask *** * ****** (*** ******** these *************** **** **** ** ****, but * ****** **** ****** **** found ** ***** **** ** *** basics.
***** ********' *** *** ******* **** many ***** ***** **** *********** ***************...
*’* ***** **** *** **** **** bashis ** *** ******* ***** ******** as * *********** **** **** ** cameras *** **** ******** ********.
** ****** *******, *’* ** *****.
*****, * (************* *********) ********** -- great **** ** ****** *** ******* this *************. * **** ** **** I *** **** * ***** *** that *** ************* ** *** ***** hygiene ** *** ******** ******** ******** the ****** **** ** **** ********.
**** **** ****, ***** **'* ************ that **** * ************* ******* ** the *** ******* ** *** ***** place, ** * ** ************* ** correctly **** *** ******** ******** ***** this ************* *** ********** *** *.* and *.**, **** ** ******* ******* example ** *** ***********/********* ********** **** cyber ******* ** *** ***** ***** would ******** **** ************* ** *** first *****. **** ******** ******* *****, it ***** **** *.** *** ******** in ******* ** ****, *** *** last *.* ******** *** ** ******** of ****. * **** **** *** of **** **** ******** ** *.** last *****.
***** ************ ** *********, *** ************ a ********* ***** ** *** ******** revisions *** *** *******-********* ******* ****** be * **** ******* *********** ***** days. **** **** ****** ** ** it **** *****, *** ****** ***** an **********-***** ******* ****** ** **** to ** ********* ******* *** *****.
***** -- ***** ** *** ******** for ******* *** *************, *** ** LSP *** (**********) ****** **.
** * ********, *** ***** *** say **** *** ** ************, *** literally **** ** ******* *** ***** number ** **** **** ****** *** luck. ****'** *** ** *** *** manufacturers *'** ***** **** **** ******** respond ******* ****** ***** **** * ever ******* ****.
* ***** *** **** *** ************* to *** ***** ******* ** *** security ******** ******** *** ****** **** of **** ********.
****** ************* *** **** *********** **** the ****** ******** ********. **'* ********** vulnerabilities ******,*****,*********,*******,***, ** **** **** * ***, that *** **** *** ******** *** more ***** ** ***** *****.
** *** *** **************, *** **** that **** ****** ** ***** **** 'bahis' *** ******** ** * **** demonstration ** *** ********* ** ************* issues ** **** ******** *** ****, more *************, ***** ******* ******** '******'***** ***** *** ******** ********* ********** to *** ****.
****, ******* ****** *** ********* ** what ******** ****** **** ** ***** out ** ****, * ***** ******** it ** *** **** ***** ********* that ****** *** ******* *** ********* intercepted ** ** ***** ******** ** that ** *** **** ** * low-level ******** ******* ****** *** *********, either ******* **** *** ** **** what ** *** ****** ** ******* they **** **** ** *** **********. Again, *** *** ****** ** *** world ** ****** ****, *** * don't ***** **'* ********** ** ****** to *** **** ******'* ******* ******* can ********* **** ****** ** *********** from ****** ** *** ******* **** ** Nigeria ** ********* *******...** ********** ********, *** I'm **** ******...
****** ***, ** ***** ** **** I ***** **** **** **** ******* doesn't ******* *** ** ** ****** negative ***** ** "************" ** *** caring ***** ***** ******. ** ********** -- *** ********* *** ********** ** others -- ** ******* *** ******** in **** *******, *** ****'* ******* evidenced ** *** ********** ***** *** that **** ******** **** **** ******** it *** *****.
** **** ** *** **** ** a ***-***** ******** ******* ****** *** discarded
****'* * **** *******. **** ***** they **** *** ***** *** ***** vulnerabilities *** ** ***** **** ****** put *** **** *****. ***** ** them ** **** *** *** **** who ****** ** *** *** *** think ***** ******** ***, ***** ***** have ****** *** ******* ********* **** it ****** ** ** ******** *******.
* ***'* ****** ***, * ***'* know **** *******, ** * ** not ****** **** *** **** ** bad *********, **** **** ***** *********** for *** ********** ** *** ************* email(s) **** *** **** **** ***** to **.
*) ***** ****** *** ********* **** sensitive (****** *******).
*) ** ** ********** **** ****** ** ************ ** * *********** ******(*** ****** ***** *****) *** ****(** ***** ****** ************).
*) **********, *** ********** ******* *** intended ** *** ***** **** ********* of *** ******, ***** ** *** own *****.
*) **** ** **** ***’* ******* it, ***** ******* *** ***** ********* to ***** ***** ** ******.
*) ********* *** ** *** ************ ***** ****** ********* ********** ** the ****** **********, ** ** ************** feels ******** *********** ***** **** *** thought ** *** ********* *********** ****-**.
********* *** *** ** *** ********** ****** ****** ** ********** ** **** ** favor ** *** ***************, ** ***** *****.
*** *** *** *** ** *** track, *** ** ******* *** * bit **** **** ********* ***
*****://***.********.***/****-******?*******=******
*** * * *****, ** **** is ******* "******" *** *** "******", however *'* *** ** ********* ***** that ;)
*********: ****** ** **** **** *** do *** * ****** ** ** this * *****? *'* *** ******* how **** **** ********* ** *** I ***. *** *** ***** ********** work *** * **** ***** ** some ****** ** **** *** ***.
** * *** *** ** ******* an *** *** * ****** **** will ** ***** ** ***** ** of *****, *** * **** ** verify **** **** **** ******** ***** the *******. ** **** *****.
* ***** ********* *** ** **** up-to **** **** ****** **, **** you “******” ** **.
*********** ******** ********* ** * *********** anyway. ** *** ***'* **** ** verify **'* *** ****** *******, *** you ****** **** ******* **** ******** the *******...
* ********** **** *** *** **** sold ** **** *****. ** *** think **** *** **** ** ****** the ******** **** ********?
***** ***, *** *** **** ** the ****:**** ******** ********** *****.
** ** ********* ** ** ******** whether *** *** ***** ** ***** LSP ****** *********, *** ** ** worth ******** *** **** **** **** week ****** * '***** ******** *******' ************* **** *** ** ******.
*** ****** ********* *** ************** ** cybersecurity ** * ********** ***** ** people ****** **** ** ****** ** result ** * *********** ***** ****** brands, ****** **** ********** ** ******** and ******** ****** * ***** ******* like ********** ***** *****.
*** *** * **** *** "***** Security ****** (*******)" **** ** **** Long *****. ***** ** *** * bad *****, ******* *** ***** ***** "we **** *****" ********* ***** ;-)
"****** ****** **** ******* ******** ** contact *** ****** **** ******* *********. The ******** ***** ***** **** **** from ******** **** - ***** ****."
******, **** *** **** ********* ** communicate ****. ************** **** **** ******* are ****** ***-********, **** **** ***** returned ***** ** ****** **** *** question... *** **** **** *** ****, understaffed ** **** ***** ********?
**** *** ******* ** ***** *********, but *** ** ***** ***-**************, *** only ****** **, "****"!