Unnamed pharmacy chain used 'password' on a Cisco edge firewall
Original title: IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall
The enable secret was Cisco IOS type 7, a reversible encoding with a publicly known key.
The Register's PWNED column recounts an audit by Dahvid Schloss, now COO of Suzu Labs, at an unnamed large US pharmacy retailer. An internet-edge Cisco firewall used the enable password "password," stored as Cisco IOS type 7. Auditors wanted it fixed immediately while IT called it less severe, and the call ran more than an hour. Schloss says high findings would cancel IT bonuses, and the client asked about the finding for three years.
Unconfirmed: The pharmacy chain is unnamed, and the account is Schloss's recollection of a past audit.
- Schloss was auditing corporate switches, routers, and firewalls, not breaking in.
- The enable password grants administrative control of the firewall.
- He decrypted the stored secret rather than guessing it.
- The client kept requesting explanations for three years after he left the project.
Impact: Administrative control of an internet-edge firewall if the weak enable password is used
| Product | Affected |
|---|---|
| Cisco firewall | — |
- Vendors
- Cisco
- Products
- Cisco IOS
- Organizations
- Suzu Labs
- Countries
- United States
From the original article
3 min read at theregister.comWelcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week’s sad story involves a major American pharmacy chain that couldn’t fill a prescription for password security. Have a story about someone leaving a gaping hole in their network?
By Avram Piltch · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.