Unique HMI password...

Found this HMI password inside a door.
Somebody thinks highly of themselves.:site:

for some engineers that would be a moderate statement.

If he was godlike... he would have used Upper Case, Lower Case, Numbers, and special characters....

NetNathan said:

If he was godlike... he would have used Upper Case, Lower Case, Numbers, and special characters....

Click to expand...

If he was godlike, he probably wouldn't need to write it down.

You bring up an interesting security topic, if off-handedly.

Why on earth would you put an operator level security login on a local HMI when all the HOA switches, four feet or so away, don't have any security?

I see this all the time. There's a big wave of security concerns going on right now. There was another one after 9/11. Fly by night companies are being formed out of nowhere to address the supposed problem.

Similarly, there was a wave of companies that would research your control system for Y2K problems back in 1999.

The goal of these efforts seem to be to make a report for the owner so he dots his i's and crosses his t's for insurance and regulatory compliance reasons. Rarely, a specific problem, is identifies or solved.

The companies that do this are generally (i am being generous) clueless when comes to ICS's

No one on our side complains much because there's often a scrap of work involved. Just a little scrap. We don't stand up for ourselves very much, myself included.

I am not against security, but what I see here in the US is a lot of second world infrastruture where security should be at a lower prioritity than more rugged installations and well written software.

There's only so much money to spend, and IMHO, it's being directed at the wrong task.

Good one.
I think im gonna start calling the user login "GodMode".

KirkC said:

You bring up an interesting security topic, if off-handedly.

Why on earth would you put an operator level security login on a local HMI when all the HOA switches, four feet or so away, don't have any security?

Click to expand...

Because the password protection on the HMI helps prevent the attack that comes in over the wire, assuming it is connected to a network.

I can't remember which MPS game it was but if there's one that blurt out "GOD LIKE" everytime if you kill a bunch of other players in a row.

GodMode is a great add on for Windows 10....google it..

harryting said:

I can't remember which MPS game it was but if there's one that blurt out "GOD LIKE" everytime if you kill a bunch of other players in a row.

Click to expand...

*dredges up misty memories of when free time was a thing* Unreal... Tournament? Something like that, iirc.

NetNathan said:

GodMode is a great add on for Windows 10....google it..

Click to expand...

All you have to do is create a folder and name it xxxx.{ED7BA470-8E54-465E-825C-99712043E01C} Include the period, dashes and brackets!

Most of the time xxxx is GodMode, but it can be anything or even nothing - just start with the "."

This is for Win7, Win8 & Win10. Not sure about ME or Vista. Definitely NOT XP.

If you put it on a flash drive it will open the GodMode control panel, but if you put it in an older (XP) computer it will be a regular folder there can be files in that are not accessible to the newer OS's.

plvlce said:

*dredges up misty memories of when free time was a thing* Unreal... Tournament? Something like that, iirc.

Click to expand...

I think that was after... a streak of 7 kills ?

3 Kill Streak, 5 Ultra Kill, 7 God Like.

User: God
Password: engineerlike

KirkC said:

Why on earth would you put an operator level security login on a local HMI when all the HOA switches, four feet or so away, don't have any security?

Click to expand...

They should be operated by key.
Apart from that, the fact that many operator panels can be operated remotely adds another risk, so it makes sense that there is another layer of safety.

shawn_75 said:

Because the password protection on the HMI helps prevent the attack that comes in over the wire, assuming it is connected to a network.

Click to expand...

If I have access to your network, the HMI password isn't going to do anything.

But as far as security goes I think places need to secure their buildings first and disconnect their process network from their business network (no internet to process network unless needed and remove when not needed, this is still a risk).

As far as the original post, anyone see the movie "Hackers"?

Lol, good find. Any idea how old the panel is?

Another possibility- the guy may have been a fan of industrial music. This song was oddly popular in the 90s in certain circles.https://youtu.be/ho_WeNKhgxk