Vulnerabilities: Microsoft car parks unprotected on the Internet

It is not the first parking garage that Tim Philipp Schäfers looks into on his computer. The Golem.de author and founder of Internetwache.org discovered a few years ago that some companies use the control software for their parking garage do not secure sufficiently, In November he came across another such case: he has a parking space overview in front of him – and next to it the Microsoft logo! Schäfers quickly realizes that he can access the parking garage management at Microsoft’s headquarters in Redmond, USA. Without protection, over an unencrypted connection.

Schäfers is shown a map of the Microsoft site in Redmond on the web interface. There are several parking garages with a total of 3,952 parking spaces. He can click from parking garage to parking garage and from parking deck to parking deck. The system uses sensors to determine whether a parking space is free or occupied, Schäfers can see this on his computer.

With thousands of sensors, however, there are always problems or errors, for example if a sensor breaks. These errors are displayed in an alarm list that Schäfers can not only see but also acknowledge. This means that administrators may no longer see them. He can also check which parking spaces have been reserved and when which parking space was used. In contrast to other installations of the parking garage software, Microsoft does not display license plates or other personal data of the parking garage users and Microsoft employees.

Screenshot of the parking garage control from Microsoft (screenshot: Golem.de)

The software can also add notes to specific parking spaces. Schäfers can also create these with his guest access. He can also set the time period for the note. It is unclear whether it will reappear elsewhere.

DDoS could shut down parking garage?

The software offers many other functions that can be used to control the parking garage – right down to the parking garage lighting or the barriers. There is also an event plan that can be used to start certain actions, such as blocking the ticket button. However, these functions usually require authentication with a user name and password.

The password could be found out via a brute force attack, i.e. trying out access data in bulk. The software manufacturer’s standard passwords could also be tried. In addition, the parking garage management could be overwhelmed with inquiries (DDoS attack) and, in the worst case, the entire parking garage could be paralyzed. That poses a massive security problem.

Open parking garage, open ports

Not only the car park control is open, the RDP and SMB ports are also accessible via the Internet. The Remote Desktop Protocol (RDP) is used for remote maintenance of Windows computers, while the Server Message Block (SMB) protocol provides file and printer services and is designed for local networks. Microsoft itself advises not to make the services available on the Internet. In RDP were also in the course of last year serious security holes found, however, the vulnerabilities have been patched on Microsoft’s parking garage server.

Version 1 of SMB is still running on the server Microsoft in a blog entry advises very clearly: “Stop using it!” is not just the heading, the sentence is repeated three times in the first few sentences. The blog entry lists a full list of security issues in SMB 1. The blog entry was published for the first time in 2016, including that US Cert warned in 2017 well before using SMB 1.

Microsoft told Golem.de after several notices that the Azure server was operated by a third party. The company had previously stated that it would take care of the problems – but it did not work out entirely.

–