Airport Scanners Have Account Backdoors, Default Passwords
How many people listened to the Black Hat talk about the backdoor accounts present in scanners used by many airports in the United States and thought, "How am I going to fly back home after this?" I know I did.
Many of the machines deployed at airport security checkpoints have embedded accounts with default passwords that can be abused, Billy Rios, director of threat intelligence at Qualys, told attendees at the Black Hat conference on Wednesday. In this case, the concern is that attackers may be able to use the accounts as a backdoor to get access to the system.
The embedded accounts on the scanners weren't added as malicious backdoors. Manufacturers like to create embedded accounts with hardcoded passwords for maintenance and support purposes. While convenient, these accounts pose problems when administrators don't even know these accounts exist, and can't even change the passwords to something else.
