CIA urges ‘secure by design’ elimination of factory-default passwords

CISA says default passwords like “1111” need at least a few more special characters.

In an advisory issued December 15, the agency offered “secure by design” recommendations for tech manufacturers, especially those making programmable logic controllers (PLCs)—devices that cyber attackers have targeted to compromise waste and water-system facilities.

CISA’s main plea for technology developers: “eliminate default passwords in the design, release, and update of all products.”

Threat actors, “including Islamic Revolutionary Guard Corps (IRGC)-affiliated actors,” have compromised critical US infrastructure systems by targeting operational technology (OT) products, which frequently have “passwords set to a static default,” CISA warned.

For technology manufacturers, CISA recommended:

• Passwords unique to each instance
• Time-limited, self-disabling passwords that require activation of more secure authentication after initial setup.
• Physical-access requirements for the beginning of implementation

Factory-default passwords can be found on publicly available online lists and product documentation.

In a study released in October, NSA and CISA incident-response teams identified “default configurations of software and applications” as the top-most “common network misconfigurations.”

This isn’t the first time CISA has warned about hardcoded default credentials. “Change default passwords as soon as possible and absolutely before deploying the system on an untrusted network such as the internet,” the agency advised in 2016.

A more recent urging in December announced that the Iran-affiliated “CyberAv3ngers” group is actively targeting and compromising Israeli-made Unitronics Vision Series PLCs “that are publicly exposed to the internet, through the use of default passwords.” The “CyberAv3ngers” have targeted US water systems.

“The use of widely known default passwords is unacceptable given the current threat environment,” CISA’s most recent advisory said.