IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall

Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week’s sad story involves a major American pharmacy chain that couldn’t fill a prescription for password security. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com . Anonymity is available upon request. Our tale comes courtesy of red team and pen testing specialist Dahvid Schloss, who currently serves as COO of Suzu Labs , a cybersecurity company that boasts “we break your systems before adversaries do.” Over a career spanning more than 15 years, Schloss has assessed the security of numerous businesses, including a large US pharmacy retailer that he asked us not to name. He wasn’t asked to break in, just to do an audit on all of the org’s corporate switches, routers, and firewalls. “So, I come across this firewall,” Schloss said. “That is an edge firewall, meaning this is what touches the internet. This part will add its enable password, which is the term Cisco uses for administrator. It had the enable password as 'password.' Just p-a-s-s-w-o-r-d.” As Schloss noted, the enable command on Cisco devices allows the user to gain administrative rights to the firewall, controlling network traffic. If someone connected to that firewall, either via SSH or through an exploit, and got normal user privileges, they could then elevate those privileges to admin and do something like shut off all traffic from the intranet to the outside world. Schloss actually didn’t guess that the password was “password,” but instead was able to decrypt the file holding the passwords by breaking Cisco’s own protection, something he said is easy to do. “That enable password was stored as Cisco IOS type 7, which isn’t really a hash,” he said. “It’s more of a reversible encoding with a publicly known key. Even back then, it was best practice not to use it.” But even if the password were stored in a secure place, it would be very easy for a threat actor to guess. So he marked the password failure down as a “high find,” a bad type of vuln that needs to be fixed right away. When he brought the password to the company’s auditing department, they put him on a phone call with the auditing team, the entire IT team, his own manager, and others. On the packed call, the auditing team, who had commissioned Schloss’s work, was very concerned about the firewall password, but the IT team didn’t think it was a very …