Snippet 26: Zigbee Network Demonstration

Devices often arrive from the manufacturer radio-ready, with wireless interfaces the buyer never asked for and may not know exist. Using real examples, including Dell EMC servers that ship with a Bluetooth telemetry interface, a data center Zigbee chiller beaconing with default credentials, and an easily cracked Bluetooth 3 laptop connected to the rest of the data center, this clip shows why facilities need continuous visibility into unmanaged and unknown devices.

Key Takeaways

• Equipment frequently ships radio-ready, with wireless interfaces enabled that the customer never requested
• Dell EMC servers include a Bluetooth telemetry interface by default, a capability many operators would not knowingly allow in a data hall
• Real-world finds include a Zigbee chiller beaconing with default credentials and a crackable Bluetooth 3 laptop connected to the data center
• Continuous RF monitoring is how unmanaged devices like these get found before someone exploits them

Video Transcript

Unmanaged and Unknown Devices in your Facility. Back to the story about the new CISO in charge of all these manufacturing facilities. We see this radio-ready problem, where devices are delivered to customers from manufacturers. Even if the customer intends to use Wi-Fi or ethernet connections, for instance, the device may also support other connections that the customer didn't ask for. And maybe the customer is not even aware that they're there, and moreover, they're not aware that they're using default username credentials.

One that struck me recently is that Dell EMC has exactly this story for their servers. If you buy a server today, there's a Bluetooth interface that's made to interact with the Dell phone app to give you telemetry about your servers. So now, even if you didn't want your server to have a Bluetooth interface that was so easy to use, and there's backhauling telemetry, you're getting it for free.

And so that you may consider that as something you don't want your space, in which case you need to monitor that to make sure these things aren't deployed to you. We've seen that out in the wild. Here's an example of a data center where there was a Zigbee chiller that was beaconing out to false credentials. And we also saw a Bluetooth laptop that had Bluetooth 3, and could easily be cracked, and somebody getting that laptop, and that laptop was connected to the rest of the data center. So you get some pretty ready access there.