“White-hat” cyber security company, Tenable, last month discovered a potentially catastrophic flaw in PremiSys, an access control system run by IDenticard. The hardcoded credentials that Tenable found in the firm’s devices provide administrator access to the entire service through an end-point that controls the system. This means that anyone with those passwords would be able to modify the contents or even dump the entire badge system database, in addition to a variety of other processes, without obstacles. A malicious attacker discovering those passwords could disrupt building operation, block entry/exit for occupants, or allow physical access to unauthorized persons. Researchers at the Maryland-based Tenable found the username and password – “PremisysUsr” / “ID3nt1card” – hardcoded into the database configuration as a default. Tenable claim that the configuration file contains an encrypted form of the default password, and that the only way for customers to change their password is to request an encrypted version of their desired […]