If you read your own post you would realize that Mitsubishi=20
kept the device ipaddress prefix as 192.168.1 so only you can attack
yourself.

192.168 cannot be access from the internet ;-) [unless you NAT at which
point its your NAT config problem]
=20

-----Original Message-----
From: Chris Withers [mailto:chris@simplistix.co.uk]=20
Sent: Friday, March 21, 2008 9:50 PM
To: bugtraq@securityfocus.com
Subject: hacking the mitsubishi GB-50A

Hi All,

Well, it's been over 4 months since my plea for a security contact at=20
Mitsubishi Electric to come forward. Since no one has, I thought I'd=20
release a POC for hacking one.

It's not exactly hard, the web controller uses a nasty set of Java=20
applets to interact with itself. The shocking thing is that these=20
communicate using a series of xml packets and absolutely zero=20
authentication or encryption :-(

Oh, and just in case you thought about maybe putting something secure=20
like an ssl webserver proxying the thing, these java applets are hard=20
coded to connect back to port 80 on the originating host using HTTP :-(

Still, you should get an idea of how the box is *supposed* to be used by

the fact that its ip address is set with dip switches where the=20
192.168.1 bit is hard coded!

*sigh*

Well, please find attached a little python script that will let you turn

on or off every aircon unit attached to a GB-50 that you know the ip=20
address of. Minor modifications will let you change the set point and=20
mode too, so you might be able to turn off a data centres aircon *or*=20
turn an office's aircon up to 28'C and then turn it all on ;-)

The plus side is that because it's so rediculously insecure, it's not=20
that hard to build a secure web app that can interact with it and then=20
just firewall it off from anywhere harmful...

If you have a GB-50 or a GB-50A, please make very sure you keep it on=20
its own private network until Mitsubishi Electric find a clue stick to=20
hit themselves with!

cheers,

Chris

--=20
Simplistix - Content Management, Zope & Python Consulting
- http://www.simplistix.co.uk