I'm staring up into the wheel wells of a Chevy Silverado pickup truck. I'm trying to explain to the driver that what I'm doing with my laptop and a bunch of antennas is perfectly normal and he should leave me be.

One week earlier:

I'm working at a cybersecurity consulting firm during the COVID-19 pandemic. A colleague has sold an engagement that requires three consultants to actually go on premises at a client site for two or three days. They really, really want me onsite.

I don't like flying under normal conditions, so I tell my colleague that it's perfectly sane to drive twelve hundred miles each way instead of fly.

I love road trips, and it's perfect early Fall weather for a convertible. I let my direct manager know that my response times will be a bit longer. I'm working on a few other client projects right now, so I plan to do research and writing in the evenings.

This is going to be fun, I think. I tell everyone else in my practice group to not let it get out that I'm doing this road trip. My boss might be cool with it, but the execs will hate that I'm not taking PTO for the trip.

Three days before I'm supposed to leave, I get an urgent email from a private equity client. They've hired us to do technical due diligence in the past. They're usually fun, fast paced projects and we bill aggressively on them. The PE client is considering investing in CopperBolt, a company that makes devices and software for schools, public libraries and other similar institutions. It's a neat package- all a high school's IT needs in a two unit rack mount device. It offers a web server, content filter, file storage,grading, learning management,support for surveillance cameras and more. CopperBolt can remotely support users over an Internet connection, so there’s no need for local IT staff.

The PE firm wants us to see if there are any serious problems with the CopperBolt box and software. We get two of the devices overnighted to us.

One goes right to Oscar, a young penetration tester. The other ends up on the conference room I’ve taken over. We’re the only two people in the building this week. Just to get some familiarity with it, I set it up. It's pretty slick. For Windows users, there's a setup wizard. For everything else, the CopperBolt box has an admin web page.

I connect it to a simple wired network consisting of my laptop and a home router. It lets me create an admin user, so I create 'admin/nimda' and go from there. It seems to work fine and I've got too many other things to do today. I'll let Oscar take a more rigorous approach to it. The rest of my day is a bunch of meetings.

One of my firm's other clients is in the automotive space. I'm listening in on their call like an Alexa, waiting for my name. They're building some kind of autonomous driving device that can be retrofitted to buses and trucks. An interesting slide comes up, listing all the wireless interfaces this thing has.

Two of them are new to me.

The client doesn't think this is a problem because trucks and buses, you know, move. It's not possible to hack something that's moving at speed. None of their simpler devices have been attacked and there are thousands in the field.

Now I want to learn more.

On a previous engagement, I built a wireless survey device. Essentially, it's a three year old laptop connected to a bunch of wifi and bluetooth cards, held together with lots of monoprice cables, velcro and zip ties. This junior high science fair project worked well enough to grab WPA handshakes and convince a client to offer a guest network and go WPA-Enterprise for everything else. It's been stowed behind a filing cabinet since then.

I dust it off and start connecting cheap software defined radios to see if I can get all the frequencies of those truck/bus devices. Perhaps I can sniff some traffic on my road trip and learn something.

While reconnecting and testing this science project, I notice something. There's an open wireless network called "CopperBolt-2BB048" that I hadn't noticed before. I can associate with the network and go to the admin page. Its the same admin page as I saw on 'my' CopperBolt box. I'm guessing Oscar hasn't configured his yet, so I create a new root/toor user as a joke.

I make my way over to Oscar's cubicle. The months-out-of-date calendars and dead office plants are a nice nod to the zombie theme. All we need is the flickering light to complete the scene.

Oscar has headphones on and is clearly working on a deliverable. I'm not going to disrupt his flow.

'His' CopperBolt box is on his desk, powered down.

Well, I'm not as clever as I think. I hacked my own device.

I spend a minute or two just staring into space, trying to remember how I set up the CopperBolt box. I don't remember a checkbox that read "leave gaping hole in your security". I think I'd have unchecked it.

Oscar has taken off his headphones to toss a foam vendor shwag thing at me.

I ask Oscar to set his one up now. In exchange for this, I'll finish his deliverable.

I'm finishing up the executive summary and starting to make sure that all the parts line up- every vulnerability has to have a corresponding recommendation. I just don't want to have a stupid recommendation like fixing an unpatched, end-of-life system with "use single sign-on".

Oscar yells to me. He's done setting up his CopperBolt device. It's connected to our network wirelessly, but doesn't let me create new users without authorization.

After an hour of factory resets, we finally figure it out. Oscar's been using the Windows wizard. I'm using the web admin instead. We've found a border condition. At first boot, the device offers an open network and an IP address. The wizard turns WiFi off if it's not configured, and disables the setup script. The web admin page leaves WiFi on if it's not configured, and leaves the setup script and page when you connect wirelessly.

Oscar:"I'm looking at the setup script. I can fix this in twenty lines of code"

me:"No. The specifics aren't relevant to this. The cost to fix this and the brand damage from a breach are a price offset for the buyers. We aren't paid to fix the problem. we're paid to identify problems to fix and maybe get paid to fix them.

me:"And thanks. I'll let the client know that there's an issue"

I try to write this up into two lines, since that's all a VC wants to see during the last few days of an acquisition. I realize that the largest risk is the already deployed devices, since CopperBolt patching requires the admin to manually download and install the patch.

I spend around twenty minutes trying to write two sentences that convey the risk and impact. I then realize it’s not definite enough to be useful, since it’s theoretical. I need to show that in-field devices are vulnerable.

Now I just need to find some.

I also need to pack for my trip and do some last minute maintenance on the car. I don’t want to break down somewhere in-between here and Kansas.

I’m packing a varied wardrobe so I can at least blend in a bit. Mask of sanity and all that. And it hits me. There’s probably some unique term in the admin page. There are probably some locations that just gave this box a public IP. Google indexed it, I’m sure. I try some searches and between some odd ads, I find a handful of locations. I soon have a cross country map with a handful of CopperBolt T 1020s and the institutions they live in.

I’m going on a road trip. I think I can bill the mileage.

To be continued.