Comment Re:playing the odds (Score 1) 68
I worked in the Physical Security world for 17 years (key cards, cameras, alarms, that stuff). Default passwords are generally a necessity, since you need to be able to set the equipment up the first time. If the manufacturer doesn't require it to be changed after initial config that's an issue, but even if they do require it there's almost never any requirement that the installers **NOT** change it back to the default and that's what will be done more frequently than not. The reason is for ease of service, there's no guarantee that the guy who installed it today will be the same one who services it when it breaks or needs maintenance next year. Not that I'm saying that this is good practice, just that it's common.
Even more common in systems that allow secondary user accounts to be created (not all do, even with security equipment, and many building management systems don't) is to create one login to be used across all customers of the installation/service company. I could have logged in with God-like permissions in any installation in North America that was set up and/or serviced by the second-largest security company in the US, because we had their service account information. My company originally did that, until I instituted custom logins for all our customers and stored them in a Keepass database on the network. Our salescritters used that as a selling point, frequently after demonstrating how we could log into our competitions' installs.
Never updating the system software is more common than not, no one wants to take their core systems down for an upgrade unless there is critical new functionality or reliability being added, and there's always the risk of a catastrophic failure. In 2012 I updated the Lenel system at our local Coast Guard base from NT4.0 on SQL 2000, and then it was only because the hard drive on the server was spitting out errors.
Check your company's background systems (building management systems, security, elevators, power management, etc.) you may be shocked at what you find. It's terrible to find your security system is your company's biggest security hole.