9 ms·
• 29% of all devices tested had at least one default username and password stored in the firmware, enabling access to the device if administrators don’t change
by Kenji 7y ago
• 29% of all devices tested had at least one default username and password stored in the firmware, enabling access to the device if administrators don’t change these credentials.
• We identified 76 instances of firmware where the device was, by default, configured such that a root user with a hard-coded password could log in over the SSH protocol, providing for default backdoor access.
• 8 different firmware images were found to have pre-computed authorized_keys hard coded into the firmware, enabling backdoor access to the holder of the private key.
• 424 different firmware images contained hardcoded private SSH keys, which can enable a man-in-the-middle to manipulate and/or decrypt traffic going to the device.
What a witch hunt... This is state of the art in the industry. Everybody does it like that. No intelligence agency has to be involved at all, it's basic negligence. If you're behind a NAT, your device is unlikely to be attacked via these vectors.
- WordyMcWordface 7y agoExactly, every vendor has default passwords. If you are doing things right all default credentials are changed or disabled. Access to any service is firewalled off or better yet only accessible out of band on a dedicated management network.
- djsumdog 7y agoThis is changing. I've seen a number of ISPs no longer have default passwords. Each router or modem has a random password string set to the device, it's printed out and pasted as a sticker on the modem (or some print directly to the plastic). A lot of big name devices do this now too. Sure it's a password written on the device, but it's random, you need physical access to see it, and people who are security conscious can change it. This bad practice isn't excusable, especially not by a company as big as Huawai, not if they want to be taken seriously.
- elmo2you 7y agoIt's definitely a good development that ISPs have started to deploy routers and modems with randomized passwords. However, please do keep in mind the deployment of consumer equipment and enterprise hardware is different. Or at least it should be, in theory. Enterprise equipment is usually not supposed to be just dropped into place, without oversight. It usually needs proper configuration/management, by qualified people. Whether this also happens in practice can be a different story altogether. Still, the security of enterprise equipment usually involves more policy and procedure than it does with consumer equipment. With the latter, security has to come more or less by default, because the people handling the devices usually have little expert knowledge.
- SuperNinjaCat 7y agoFrom what I have seen where I live, printed passwords on things like home routers and VDSL/Fiber modems provided by major ISP's are for 802.11 stuff (WiFi passwords) and not for the devices management interface. This may have changed since I last looked into it a few years ago though. There was also the whole Netgear router "backdoor" port thingy (a device shipped by a major ISP) which I actually had to exploit to recover my password after forgetting it once, which was kind of amusing.
- bifrost 7y agoJuniper doesn't. There is no password on the device when you power it on. When you get a new device, in order to save your initial configuration on it, you have to set a password. Cisco used to ship with zero config on their devices and part of the setup process was setting a password as well.
- o-__-o 7y agoCisco never requires a passsword to be set. iOS prompted for a password during the easy configuration but if you dropped in, via console or Tftp, a config over you can configure it without a pw. Later versions did not allow passwordless ssh but still allowed it via telnet. Cisco’s ACI platform enforces password on the initial account, then with some smarts you could disable it in OpenLDAP
- bifrost 7y agoIf you consoled into easy mode you defo could set a pw there, or skip it. I still don't get why they don't make you set at least one password, but some of it also stems from the architecture of the OS AFAIK.
- judge2020 7y agoSo would a "different password for each device programmed at the factory" approach (as Comcast/Xfinity/Att and others currently do, at least in the US) be better? This would make it better in the sense that only Huawei would know about the default password for that piece of hardware [if they were to log it].
- btbuilder 7y agoNegligent or malicious, no matter which, I would not want to deploy devices that had hardcoded ssh private keys. Default passwords can be dealt with.
- trickstra 7y agoHow many companies would be left on the market if a default password or hardcoded account or sloppy programming was enough to put them out of business? If we treated them all the same.
- BubRoss 7y agoA default password and hardcoding a private key are two very different things.
- trickstra 7y agoYes, it is. I'm just pointing out that defaul password was a common practice couple of years ago, and one of the companies caught with hardcoded private key is Cisco. If we treated them all like Huawei, we wouldn't have much of the infrastructure left. Which means the whole affair around Huawei is blown out of proportions.
- rossdavidh 7y agoSo I am reminded of the difference between "he attacked them because he was evil" and "he attacked them because he was insane". So, while this might make some difference in how you feel about it, but either way you need to lock them up (albeit perhaps in different places). If they are grievously incompetent at security, or they are intentionally installing backdoors, might make a difference in how we feel about it, but in neither case should we allow their products to be used.