12 ms·

TP-Link Archer VR1600V V2 Super User Password Cracked

160 points by stubish 6y ago

yabones 6y ago
Server's timing out! Does anybody have an archive link / mirror?
- bArray 6y ago
  Archive link: https://web.archive.org/web/20201215032258/https://www.marcelvarallo.com/so-we-cracked-the-archer-vr1600v-v2-super-user-password/ https://web.archive.org/web/20201215032258/https://www.marce...
  - deleted 6y ago
    [deleted]
  - eznzt 6y ago
    >Sorry. >This snapshot cannot be displayed due to an internal error. archive.org, never change.
    - segfaultbuserr 6y ago
      Try another version of the snapshot: https://web.archive.org/web/20201127172327/https://www.marcelvarallo.com/so-we-cracked-the-archer-vr1600v-v2-super-user-password/ https://web.archive.org/web/20201127172327/https://www.marce... > archive.org, never change. I recently started a scheduled donation to archive.org due to my fear that it can get worse...
    - bArray 6y ago
      > They’re trying to change history—don’t let them. In the > chaotic atmosphere of 2020, the Wayback Machine is a > crucial resource in the fight against disinformation, and > now more than ever we need your help. It was working earlier... What was that about not letting them change history? I also hear that the Wayback machine has also been involved in censorship of some content, something I don't think they should do unless the case is extreme (which there are few). The only form of disinformation the Wayback machine should be responsible for fighting is that of historical changes, not the content itself.
- m463 6y ago
  VExy!64a3ng
bArray 6y ago
> After requesting the SU password, they were told flat out > it doesn’t exist and referred to the manual by the vendor. This kind of flat out lying happens a lot. I suspect some of it is that the customer service teams have zero to no interaction with the developers, so if it's not written down it doesn't exist. I think this is a good argument for developers spending at least some time working on customer service per week (even just a few hours). You could escalate queries such as this one to a developer, where clearly somebody is asking a more technical question. Before anybody says "that's unrealistic, they don't have time" - first consider the amount of ridiculous meetings a developer will normally find themselves in, or how long they spend answering emails every day. Of course, it doesn't mean that such a password would be given away, but at the very least it could start an internal discussion about it's existence. Having a single shared super-password is a problem waiting to happen. Regarding the point with small firmware-based devices and security (i.e. IoT), I believe the practice is changing where each device will have entirely unique credentials (something that's relatively easy to do these days).
- m463 6y ago
  > I believe the practice is changing where each device will have entirely unique credentials I believe some regulations require unique credentials and this goes against that.
  - bArray 6y ago
    Great to hear regulations moving in this direction, security shouldn't be optional for such devices! I guess in the future we'll see this even effect SMBs like the Raspberry Pi... I guess they will need some new methods for such devices to store a default password independent of the flashed OS?
    - m463 6y ago
      I don't think the raspberry pi qualifies as an iot device. It has no built-in storage and you cannot remotely access raspbian unless you modify the image to write 'ssh' in the root folder. (I don't think pxe qualifies either)
RachelF 6y ago
Surely there's a typo in the article. There's no TP-Link VT1600V product. They do make a VR1600V, though.
- PostOnce 6y ago
  The article, page title, and the URL all say VR... T is directly right of R on the keyboard, so submitter typo.
- floatingatoll 6y ago
  I’ve emailed this comment to the mods so they can fix it, using the Contact link in the page footer.
- dang 6y ago
  Fixed now. Thanks!
jbyers 6y ago
Note the post was written in January 2020.
ztgasdf 6y ago
Someone reported[1] that the password has changed as of October 27th. [1] = https://whrl.pl/Rgapje https://whrl.pl/Rgapje
gwillz 6y ago
So recently TPG used their CWMP powers to disable the OpenVPN server on all of their customer's routers, including the VR1600V [1]. Without any notice too - and I know a few businesses that were pretty upset with this. Particularly because many of their employees were working from home and 'in this climate'. A commenter has also pointed out [2]: > The Archer VR1600V software is licensed under the GPL. This can be used to compel TPG to release the source behind their modifications, if anyone wants to use the legal system to chase TPG for information. Edit: I know that the version of OpenVPN on the router was using TLS 1.0, which is deprecated in all clients now. That's besides the matter. I don't believe it's an ISPs role to be fiddling with the application level services of someone's internet. [1]: https://community.tpg.com.au/t5/Broadband-Internet/Missing-VPN-Setup-on-Archer-VR1600v-v2/m-p/80095#M31146 https://community.tpg.com.au/t5/Broadband-Internet/Missing-V... [2]: https://www.marcelvarallo.com/some-more-fiddling-with-the-archer-vr1600v/#comment-33884 https://www.marcelvarallo.com/some-more-fiddling-with-the-ar...
- milankragujevic 6y ago
  > I don't believe it's an ISPs role to be fiddling with the application level services of someone's internet. It is not but it doesn't mean they won't do it. I am lucky enough to be unlucky enough to be using VDSL2, so I use my own CPE where possible, and often just disable the TR069 interface and CWMP functionality so the ISP can't break into my modem. The reason for this is they often factory reset the modem if their automated auditing scripts notice something "forbidden", i.e. DMZ to my router, which causes me great inconvenience to have to log into the modem again and setup a DMZ. Same would happen if I was using (soft-disabled) Bridge mode. So I just deny them access. On some modems I also download the config, change SSH and Telnet password (as well as "admin" and "telecomadmin" passwords for web UI), remove CWMP entries completely, and then restore the config so the modem won't connect. Best part is, if I have a problem that I have to report to the ISP, I first factory reset the modem, it pulls the config via TFTP on TR069 interface, resets again and configures itself according to their wishes - then I try to reproduce the problem, and if it is present, I call them to open a support ticket. If it is not present, I roll back to my config and try to debug the issue on my side. No harm to the modem, no time wasted for me. Sadly this is not at all possible for DOCSIS cable modems nor GPON ONTs for fiber to the home service. There you're SOL if your ISP is being mean and displaying anti-user behavior.
ohthehugemanate 6y ago
Personally I got tired of fighting my ISP for control of my router. Between CWMP and DOCSIS, I just gave up. So now I put my own NAT device/firewall behind the router, and treat that outer 192.168.1.0 subnet, DHCP, DNS, etc as if they were public. My home network starts at _my_ router. In various periods of distrust for my ISP, I have also run the external interface of my NAT through a public VPN provider, and added monitoring to look for connection slowdowns or open ports on the router, as evidence of a compromise. So far it's just been jumping at shadows, though.
- elktea 6y ago
  Surprising amount of distrust of CWMP in this thread. As someone who implemented this and manages it at an ISP we really only use it to configure the WAN or VoIP connections.
  - milankragujevic 6y ago
    Well yes but nothing prevents you from, for example, changing both user's passwords so they can't log in to even change WiFi password. [1] Needless to say, I don't trust it and disable it whenever I can. I can set up my PPPoE or VoIP access myself. [1] https://milankragujevic.com/uploads/oKazARE_.png https://milankragujevic.com/uploads/oKazARE_.png
    - elktea 6y ago
      Yes, agreed technical people are fine. Most users struggle with basic setup so it's a win for them. Personally, why would I do anything hostile that generates support calls?
      - milankragujevic 6y ago
        Agreed. For most people remote management is a life savior. But hostile can also be company policy, i.e. rewriting DNS servers every hour, etc.
- neurostimulant 6y ago
ibic 6y ago
Turns out in Jan-2020, the password is already googlable: https://whrl.pl/RfZQfv https://whrl.pl/RfZQfv
- phire 6y ago
  The linked article about cracking the password is dated Jan 11th 2020.
appleflaxen 6y ago
The password is VExy!64a3ng
- hda2 6y ago
  Luckily, it's okay to share it here since it's for an account "that doesn't exist".
WayToDoor 6y ago
The site timeouts for me, so here's a mirror : https://web.archive.org/web/20201127172327/https://www.marcelvarallo.com/so-we-cracked-the-archer-vr1600v-v2-super-user-password/ https://web.archive.org/web/20201127172327/https://www.marce... A little older since the web archive snapshot of today are erroring out too.
- giancarlostoro 6y ago
  Also here: https://archive.is/TSVAv https://archive.is/TSVAv
Snawoot 6y ago
Developers of embedded devices have long track record of embedding backdoors into their devices "for support purposes". Some of them try to hide backdoors better when they are discovered. Here we can see three generations of such hide-n-seek, ending with applying unsound crypto to hide access to backdoor: https://habr.com/en/post/486856/ https://habr.com/en/post/486856/ I guess we have to do something with it eventually. Probably widespread ban of import of devices with security issues in its design will do.
hayyyyydos 6y ago
This is (kind of) a non-issue. The hard coded su password only exists in the TPG (an Australian ISP) version of the VR1600v software. The main admin user is unable to set VOIP server details and authentication etc. If you get a vanilla TP-Link VR1600v, you'll find there is no such hardcoded password, and the normal admin account has full access to VOIP and CWMP settings.
bsharitt 6y ago
Hopefully the password is better that it used to be on Panasas devices(HPC storage appliances essentially). Back when I worked in HPC, I had a Panasas fail hard and it required one of their techs to login with the super special root password. Normally they would do it remotely, but this was at a DoD facility and we couldn't make an allowance for that. So instead of sending a tech on site, the support person I was working with gave me the root password and made it very clear I shouldn't share their super secret password that allowed (remote) root access. I don't remember it exactly, but the password is something very similar to P@nA$as!.
ClumsyPilot 6y ago
"If there were one and you wanted to change it for security reasons, it looks like you can’t and with the vendors denying it’s existance" How is this not fraud? If anyone can just lie with no consequence, how will the consumer ever find a company that does take security seriously?

160 points by stubish 6y ago

yabones 6y ago

Server's timing out! Does anybody have an archive link / mirror?

bArray 6y ago
Archive link: https://web.archive.org/web/20201215032258/https://www.marcelvarallo.com/so-we-cracked-the-archer-vr1600v-v2-super-user-password/ https://web.archive.org/web/20201215032258/https://www.marce...
- deleted 6y ago
  [deleted]
- eznzt 6y ago
  >Sorry. >This snapshot cannot be displayed due to an internal error. archive.org, never change.
  - segfaultbuserr 6y ago
    Try another version of the snapshot: https://web.archive.org/web/20201127172327/https://www.marcelvarallo.com/so-we-cracked-the-archer-vr1600v-v2-super-user-password/ https://web.archive.org/web/20201127172327/https://www.marce... > archive.org, never change. I recently started a scheduled donation to archive.org due to my fear that it can get worse...
  - bArray 6y ago
    > They’re trying to change history—don’t let them. In the > chaotic atmosphere of 2020, the Wayback Machine is a > crucial resource in the fight against disinformation, and > now more than ever we need your help. It was working earlier... What was that about not letting them change history? I also hear that the Wayback machine has also been involved in censorship of some content, something I don't think they should do unless the case is extreme (which there are few). The only form of disinformation the Wayback machine should be responsible for fighting is that of historical changes, not the content itself.
m463 6y ago
VExy!64a3ng

bArray 6y ago

> After requesting the SU password, they were told flat out > it doesn’t exist and referred to the manual by the vendor. This kind of flat out lying happens a lot. I suspect some of it is that the customer service teams have zero to no interaction with the developers, so if it's not written down it doesn't exist. I think this is a good argument for developers spending at least some time working on customer service per week (even just a few hours). You could escalate queries such as this one to a developer, where clearly somebody is asking a more technical question. Before anybody says "that's unrealistic, they don't have time" - first consider the amount of ridiculous meetings a developer will normally find themselves in, or how long they spend answering emails every day. Of course, it doesn't mean that such a password would be given away, but at the very least it could start an internal discussion about it's existence. Having a single shared super-password is a problem waiting to happen. Regarding the point with small firmware-based devices and security (i.e. IoT), I believe the practice is changing where each device will have entirely unique credentials (something that's relatively easy to do these days).

m463 6y ago
> I believe the practice is changing where each device will have entirely unique credentials I believe some regulations require unique credentials and this goes against that.
- bArray 6y ago
  Great to hear regulations moving in this direction, security shouldn't be optional for such devices! I guess in the future we'll see this even effect SMBs like the Raspberry Pi... I guess they will need some new methods for such devices to store a default password independent of the flashed OS?
  - m463 6y ago
    I don't think the raspberry pi qualifies as an iot device. It has no built-in storage and you cannot remotely access raspbian unless you modify the image to write 'ssh' in the root folder. (I don't think pxe qualifies either)

RachelF 6y ago

Surely there's a typo in the article. There's no TP-Link VT1600V product. They do make a VR1600V, though.

PostOnce 6y ago
The article, page title, and the URL all say VR... T is directly right of R on the keyboard, so submitter typo.
floatingatoll 6y ago
I’ve emailed this comment to the mods so they can fix it, using the Contact link in the page footer.
dang 6y ago
Fixed now. Thanks!

jbyers 6y ago

Note the post was written in January 2020.

ztgasdf 6y ago

Someone reported[1] that the password has changed as of October 27th. [1] = https://whrl.pl/Rgapje https://whrl.pl/Rgapje

gwillz 6y ago

So recently TPG used their CWMP powers to disable the OpenVPN server on all of their customer's routers, including the VR1600V [1]. Without any notice too - and I know a few businesses that were pretty upset with this. Particularly because many of their employees were working from home and 'in this climate'. A commenter has also pointed out [2]: > The Archer VR1600V software is licensed under the GPL. This can be used to compel TPG to release the source behind their modifications, if anyone wants to use the legal system to chase TPG for information. Edit: I know that the version of OpenVPN on the router was using TLS 1.0, which is deprecated in all clients now. That's besides the matter. I don't believe it's an ISPs role to be fiddling with the application level services of someone's internet. [1]: https://community.tpg.com.au/t5/Broadband-Internet/Missing-VPN-Setup-on-Archer-VR1600v-v2/m-p/80095#M31146 https://community.tpg.com.au/t5/Broadband-Internet/Missing-V... [2]: https://www.marcelvarallo.com/some-more-fiddling-with-the-archer-vr1600v/#comment-33884 https://www.marcelvarallo.com/some-more-fiddling-with-the-ar...

milankragujevic 6y ago
> I don't believe it's an ISPs role to be fiddling with the application level services of someone's internet. It is not but it doesn't mean they won't do it. I am lucky enough to be unlucky enough to be using VDSL2, so I use my own CPE where possible, and often just disable the TR069 interface and CWMP functionality so the ISP can't break into my modem. The reason for this is they often factory reset the modem if their automated auditing scripts notice something "forbidden", i.e. DMZ to my router, which causes me great inconvenience to have to log into the modem again and setup a DMZ. Same would happen if I was using (soft-disabled) Bridge mode. So I just deny them access. On some modems I also download the config, change SSH and Telnet password (as well as "admin" and "telecomadmin" passwords for web UI), remove CWMP entries completely, and then restore the config so the modem won't connect. Best part is, if I have a problem that I have to report to the ISP, I first factory reset the modem, it pulls the config via TFTP on TR069 interface, resets again and configures itself according to their wishes - then I try to reproduce the problem, and if it is present, I call them to open a support ticket. If it is not present, I roll back to my config and try to debug the issue on my side. No harm to the modem, no time wasted for me. Sadly this is not at all possible for DOCSIS cable modems nor GPON ONTs for fiber to the home service. There you're SOL if your ISP is being mean and displaying anti-user behavior.

ohthehugemanate 6y ago

Personally I got tired of fighting my ISP for control of my router. Between CWMP and DOCSIS, I just gave up. So now I put my own NAT device/firewall behind the router, and treat that outer 192.168.1.0 subnet, DHCP, DNS, etc as if they were public. My home network starts at _my_ router. In various periods of distrust for my ISP, I have also run the external interface of my NAT through a public VPN provider, and added monitoring to look for connection slowdowns or open ports on the router, as evidence of a compromise. So far it's just been jumping at shadows, though.

elktea 6y ago
Surprising amount of distrust of CWMP in this thread. As someone who implemented this and manages it at an ISP we really only use it to configure the WAN or VoIP connections.
- milankragujevic 6y ago
  Well yes but nothing prevents you from, for example, changing both user's passwords so they can't log in to even change WiFi password. [1] Needless to say, I don't trust it and disable it whenever I can. I can set up my PPPoE or VoIP access myself. [1] https://milankragujevic.com/uploads/oKazARE_.png https://milankragujevic.com/uploads/oKazARE_.png
  - elktea 6y ago
    Yes, agreed technical people are fine. Most users struggle with basic setup so it's a win for them. Personally, why would I do anything hostile that generates support calls?
    - milankragujevic 6y ago
      Agreed. For most people remote management is a life savior. But hostile can also be company policy, i.e. rewriting DNS servers every hour, etc.
neurostimulant 6y ago

ibic 6y ago

Turns out in Jan-2020, the password is already googlable: https://whrl.pl/RfZQfv https://whrl.pl/RfZQfv

phire 6y ago
The linked article about cracking the password is dated Jan 11th 2020.

appleflaxen 6y ago

The password is VExy!64a3ng

hda2 6y ago
Luckily, it's okay to share it here since it's for an account "that doesn't exist".

WayToDoor 6y ago

The site timeouts for me, so here's a mirror : https://web.archive.org/web/20201127172327/https://www.marcelvarallo.com/so-we-cracked-the-archer-vr1600v-v2-super-user-password/ https://web.archive.org/web/20201127172327/https://www.marce... A little older since the web archive snapshot of today are erroring out too.

giancarlostoro 6y ago
Also here: https://archive.is/TSVAv https://archive.is/TSVAv

Snawoot 6y ago

Developers of embedded devices have long track record of embedding backdoors into their devices "for support purposes". Some of them try to hide backdoors better when they are discovered. Here we can see three generations of such hide-n-seek, ending with applying unsound crypto to hide access to backdoor: https://habr.com/en/post/486856/ https://habr.com/en/post/486856/ I guess we have to do something with it eventually. Probably widespread ban of import of devices with security issues in its design will do.

hayyyyydos 6y ago

This is (kind of) a non-issue. The hard coded su password only exists in the TPG (an Australian ISP) version of the VR1600v software. The main admin user is unable to set VOIP server details and authentication etc. If you get a vanilla TP-Link VR1600v, you'll find there is no such hardcoded password, and the normal admin account has full access to VOIP and CWMP settings.

bsharitt 6y ago

Hopefully the password is better that it used to be on Panasas devices(HPC storage appliances essentially). Back when I worked in HPC, I had a Panasas fail hard and it required one of their techs to login with the super special root password. Normally they would do it remotely, but this was at a DoD facility and we couldn't make an allowance for that. So instead of sending a tech on site, the support person I was working with gave me the root password and made it very clear I shouldn't share their super secret password that allowed (remote) root access. I don't remember it exactly, but the password is something very similar to P@nA$as!.

ClumsyPilot 6y ago

"If there were one and you wanted to change it for security reasons, it looks like you can’t and with the vendors denying it’s existance" How is this not fraud? If anyone can just lie with no consequence, how will the consumer ever find a company that does take security seriously?