5 ms·
Those routers don't have particularly bad default passwords iirc, 12-14 random chars, which is better than the vast majority of user-set passwords. I don't reme
by bserge 5y ago
Those routers don't have particularly bad default passwords iirc, 12-14 random chars, which is better than the vast majority of user-set passwords. I don't remember if it uses WPS 1.0 (why is there even a 2.0 of this horrible "feature"?), that would be the easiest way to access any router.
Why would the would-be hacker need access to the router settings? I can't think of anything worth changing there, these routers don't have any extra features.
The usual illicit use is to point an antenna at a router and use it from afar (well, no more than 100-300m, line of sight and preferably no obstructions).
In which case it makes more sense to just get a prepaid SIM card, set up a phone as a VPN in a location far from you and route traffic through it. It's not more complicated than bruteforcing a WPS PIN or WPA2 password. That is, if you can't just get a VPN without using any ID.
- Orphis 5y agoI remember stories of the default password being a weak hash of the SSID. And when those are "ISPNAME-4DIGITS", it's not too hard to collect them all. Sometimes, they can be retrieved from the MAC address as well. So it's just the illusion of security for most.
- serf 5y agoverizon just recently stopped defaulting the wep key to a very simple hash derived from the ssid and mac.[0][1] [0]: https://www.xkyle.com/verizon-fios-wireless-key-calculator/ https://www.xkyle.com/verizon-fios-wireless-key-calculator/ [1]: https://aruljohn.com/fios/ https://aruljohn.com/fios/
- dpwm 5y ago> It's not more complicated than bruteforcing a WPS PIN or WPA2 password. In the UK a prepaid SIM is normally linked to you in some way.
- bserge 5y agoIn what way?
- dpwm 5y agoSome are not really pre-paid, you have to go online to activate them, or have to order them online, or have few options but to top up by card. However, I just looked into it some more and it appears you can still buy prepaid cards by cash and buy top-up vouchers with cash.
- hfkfmtkrkf 5y agoYou can still be on the camera of the shop which sold you the sim card if they recorded the serial number.
- bserge 5y agoYes, you can get and top them up with cash, at some dinky corner shop with non-functional cameras. Or just buy a bunch of them on Gumtree, also in cash.
- maccard 5y agoYou can walk into many shops (including sainsburys te#co and Morrison's) and buy a sim card and top it up there and then with cash.
- pbhjpbhj 5y agoHave you done it? I thought I recalled needing a bank card to activate a free SIM.
- 5y ago
- midasuni 5y agoThose reports often have the wpa password printed on the back - I’ve seen more than one person with it on their windowsill, visible from anyone at the door.
- gnfargbl 5y ago> Those routers don't have particularly bad default passwords iirc I just checked, and the default credentials for the HHG2500 model mentioned in the article were admin / vodafone1234. It isn't clear to me whether the router's admin interface was default open on the WAN side, or whether it could be remotely enabled through TR069. I wouldn't be at all surprised if it could.
- pbhjpbhj 5y agoI don't think you can get a SIM in the UK without providing ID? I'm not sure if it's a financial liability issue, or a legal requirement.
- pbhjpbhj 5y agoSeems I was mistaken, or it's changed: https://news.ycombinator.com/item?id=27256827 https://news.ycombinator.com/item?id=27256827