20 ms·
Please log in with router's password
- TchoBeer 5y agoLet's say I social engineer a password out of one of these people. What can I do with that?
- fermentation 5y agoYou can restart their router enough times until they get annoyed and buy a new one.
- soheil 5y agoYou can install openWRT on their router and gain full access to their network.
- TchoBeer 5y agoOnce I get access to their network, what can I do? What does that do for me?
- ineedasername 5y agoSearch for vulnerable PC's, install ransomware, extract $$ from the victim. Or just generally cause havoc "for the fun of it", which seems to be a not uncommon motive for some people.
- TchoBeer 5y agoDoes the router have the ability to install software onto connected devices?
- ineedasername 5y agoThe issue isn't the router installing something onto connected devices. I suppose that's not technically impossible, but the issue is someone accessing connected devices through the router and compromising connected devices more directly. This would be even easier if-- because a person putting their router on the internet might not understand good security practices-- they might also be more likely to do things like punch holes through NAT without understanding the risks and proper precautions. Even without the user misusing NAT, a router will often give a list of connected devices, internal IP, and other details. An attacker with admin access to the router can easily punch their own holes through NAT to any of those devices, run port scans, and find vulnerabilities to exploit.
- quickthrower2 5y agoI guess you can also add it to a botnet?
- fny 5y agoYou can MITM their connections.
- SturgeonsLaw 5y agoYou can set up a VPN and connect directly to their network. You can put one of their computers into the DMZ and expose all its open ports to the internet. You could engage in denial of service by blocking their devices or messing with the WAN configuration. You could set their network to use a malicious DNS server and direct them to hosts that you control.
- vanpelt 5y agoPretty cool this post is already the first result in Google’s index. How does that work?
- eganist 5y agoTo the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets. https://en.wikipedia.org/wiki/Shodan_(website) https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated. --- It's also a super basic intro to proper google-fu (which you can google to find others' takes on how to become somewhat effective at, erm, googling). Back when I used to blog on Microsoft-related topics, it was common to construct extremely narrow queries to find exposed confidential documents in Skydrive accounts which we could then sift through to find bloggable material. e.g site:[skydrive domain] filetype:.pptx "Microsoft Confidential" etc. Or one which still works: https://www.google.com/search?q="Microsoft+Confidential"+site%3Ablob.core.windows.net https://www.google.com/search?q="Microsoft+Confidential"+sit... lmao I'm going to have some fun tonight.
- br2 5y agoAre Skydrive documents somewhat public or are people just sharing them by mistake? I don't use it nor am I that familiar with it.
- eganist 5y ago> Are Skydrive documents somewhat public or are people just sharing them by mistake? I don't use it nor am I that familiar with it. Almost all of this would be by mistake, no different than misconfiguring an S3 bucket.
- bellyfullofbac 5y agoYou can create a long complicated link to share with other people, even people without Skydrive/OneDrive/Dropbox/Google Drive accounts. But sometimes people publish these links somewhere where a search engine's crawler sees it and follow it. I remember spotting someone's URL to a Google Doc on their screen which their camera caught in their YouTube video. I manually typed it into my browser's URL bar and voila, I could read that document. Nothing juicy though.
- core-e 5y agoI don't understand. What point is being made here?
- fungiblecog 5y agoPeople are exposing their routers to the internet. This is not a good idea.
- csomar 5y agoProbably people not aware of exposing their routers to the Internet.
- core-e 5y agoThanks. How do I make sure I'm not on this list?
- mixedCase 5y agoEasiest, most practical, 90% good enough: Get your IP address, grab your phone on mobile network and go to http://your.ip.address http://your.ip.address
- iamcreasy 5y agoSo, if I was exposed I will see the router's login page?
- Arrath 5y agoIf you're running their equipment, you may see your ISP provided modem's login page, which ideally should have whatever randomly generated password was on the sticker on the bottom of the modem when you got your service. A shade more secure than a router with default credentials.
- kelnos 5y ago
- Johnny555 5y agoI think this is more the fault of manufacturers than end users. Routers should be secure by default, and it should be hard to do something that will make it insecure. The router manufacturers are the supposed experts when it comes to networking, expecting every consumer to even know the risks of exposing their router admin interface to the world is not a reasonable assumption.
- sathackr 5y agoSo it's the car companies fault if I crash my car? They should limit vehicle speed to 5mph so I don't hurt myself or others. I have used many of these routers. Admin access on the wan port is blocked by default and must be enabled by the user.
- solarkraft 5y agoLackluster comparison (a modern consumer router should be more like a self steering car), but modern cars indeed have safety features to prevent you from crashing. Of course, both with the car and the router there are good arguments that you should be able to do the dumb thing if you know you need it. If it has to be explicitly enabled after intense warnings, the protective duty (as someone knowing better) can possibly be considered fulfilled - or you can still argue that it should be especially hard to do to block out people who don’t listen to warnings.
- Johnny555 5y agoDo you want to require that router users pass a government proficiency test and carry insurance to cover their liability for unsafe network use? Otherwise the analogy with driving a car is not quite complete.
- sophacles 5y agoYou are making a very good point: the order of gear shifting was tightly regulated after a lot of accidents caused by NDLR order (instead of the now-standard PRNDL). In fact most automotive interfaces have regulations to standardize them after enough accidents were caused by people getting new cars that had different interfaces.
- paxys 5y agoFunny enough just 45 minutes later this very HN thread is the top result on Google.
- nicce 5y agoWe live in the endless loop folks! It took me a while to realize if it was actually the purpose of this post. Edit: Yes, it was not.
- slim 5y agoIt is not. The purpose is to show misconfigured access points accessible through the internet
- soheil 5y agoI don't think that was the purpose of this post.
- cduzz 5y agoThis reminds me of when Sergey Brin explained recursion to Terry Gross in this interview (14:45 seconds into the interview) https://freshairarchive.org/segments/google-founders-larry-page-and-sergey-brin https://freshairarchive.org/segments/google-founders-larry-p...
- thih9 5y agoIs there a summary or text version for people unable to view a video at the moment?
- JasonFruit 5y agoTerry Gross is one of the very best interviewers I have ever heard. Her interviews and classical music alone make public radio worthwhile.
- dane-pgp 5y agoIt seems Jonathan Coulton thinks highly of her too: https://genius.com/Jonathan-coulton-dance-soterios-johnson-dance-lyrics https://genius.com/Jonathan-coulton-dance-soterios-johnson-d...
- Alupis 5y agoFolks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_Archer%20C2300(US)_QIG_V2.pdf https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1) These routers all have secured passwords that are non-default. 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. Just because it's not how you would configure your router doesn't make it wrong. There are legit reasons to place a router on the internet, so long as it's secured properly... how else would you remotely manage a router at a different physical location, for instance. __Lastly__ click "Next Page" on the OP search results. The estimated 7,000+ results becomes 21. Many of which are HN aggregators reporting on this thread here. So... out of the possible millions of routers TP-Link has sold in this model line, less than 21 are on the public internet - many of which no longer load via IP address (indicating they are no longer publicly accessible), and the rest have professional CNAME's attached, indicating professional management. Nothing here...
- mullingitover 5y agoI would love to know how these are secured. I doubt there's MFA or even rate limiting. > 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. That's making some very generous assumptions.
- Alupis 5y agoThese are not high end enterprise grade kit, folks. Expecting things like MFA, secondary VPN endpoints, etc is just absurd for the target audience of this device. Again, just because you wouldn't configure it this way doesn't make it wrong. It's as secure as it can be, short of throwing a bunch of other kit in front of it, and then why would you be using a $100 consumer router anyway? The only vulnerability here is the possibility of a 0-Day. Everything else is either misguided or screaming for the sake of it.
- deleted 5y ago[deleted]
- tester756 5y agohttps://en.wikipedia.org/wiki/Google_hacking https://en.wikipedia.org/wiki/Google_hacking
- coldacid 5y agoFunny enough, this very page was the top result for me on Google.
- soheil 5y agoI suggest anyone wanting to see the pages in the search result to click on the google cache version instead of clicking on the link itself exposing your IP address.
- AshamedCaptain 5y agoI am quite sure there are enough preload/prefetch links in the Google results pages to make this irrelevant (and crash the poor routers' owners' downstream links).
- deleted 5y ago[deleted]
- soheil 5y agoHere is another example of what Google wasn't designed to do: https://www.google.com/search?q=intitle%3A%22index+of%22+mp3 https://www.google.com/search?q=intitle%3A%22index+of%22+mp3
- TchoBeer 5y agoWhat is this showing?
- forgotpwd16 5y agoOpen directories with direct links to mp3 files. You can try replacing mp3 with movies, shows, etc.
- quickthrower2 5y agoMan. Hypothetically this is freaking awesome! Interesting with an mp4 search too.
- beezischillin 5y agoSome of these routers can be crazy insecure. Just some fun from my own experience: before I got mine switched into bridge mode by my ISP I managed to disable the wifi on it despite the ISP blocking that functionality. How? By removing the disabled attribute from the select element via the devtools. I also know a friend who found his password in plaintext in a script tag in his router’s login page. I understand that nothing is absolutely secure but this is just tempting fate.
- Alupis 5y agoClick "Next Page" folks - estimated 7,000+ results turns into 21 results - many of which are dead, many others are HN aggregators, leaving the total amount of these model routers on the public internet to be a small handful - all of which appear to be professionally managed with CNAMEs, etc. All the outrage in this thread over nothing...
- ElijahLynn 5y agoTrue claim: When I click on "next page" I get "Page 2 of about 7,520 results" BUT when I click on "next page" again I do get "Page 3 of about 21 results".
- nicce 5y agoDoes this mean that our beloved search engine is narcissist. Overqualifying its capabilities. Or thinks that it found everything useful already.
- ElijahLynn 5y agoI read an article on this behavior many years ago explaining why it does this, and it has something to do with performance.
- mr_sturd 5y ago> many of which are dead They could all be receiving hugs of death from the HN traffic.
- calibas 5y agoAhem: >In order to show you the most relevant results, we have omitted some entries very similar to the 22 already displayed. If you like, you can repeat the search with the omitted results included.
- gennarro 5y agoThis is a list of the routers with the best SEO
- mrkramer 5y agoGoogle dorking at its finest.
- FridayoLeary 5y agoIt's a slightly recursive submission.
- yakubin 5y agohttps://www.google.com/search?hl=en&q=recursion https://www.google.com/search?hl=en&q=recursion
- jonplackett 5y agoThis has gone meta now and the search link just links back to this HN article.
- prasanthabr 5y agoWoah! Never thought this would be crawled by the google bot. Thanks for sharing
- z80x86 5y agoWhen you include omitted results, you’ll get the entire set of ~7000. The each result is nearly identical, so Google will initially filter them out.
- aetherspawn 5y agoHi folks, not much to see here. These routers are very well designed, receive regular firmware updates and are overall very solid. The only router that I haven't had to reboot since I've owned it (for nearly 18 months now). Had no random configuration resets, interface bugs, WiFi drop-outs, QoS issues ... just, solid. So seeing that people have exposed it to the internet - sure, that's not recommended. But I don't think that it is something to be overly concerned about. It doesn't feel like your normal internet of crap router. And as others have said, this is not the default setting, and you're actually warned when you try and enable external access. But for some, this is useful. Since this router supports a VPN server, external access could be the only way to troubleshoot it if you're not on-site.
- jfrunyon 5y agoOh, great! It's stable! That means it couldn't possibly have any 0days or weak passwords.
- aetherspawn 5y agoA security problem is a bug. If their track record is quality (i.e. no bugs), you can extrapolate that their process is pretty good at dealing with security problems as well. Until proven otherwise. Of course, nothing is unhackable. If a state actor wants to get inside your router, you'll lose no matter what. And you don't need to have https:// https:// exposed on WAN to get hacked in that way. The 0-day could just as easily be on the transceiver or on the WAN layer itself. The only way to protect yourself from a 0-day is to live in a tin foil bubble and simply never use a mobile phone or the internet.
- yipbub 5y ago> If their track record is quality. I really don't think that's the case for router manufacturers. > The only way to protect yourself from a 0-day is to live in a tin foil bubble and simply never use a mobile phone or the internet. Or have fewer attack surfaces. Like notoriously buggy routers.
- 5y ago
- fnord77 5y agoI'm getting "invalid cert" on all of these
- fnord77 5y agoalso, how did google find these? scanning all possible IPs? or from shodan?
- nashashmi 5y agoHow did these routers end up in google results. In the past you could check with link: I am not sure if there is any way you can check now.
- soheil 5y agoOne way I suppose is this: there are indexed sites on Google that just basically list all known IP addresses (eg. ip to location services) in hope of SEO juice. If those IPs are linked to by said websites then the Google spider will follow and index them.
- soheil 5y agoNote to self - if ever work at a router company include a robots.txt with: disallow all
- remram 5y agoThat is such an easy fix. I can't believe this is not the default on all devices with an HTTP server. Of course this wouldn't stop attacks or even entire-internet scans (does Shodan respect that?) but would make discovery way harder. Brb going through all software I ever wrote looking whether they could benefit from this too.
- kralos 5y agoHey Mum! I can see my router from here!
- tjxp 5y agoI just checked if my router's admin was open to public access by connecting with my public IP. It connected! Oh no! That's embarrassing, I thought. Turns out it was just NAT hairpinning. I can't connect from my mobile network.
- kivlad 5y agoI've done something similar once to find Dell iDRAC [0] and Exchange Outlook Web App [1] instances open to the internet. Just goes to show how forgetting a simple robots.txt (if it's even an option) can expose something you don't want, even if it's password protected. [0] https://www.google.com/search?q=%22Type+in+Username+and+Password+and+then+click+Submit%22 https://www.google.com/search?q=%22Type+in+Username+and+Pass... [1] https://www.google.com/search?q=intitle%3A%22Outlook+web+app%22+%22Connected+to+microsoft+exchange%22 https://www.google.com/search?q=intitle%3A%22Outlook+web+app...
- ThePowerOfFuet 5y agoNon-Google link: https://duckduckgo.com/?q=%22Please+log+in+with+router%27s+password%22 https://duckduckgo.com/?q=%22Please+log+in+with+router%27s+p...
- hamidchowdhury 5y agoWelcome to your Password Manager. Manage your saved passwords in Android or Chrome. They're securely stored in your Google Account and available across all website .
- quickthrower2 5y agoHow do they get the requisite backlink or submission to search console to appear in Google I wonder
- bhaavan 5y agoOn a side not, it's super annoying when you want to log in into your router, and google chrome auto completes / suggests it with 192.168.l.l, or ends up doing a google search for 192.168.0.1.
- James-Livesey 5y agoiirc, there's a certain query that's similar to this one which you could type into Google and control various security cameras around the world which are all on the WAN. Not only can you view the picture being recorded by the cameras, but you could rotate the cameras right from the web interface too. I (un)fortunately can't remember the certain query needed, but it's not too hard to find it — I'm sure it's been mentioned on various news articles or YouTube videos. If I remember, it relied on the cameras all sharing the same filename for the PHP page to access the interface.