4 ms·
Wow, reading that I've checked a new IoT device I'm working on and turns out it had dropbear running as root by default. Couple this with our policy of not disc
by throwaway981273 4y ago
Wow, reading that I've checked a new IoT device I'm working on and turns out it had dropbear running as root by default. Couple this with our policy of not discouraging tinkering and hackers (it served us well with different devices) and it was passwordless account (simple rs232ttl dongle connected to exposed header gives you root, pretty useful for anyone with access to hardware) so anyone with a port scanner could go in. Dropbear also by default advertises on mDNS. One IoT device now fixed, thanks to this article.