3 ms·

Hard-coded default passwords is a non-problem. The problem is sloppy processes lacking protected networks for staging and deployment that properly configures s

Hard-coded default passwords is a non-problem. The problem is sloppy processes lacking protected networks for staging and deployment that properly configures said network gear with a unique password or TACACS+ auth.

e12e 3y ago
> Hard-coded default passwords is a non-problem. I humbly disagree. However, this is much worse, anyway - it's a static root password: > A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. > This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cer-priv-esc-B9t3hqk9 https://sec.cloudapps.cisco.com/security/center/content/Cisc...
- oldbbsnickname 3y ago
  You're mischaracterizing what I was talking about: I was talking about the general case of a hard-reset default password that is user-configurable. I don't care about Cisco, so they can continue footgunning themselves in obviously stupid ways. It sounds like such a Cisco user should or must have an ability to be disabled. If not, that's fucking moronic. But really, what kind of morons put what should be their internal management network on the fucking internet and don't have TACACS+?
  - e12e 3y ago
    > You're mischaracterizing what I was talking about I didn't mean to imply you was talking about something else - I tried to make two separate points: 1) I don't think default passwords are "no problem" 2) This Cisco thing is anyway much worse than that. As for what you bring up: 3) But really, what kind of morons put what should be their internal management network on the fucking internet and don't have TACACS+? Indeed. Sadly 3) doesn't surprise me; it makes both 1 and 2 much worse (1 because the people that give us 3 aren't likely to change the default - even if they could - and with 2 they can't).

e12e 3y ago

> Hard-coded default passwords is a non-problem. I humbly disagree. However, this is much worse, anyway - it's a static root password: > A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. > This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cer-priv-esc-B9t3hqk9 https://sec.cloudapps.cisco.com/security/center/content/Cisc...

oldbbsnickname 3y ago
You're mischaracterizing what I was talking about: I was talking about the general case of a hard-reset default password that is user-configurable. I don't care about Cisco, so they can continue footgunning themselves in obviously stupid ways. It sounds like such a Cisco user should or must have an ability to be disabled. If not, that's fucking moronic. But really, what kind of morons put what should be their internal management network on the fucking internet and don't have TACACS+?
- e12e 3y ago
  > You're mischaracterizing what I was talking about I didn't mean to imply you was talking about something else - I tried to make two separate points: 1) I don't think default passwords are "no problem" 2) This Cisco thing is anyway much worse than that. As for what you bring up: 3) But really, what kind of morons put what should be their internal management network on the fucking internet and don't have TACACS+? Indeed. Sadly 3) doesn't surprise me; it makes both 1 and 2 much worse (1 because the people that give us 3 aren't likely to change the default - even if they could - and with 2 they can't).