Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please log in with router's password

google.com

Post reply on HN
Print view View original

111–120 of 265 posts

Re: Please log in with router's password

#111

Post by alerighi »

Alupis wrote: post #22

Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1)…

> 1) These routers all have secured passwords that are non-default.

Who said secure password? Yes, they are not the default, but people are terrible at choosing password, most will choose weak password that are easy to exploit with a dictionary attack.

> 2) These routers were deliberately placed on the internet by people that knew enough about them to do so.

A people that know what it's doing would never expose a router web interface on the internet. Most people doesn't know how to configure his router, and let the ISP technician configure it, and they probably expose the router interface so they can access it remotely for maintenance, but it's not a great idea...

> There are legit reasons to place a router on the internet, so long as it's secured properly...

There aren't. Also you can choose a secure password, but these router interfaces are full of bugs, and highly exploitable. Add to this the fact that the manufacturer rarely updates the firmware of these devices...

> how else would you remotely manage a router at a different physical location, for instance.

With a VPN? By creating an SSH tunnel to one machine inside the local network? By connecting remotely (via RDP, VNC, TeamViewr, whatever) to one PC inside the local network? There are a ton of better solutions.

Also if you don't have a static public IP address, as it's in most situations nowadays, how do you access it remotely anyway? With dynamic DNS but it's not reliable. The best solution to me is using a VPN (I can connect to my home network from anywhere in the world and access all the hosts, including router and other networking equipment of course).

Re: Please log in with router's password

#112

Post by kenniskrag »

iamcreasy wrote: post #20
angott wrote: post #5

Earlier quoted context omitted.

There are thousands of TP-LINK routers whose WAN port 80/443 is exposed to the Internet, allowing access to their administration interface if you know the password (or a vulnerability is present).

I was planning to host a simple website on my RasberryPi using Dynamic DNS - which I think requires me to expose port 80 to the internet. Is that safe?

I was considering self hosting at home. If the local network should be disconnected IMHO only a DMZ will help. My router doesn't support that so the setup will be:

ISP router (with disabled wlan) firewall and the firewall can then separate the network by port. WAN for the firewall is the LAN Port of my ISP router.

Is that a good setup?

Re: Please log in with router's password

#113

Post by kle »

ascar wrote: post #99
ericyan wrote: post #74

Earlier quoted context omitted.

> These routers all have secured passwords that are non-default. Secure passwords is just a tiny subset of non-default passwords. Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low. > These routers were deliberately placed on the internet by people that knew enough about them to do so. This means these people knows how to expose the managem…

> Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low. https://xkcd.com/936/ So you think the chance of human beings to come up with 4 random words is pretty low? You can't brute force millions of guesses per second through a web interface. 40 bits of entropy is already plenty for internet usage especially when the password is properly hashe…

>So you think the chance of human beings to come up with 4 random words is pretty low?

I've always wondered how effective the random words thing is. sure, there are like 100k english words in current use according to google, but it seems like a list of the most common few hundred of those words would crack a lot of passwords.

Re: Please log in with router's password

#114

Post by BeefWellington »

Alupis wrote: post #52
SheinhardtWigCo wrote: post #47

Earlier quoted context omitted.

> The only vulnerability here is the possibility of a 0-Day. That's not exactly uncommon in cheap consumer routers. No rate limiting is as good as no authentication.

> That's not exactly uncommon in cheap consumer routers. That's, in my opinion, the only fair criticism available here. > No rate limiting is as good as no authentication. Trying to even load some of the links found in Google takes 10's of seconds. That's effectively a rate limit, even if it doesn't temp-ban per IP address. Someone would have to dump the firmware to find out, but it would be trivial for each device t…

> Someone would have to dump the firmware to find out, but it would be trivial for each device to generate their own salt - making a potential lack of rate limit a non-issue.

Salting does nothing to protect against bruteforce attacks, which are what rate limiting defends against. Salting is done to protect passwords in the event the password data is stolen.

Re: Please log in with router's password

#115

Post by cafxx »

Alupis wrote: post #22

Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1)…

> these routers are secure.

Owner of a C7 v4 here. There has not been a firmware update from TP-Link since December 2019 (note that v4 is the second-most recent HW revision). No way these are not affected by at least some CVE somewhere in their stack. Calling them secure is a leap of faith that TP-Link does not deserve.

I recently flashed openwrt exactly to be able to be on a more recent stack.

I would never dream exposing that UI to the Internet as-is. They don't even have any form of brute forcing protection. If they really needed access to the router remotely, it would be much saner to expose an SSH server with pubkey-only access or VPN, both with brute forcing protection, and allow tunnelling to the router UI only from the LAN side.

Either who set those up really has nothing to lose if they get owned, or they do not know what they are doing. In both cases, it does not qualify as being a secure setup. (Sure, they may also be honeypots - in which case your argument was incorrect anyway, as they are secure, but they are not routers)

Re: Please log in with router's password

#116

Post by BeefWellington »

ascar wrote: post #99
ericyan wrote: post #74

Earlier quoted context omitted.

> These routers all have secured passwords that are non-default. Secure passwords is just a tiny subset of non-default passwords. Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low. > These routers were deliberately placed on the internet by people that knew enough about them to do so. This means these people knows how to expose the managem…

> Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low. https://xkcd.com/936/ So you think the chance of human beings to come up with 4 random words is pretty low? You can't brute force millions of guesses per second through a web interface. 40 bits of entropy is already plenty for internet usage especially when the password is properly hashe…

> > Secure passwords is just a tiny subset of non-default passwords

> Actually the exact opposite is true. Since only low entropy and publicly known (which are mostly low entropy) passwords are insecure there are much more secure than non secure passwords.

You're confusing "passwords that are in use" with the set "passwords that are possible". We have data via password dumps that suggests of the "passwords that are in use" the set that qualifies as "secure" is indeed a tiny subset of passwords.

Re: Please log in with router's password

#120

Post by ascar »

kle wrote: post #113
ascar wrote: post #99

Earlier quoted context omitted.

> Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low. https://xkcd.com/936/ So you think the chance of human beings to come up with 4 random words is pretty low? You can't brute force millions of guesses per second through a web interface. 40 bits of entropy is already plenty for internet usage especially when the password is properly hashe…

>So you think the chance of human beings to come up with 4 random words is pretty low? I've always wondered how effective the random words thing is. sure, there are like 100k english words in current use according to google, but it seems like a list of the most common few hundred of those words would crack a lot of passwords.

If you assume the password to be only based on the 200 most common words you already have 30.5 bits of entropy to brute force or 1.6 billion guesses and you're assuming your attacker knows you're using this password strategy. The Wikipedia entry on Basic English [1] suggests there are about 850 core words for daily life and I could immediately think of simple words like well-known animals you would see in the zoo that are not included. So how many of these "4 words that you could draw as a picture"-passwords actually fall into even the most common 850 words?

30 bits of entropy isn't particularly secure against locally cracking a password hashed with sha256 or a similar non password hash. However at 1000 guesses per second it would already take 28 days to brute-force and 1000 guesses per second is pretty fast against any password stored with a properly configured password hash like bcrypt.

I personally auto-generate readable passwords for most websites at ~70 entropy pure brute-force and ~50 entropy if my algorithm and set of inputs would be exposed.

[1] https://en.m.wikipedia.org/wiki/Basic_English

Post reply on HN