Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please log in with router's password

google.com

Post reply on HN
Print view View original

141–150 of 265 posts

Re: Please log in with router's password

#141

Post by grawprog »

eganist wrote: post #2

To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets. https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated. --- It's also a super ba…

All I'm going to say about Shodan is...

Too many people leave the default password on internet connected devices.

Seriously, anything is better than the default password.

Re: Please log in with router's password

#142

Post by ericyan »

ascar wrote: post #120
kle wrote: post #113

Earlier quoted context omitted.

>So you think the chance of human beings to come up with 4 random words is pretty low? I've always wondered how effective the random words thing is. sure, there are like 100k english words in current use according to google, but it seems like a list of the most common few hundred of those words would crack a lot of passwords.

If you assume the password to be only based on the 200 most common words you already have 30.5 bits of entropy to brute force or 1.6 billion guesses and you're assuming your attacker knows you're using this password strategy. The Wikipedia entry on Basic English [1] suggests there are about 850 core words for daily life and I could immediately think of simple words like well-known animals you would see in the zoo tha…

You also need to be aware that in this case, the attacker is/would not targeting any specific device. For brute forcing, all it takes is a dictionary of most common passwords and a list of devices that are exposed. Attackers won't spend too much time on any single device as there are so many options out there.

Re: Please log in with router's password

#143

Post by nwallin »

oriki wrote: post #109
walrus01 wrote: post #86

Earlier quoted context omitted.

Some fun things here, as a google search: site:.gov "for official use only" filetype:pptx site:.gov "for official use only" filetype:pdf

fyi, "for official use only" or "fouo" is a slightly more than meaningless designation to shield stuff against FOIA inquiries. most of the stuff you'll find is pretty boring. a little more: https://en.wikipedia.org/wiki/For_Official_Use_Only#United_S...

+1. I don't think I ever saw a document marked UNCLASSIFIED// that was not marked UNCLASSIFIED//FOUO. I'm not convinced that there is such a thing as a document that should be marked unclassified that should not also be marked FOUO.

Re: Please log in with router's password

#144

Post by notsureaboutpg »

atum47 wrote: post #97
eganist wrote: post #2

To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets. https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated. --- It's also a super ba…

Shodan, great tool. I remember spending time looking at some misconfigured IP cams

Me too. going through the filesystem on those things was like looking at a digital graffiti tunnel

Re: Please log in with router's password

#145

Post by ascar »

ericyan wrote: post #134
ascar wrote: post #99

Earlier quoted context omitted.

> Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low. https://xkcd.com/936/ So you think the chance of human beings to come up with 4 random words is pretty low? You can't brute force millions of guesses per second through a web interface. 40 bits of entropy is already plenty for internet usage especially when the password is properly hashe…

Well, real people won't choose any random 10 characters as a CSPRNG would do. Even when picking words from a dictionary, instead of four words, most people would probably just use one (or maybe two). For those are more inclined, they might mess with the capitalisation and sprinkle some numbers to make it "more secure" and adhere to certain password policies. This does not really contribute to the odds as you might ex…

I think most of this comes down to bad education on how to choose a secure password and not an innate inability. And for the most part we software engineers are at fault for advocating and enforcing mostly useless policies for more than two decates.

I would love for more websites to implement something like the zxcvbn password strength meter [1], but unfortunately I keep seeing new services or recently refreshed ones using outdated and hurtful policies like requiring numbers and special characters.

[1] https://github.com/dropbox/zxcvbn

Re: Please log in with router's password

#146

Post by closeparen »

larvaetron wrote: post #18
Alupis wrote: post #8

Earlier quoted context omitted.

There are legit reasons to have a router be publicly accessible. How else would one remotely manage a router (top results in Google are businesses and universities, for example). Since the default configuration of these routers is not to expose the router on the WAN interface, manually overriding this configuration usually demonstrates a sufficient enough understanding that the default credentials have likely also be…

> There are legit reasons to have a router be publicly accessible. No, there are not. > How else would one remotely manage a router Over a WireGuard connection to a secure management network. > The only real issue would be using a default password Uh, no. Try any number of CVEs or 0-days or unknown-until-it's too-late vulnerabilities, depending on what web daemon/frameworks are used by the router's management softwar…

Why is exposing a web service considered so much worse than exposing a VPN service? WireGuard is respected for low complexity and high quality, sure, but what prevents a web server from having the same characteristics? And there are plenty of VPN services whose huge public surfaces turned out to be vulnerable, why is running one of these any less crazy than running nginx?

Re: Please log in with router's password

#147

Post by TchoBeer »

soheil wrote: post #136
TchoBeer wrote: post #117

Let's say I social engineer a password out of one of these people. What can I do with that?

You can install openWRT on their router and gain full access to their network.

Once I get access to their network, what can I do? What does that do for me?

Re: Please log in with router's password

#148

Post by ineedasername »

Alupis wrote: post #22

Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1)…

2) These routers were deliberately placed on the internet by people that knew enough about them to do so.

If "placing it on the internet" was proof of excellent security knowledge & practices, then nothing on the internet would be insecure.

Just because they knew enough to know how to place it on the internet doesn't mean they understood the implications of that decision.

Re: Please log in with router's password

#149

Post by craftinator »

Alupis wrote: post #43
mullingitover wrote: post #33

Earlier quoted context omitted.

I would love to know how these are secured. I doubt there's MFA or even rate limiting. > 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. That's making some very generous assumptions.

These are not high end enterprise grade kit, folks. Expecting things like MFA, secondary VPN endpoints, etc is just absurd for the target audience of this device. Again, just because you wouldn't configure it this way doesn't make it wrong. It's as secure as it can be, short of throwing a bunch of other kit in front of it, and then why would you be using a $100 consumer router anyway? The only vulnerability here is t…

> The only vulnerability here is the possibility of a 0-Day.

You do realize that the last security update for these routers was in 2019, right? So by zero day, you mean something more like 700 day? Yeah, no way anyone could've discovered a system takeover in the last 2 years, when up against the security prowess of... TPLink?

I think it might be a good idea to edit your original comment, you'll save some face.

Re: Please log in with router's password

#150

Post by ineedasername »

TchoBeer wrote: post #147
soheil wrote: post #136

Earlier quoted context omitted.

You can install openWRT on their router and gain full access to their network.

Once I get access to their network, what can I do? What does that do for me?

Search for vulnerable PC's, install ransomware, extract $$ from the victim.

Or just generally cause havoc "for the fun of it", which seems to be a not uncommon motive for some people.

Post reply on HN