Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please log in with router's password

google.com

Post reply on HN
Print view View original

151–160 of 265 posts

Re: Please log in with router's password

#151

Post by pugworthy »

grawprog wrote: post #141
eganist wrote: post #2

To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets. https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated. --- It's also a super ba…

All I'm going to say about Shodan is... Too many people leave the default password on internet connected devices. Seriously, anything is better than the default password.

Or there is no password at all, like say a lot of HP printers.

Re: Please log in with router's password

#152

Post by TchoBeer »

ineedasername wrote: post #150
TchoBeer wrote: post #147

Earlier quoted context omitted.

Once I get access to their network, what can I do? What does that do for me?

Search for vulnerable PC's, install ransomware, extract $$ from the victim. Or just generally cause havoc "for the fun of it", which seems to be a not uncommon motive for some people.

Does the router have the ability to install software onto connected devices?

Re: Please log in with router's password

#153

Post by remram »

soheil wrote: post #140

Note to self - if ever work at a router company include a robots.txt with: disallow all

That is such an easy fix. I can't believe this is not the default on all devices with an HTTP server. Of course this wouldn't stop attacks or even entire-internet scans (does Shodan respect that?) but would make discovery way harder.

Brb going through all software I ever wrote looking whether they could benefit from this too.

Re: Please log in with router's password

#154

Post by girvo »

eganist wrote: post #2

To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets. https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated. --- It's also a super ba…

These used to be known in the script-kiddie scene as "google dorks", IIRC

Re: Please log in with router's password

#155

Post by Retric »

nwallin wrote: post #143
oriki wrote: post #109

Earlier quoted context omitted.

fyi, "for official use only" or "fouo" is a slightly more than meaningless designation to shield stuff against FOIA inquiries. most of the stuff you'll find is pretty boring. a little more: https://en.wikipedia.org/wiki/For_Official_Use_Only#United_S...

+1. I don't think I ever saw a document marked UNCLASSIFIED// that was not marked UNCLASSIFIED//FOUO. I'm not convinced that there is such a thing as a document that should be marked unclassified that should not also be marked FOUO.

Press releases

Re: Please log in with router's password

#156

Post by achillean »

grawprog wrote: post #141
eganist wrote: post #2

To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets. https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated. --- It's also a super ba…

All I'm going to say about Shodan is... Too many people leave the default password on internet connected devices. Seriously, anything is better than the default password.

Note that Shodan doesn't try to login using default credentials. If you see banners advertising their defaults it just means that the device is telling you what its defaults are - it doesn't mean that the device is still using them.

That being said, a ton of devices still use default credentials but we don't have any numbers on how many exactly.

Re: Please log in with router's password

#157

Post by throwaway984393 »

Alupis wrote: post #22

Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1)…

Nice try, NSA.

Re: Please log in with router's password

#158

Post by achillean »

eganist wrote: post #2

To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets. https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated. --- It's also a super ba…

The Wikipedia article is unfortunately woefully out of date in describing what Shodan does. For example, Shodan collects data on thousands of ports:

https://www.shodan.io/search/facet?query=net%3A0%2F0&facet=p...

And we don't concentrate on a single type of device/ service (the article mentions SCADA). We identify everything from industrial control systems (1) to Minecraft servers (2). The news coverage makes it sound like we're skewed towards ICS, webcams or vulnerabilities but our focus is on providing a comprehensive view of what's connected to the Internet.

If you want to quickly check if your IP is exposing anything unexpected to the Internet simply visit:

https://me.shodan.io

If you see a 404 then nothing public was found. Note that this looks up information in the existing Shodan database - it doesn't launch a scan.

(1) Industrial control systems: https://www.shodan.io/search/report?query=tag%3Aics

(2) Minecraft servers: https://www.shodan.io/search?query=minecraft

Re: Please log in with router's password

#159

Post by ineedasername »

TchoBeer wrote: post #152
ineedasername wrote: post #150

Earlier quoted context omitted.

Search for vulnerable PC's, install ransomware, extract $$ from the victim. Or just generally cause havoc "for the fun of it", which seems to be a not uncommon motive for some people.

Does the router have the ability to install software onto connected devices?

The issue isn't the router installing something onto connected devices. I suppose that's not technically impossible, but the issue is someone accessing connected devices through the router and compromising connected devices more directly.

This would be even easier if-- because a person putting their router on the internet might not understand good security practices-- they might also be more likely to do things like punch holes through NAT without understanding the risks and proper precautions.

Even without the user misusing NAT, a router will often give a list of connected devices, internal IP, and other details. An attacker with admin access to the router can easily punch their own holes through NAT to any of those devices, run port scans, and find vulnerabilities to exploit.

Re: Please log in with router's password

#160

Post by YPPH »

lmilcin wrote: post #50
Alupis wrote: post #22

Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1)…

> Folks - these routers are secure. There is nothing to see here, move along. If experience is any guide, they are not. Consumer routers have horrible track of embarrassing, easily exploitable vulnerabilities. That are not patched for a long time or ever. And exposing your router to public like that suggests the owner knows very little about security. This typically goes in hand with other neglect. Tell me, how many…

What router does HN recommend for consumers?

I personally run Ubiquiti Unifi gear, but they're not exactly consumer friendly (more geared to power users).

Post reply on HN