Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please log in with router's password

google.com

Post reply on HN
Print view View original

61–70 of 265 posts

Re: Please log in with router's password

#61

Post by kube-system »

iamcreasy wrote: post #35
blacksmith_tb wrote: post #32

Earlier quoted context omitted.

If it's a static site? Probably safe-ish, I suppose bots and bored teens could DDOS it. You could also choose a non-standard port, that might cut down on the noise.

Thanks! I want to learn what could go wrong. Can you point me to any resource/book to study this particular matter?

It depends entirely on what technologies you are specifically exposing. If you are serving a page with a web server application like Nginx or Apache, you should read about securing those applications. If you are writing a NodeJS application, you should read something specific to that.

If you want something very general and comprehensive, you can read this, although it is probably too involved for a basic "website": https://owasp.org/www-project-web-security-testing-guide/sta...

Re: Please log in with router's password

#62

Post by kelnos »

iamcreasy wrote: post #20
angott wrote: post #5

Earlier quoted context omitted.

There are thousands of TP-LINK routers whose WAN port 80/443 is exposed to the Internet, allowing access to their administration interface if you know the password (or a vulnerability is present).

I was planning to host a simple website on my RasberryPi using Dynamic DNS - which I think requires me to expose port 80 to the internet. Is that safe?

It's as safe as whatever software stack you'd be using on the Raspberry Pi to serve the site, same as if you'd be hosting it on a VPS in someone's cloud (though in your case if there's a vulnerability of a particular kind, someone could gain access to your local network).

Since you're not hosting the site on the router itself, presumably you're forwarding port 80 from the router to the Raspberry Pi, so unless the security of the Pi ends up being broken, the router should be safe.

(Also I'd recommend using Let's Encrypt to get an automatically-renewing TLS cert so you can serve https on port 443 as well, and even redirect port 80 to it. It's not that difficult to set up, and you'll be improving the privacy and security of those who visit your site.)

Re: Please log in with router's password

#64

Post by cduzz »

nicce wrote: post #45
paxys wrote: post #21

Funny enough just 45 minutes later this very HN thread is the top result on Google.

We live in the endless loop folks! It took me a while to realize if it was actually the purpose of this post. Edit: Yes, it was not.

This reminds me of when Sergey Brin explained recursion to Terry Gross in this interview (14:45 seconds into the interview)

https://freshairarchive.org/segments/google-founders-larry-p...

Re: Please log in with router's password

#65

Post by amanzi »

Alupis wrote: post #22

Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1)…

You're making some massive assumptions here.

Exposing your router's admin page to the internet is not good security practice. These routers are protected by nothing but a password, and I couldn't see anything in the manual that enforces password length/complexity. So while the password might be non-default, it could still be incredibly insecure.

Also, to expose these routers to the internet, all it takes is a single checkbox to enable "Remote management". So your assumption that these have all been deliberately placed on the internet also doesn't hold up because I can definitely see a curious home user playing with these settings without realising the impact of this. There have been tons of similar reports in the past where home users have exposed things to the internet without realising the impact.

Re: Please log in with router's password

#66

Post by kelnos »

Arrath wrote: post #51
iamcreasy wrote: post #40

Earlier quoted context omitted.

So, if I was exposed I will see the router's login page?

If you're running their equipment, you may see your ISP provided modem's login page, which ideally should have whatever randomly generated password was on the sticker on the bottom of the modem when you got your service. A shade more secure than a router with default credentials.

I'd hope you don't even see that. Your ISP shouldn't be exposing that to the internet by default, either. Ideally you get connection refused or an eventual timeout.

Re: Please log in with router's password

#67

Post by kelnos »

Alupis wrote: post #46
kube-system wrote: post #42

Earlier quoted context omitted.

Best practice for remote management of network devices is over a VPN or a remote access application designed for remote management, and it has been that way for decades. Web UIs on routers are designed for use on trusted networks, are notoriously full of vulnerabilities, and aren't typically hardened for exposure to the open internet. They often do not support any security features beyond a password. No fail2ban, no…

Are VPN's, secondary networks, etc reasonable to expect for a $100 MSRP device targeted at consumers? I think not... Given what it is... it's as secure as it can be. Short of a 0-Day lurking somewhere, or an active CVE, the configuration is fine. Not to mention all the top results appear to be operated by organizations that certainly know what they are doing.

> Are VPN's, secondary networks, etc reasonable to expect for a $100 MSRP device targeted at consumers?

If they are, great. If not, then consumer-grade router admin interfaces should not be exposed to the public internet, ever.

Re: Please log in with router's password

#68

Post by JasonFruit »

cduzz wrote: post #64
nicce wrote: post #45

Earlier quoted context omitted.

We live in the endless loop folks! It took me a while to realize if it was actually the purpose of this post. Edit: Yes, it was not.

This reminds me of when Sergey Brin explained recursion to Terry Gross in this interview (14:45 seconds into the interview) https://freshairarchive.org/segments/google-founders-larry-p...

Terry Gross is one of the very best interviewers I have ever heard. Her interviews and classical music alone make public radio worthwhile.

Re: Please log in with router's password

#69

Post by system2 »

Alupis wrote: post #22

Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1)…

Why would the search engines index these though? That's the question, not their default security.

Re: Please log in with router's password

#70

Post by beezischillin »

Some of these routers can be crazy insecure. Just some fun from my own experience: before I got mine switched into bridge mode by my ISP I managed to disable the wifi on it despite the ISP blocking that functionality. How? By removing the disabled attribute from the select element via the devtools. I also know a friend who found his password in plaintext in a script tag in his router’s login page. I understand that nothing is absolutely secure but this is just tempting fate.
Post reply on HN