Woah! Never thought this would be crawled by the google bot. Thanks for sharing
Please log in with router's password
91–100 of 265 posts
Re: Please log in with router's password
#92Click "Next Page" folks - estimated 7,000+ results turns into 21 results - many of which are dead, many others are HN aggregators, leaving the total amount of these model routers on the public internet to be a small handful - all of which appear to be professionally managed with CNAMEs, etc. All the outrage in this thread over nothing...
> many of which are dead
They could all be receiving hugs of death from the HN traffic.
Re: Please log in with router's password
#93To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets. https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated. --- It's also a super ba…
Sadly, Shodan does not appear to index these, seemingly because it attempts an HTTP connection, while the router expects an HTTPS connection. Edit: I take it back. Looks like the hash is good enough. 47,000 results; the first three that responded are the same kind of routers. https://www.shodan.io/search?query=hash%3A-904286784
Lately, Shodan’s results are not as good as in the past. I think they are scanning less aggressively.
I always recommend to watch at least both Censys and Shodan.
Re: Please log in with router's password
#94When you include omitted results, you’ll get the entire set of ~7000. The each result is nearly identical, so Google will initially filter them out.
Re: Please log in with router's password
#95Click "Next Page" folks - estimated 7,000+ results turns into 21 results - many of which are dead, many others are HN aggregators, leaving the total amount of these model routers on the public internet to be a small handful - all of which appear to be professionally managed with CNAMEs, etc. All the outrage in this thread over nothing...
True claim: When I click on "next page" I get "Page 2 of about 7,520 results" BUT when I click on "next page" again I do get "Page 3 of about 21 results".
Does this mean that our beloved search engine is narcissist. Overqualifying its capabilities. Or thinks that it found everything useful already.
Re: Please log in with router's password
#96Earlier quoted context omitted.
I would love to know how these are secured. I doubt there's MFA or even rate limiting. > 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. That's making some very generous assumptions.
>That's making some very generous assumptions. Disagree. In my current country of living, I'm not even sure how I'd properly expose the router I use to the public internet since I sit behind the ISP's NAT-ing, and even when I lived in the US, I am not confident I could tell you how to publicly expose the modem provided by Comcast for non-local access, much less how someone without any tech experience might do this. I…
> I am not confident I could tell you how to publicly expose the modem provided by Comcast for non-local access
You likely couldn't. That setting is usually gated behind some sort of "technician" or "mso" account (or not present, or only accessible from the devices telnet/ssh interface). Of course, it's probably not difficult to guess Comcast's password; past experience with other companies suggests you try things like "comcast" or "C0mc4s7". (Not even joking, Suddenlink and Spectrum/TWC.)
> much less how someone without any tech experience might do this.
Easy. It's a button that their kid clicked while playing around.
> MFA is not common at all on consumer routers, which at least quite a few on the first page result are, same with rate limiting.
Are you trying to say that's a positive for exposing it on the internet...?
Re: Please log in with router's password
#97To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets. https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated. --- It's also a super ba…
Shodan, great tool. I remember spending time looking at some misconfigured IP cams
Re: Please log in with router's password
#98Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1)…
OP. I'm posting this because I discovered a box at the hostel I'm at on Google after fat fingering the IP by mistake. (It's disconnected already.) The password was easily guessable.
Aside from the anecdata, a counter argument is that the router manufacturer has taken no steps to obscure the routers from search engines. Sure someone could simply IP scan, but you have to admit this is a little absurd.
Re: Please log in with router's password
#99Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1)…
> These routers all have secured passwords that are non-default. Secure passwords is just a tiny subset of non-default passwords. Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low. > These routers were deliberately placed on the internet by people that knew enough about them to do so. This means these people knows how to expose the managem…
> Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low.
So you think the chance of human beings to come up with 4 random words is pretty low?
You can't brute force millions of guesses per second through a web interface. 40 bits of entropy is already plenty for internet usage especially when the password is properly hashed with something like bcrypt.
> Secure passwords is just a tiny subset of non-default passwords
Actually the exact opposite is true. Since only low entropy and publicly known (which are mostly low entropy) passwords are insecure there are much more secure than non secure passwords.
For the sake of argument, let's say all passwords with less than 40 bits of entropy are insecure. Even if we restrict the set of possible passwords to only 10 characters of lowercase a-z we have about 47 bits of entropy. So the set of insecure passwords would only be about 1/128 or less than 1% of all allowed passwords.
Re: Please log in with router's password
#100Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1)…
I would love to know how these are secured. I doubt there's MFA or even rate limiting. > 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. That's making some very generous assumptions.
That would also be an assumption.