Sprint DSL's Security Hole Easy As 1,2,3,4

An Anonymous reader points to this Wired article, excerpting "Sprint officials acknowledged that remote access to the administrative software embedded in the ZyXel Prestige 642 and 645 modems is by default protected with a password of '1234.' But the company said users are responsible for securing the equipment, which stores login data, including the user's e-mail address and password." Wired found that more than 90% of the modems they polled were using that default password.

Comments

Shit

[Anonymous Coward]

Time to change the combo on the luggage again.

Re:Shit

[Anonymous Coward]

better not have those locks on if you are flying.

then you'd be a terrorist.

Re:Shit

[deadsaijinx*]

can anyone say space balls.
"tell us the combonations to the air lock."
"fine, i'll tell. its ... 1 . 2 . 3 . 4 . 5..."
"1,2,3,4,5?! that's the kind of code an idiot would put on their baggage!" (president scrooge arrives)
""so whats the combo"
"the combo is 1,2,3,4,5."
"woah, what a coincidence. thats the exact same code i have on my luggage!"

----i love that movie ----

Re:Shit

[mistered]

Close... Here's the the script. What I read the headline, I also thought of that scene in spaceballs.

Re:Shit

[mistered]

Oops. s/What/When/

Re:Shit

[Indras]

I'm thinking 4321, how about you?

Re:Shit

[bigberk]

oh my god... I understand what you just said. I've reached a new low :(

Quick, somebody bring me some women...

Re:Shit

[The Fold]

Women...no, no women....evil creatures

Re:Shit

[onnellinen]

Time to change the combo on the luggage again.

That's easy. I need to get a new ATM card now that this number is revealed.

As I've always said

[Amsterdam Vallon]

The biggest security hole is not buffer overflows, ICMP packet manipulation, or poorly written software.

The easiest security breaches are to be had via social engineering, such as human manipulation and simple password guesses such as the default password for a certain system.

You can have all the conferences on security and corporate code reviews you want, but people will always be stupid. You can't change that.

Re:As I've always said

[Artifex]

The easiest security breaches are to be had via social engineering, such as human manipulation and simple password guesses such as the default password for a certain system.

Some people are pretty opinionated about that, in fact.

Re:As I've always said

[pjrc]

people will always be stupid. You can't change that.

Default setup and settings don't need to (be stupid). That can be changed.

Re:As I've always said

[FallLine]

Some people [google.com] are pretty opinionated [powells.com] about that, in fact.

Hmmm, Mitnick says... Yes? This coming from a guy that got SOCIALLY RE-ENGINEERED, hehe.

Re:As I've always said

[CliffH]

I think the scariest part about all of this is, most telcos, telecoms, ISPs, anyone who offers these services, will have one password for all. This is not an isolated case by a long shot and at the very least, customers who have their broadband installed should be made aware that their equipment:
1) Does have a password
2) This is your password and you should change it
3) Here are the instructions to change the password or alternatively I/we can do this for you
4) Once I/we leave here, it is your responsibilty to look after your equipment unless you have a specifc contract with us stating otherwise (managed IP networks, Frame Relay, yada yada)

Now, we all know that the contracts will absolve the ISP/Telco of any harm caused by this and we all know how well people read those contracts . A simple, "Here's the deal" would suffice and make sure it is one sheet of paper in easy to understand language that all involved can reference.

Ok, enough ranting.

Re:As I've always said

[Anonymous Coward]

What do you do if the company manages your modem or router remotely
and doesn't tell you the password?

Re:As I've always said

[arkanes]

They might not get away 100% on this one - I don't have Sprint, but my experience with broadband ISPs and Telco's in general leads me to think that they, like most of the others, think of the modem as belonging to them (which, in some cases it probably does, since they lease them), and they insist on retaining control over it - many of them even get very grumpy if you reset the password on it, to the point of cancelling your service.

Ah ha. From the Sprint DSL website: "Modem remains the property of Sprint and must be returned to Sprint if FastConnect DSL service is discontinued."

I can't find a copy of thier user agreement on the website (I really hate companies that don't let you see that until AFTER you're mostly commited to buying. How am I supposed to make a decision if they won't tell me thier policies?) but I suspect that (unless they changed it right before this became public) that it's standard boilerplate, which wouldn't include anything about the customer having to maintain those modems.

Re:As I've always said

[Tailhook]

"they insist on retaining control over it"

It is insanely irresponsible of Sprint to blame their customer base, 90% of which don't even know the "modem" has a password. This is a huge, pitiful cop-out. No wonder ION died. These twits have no business in last-mile telecom.

Re:As I've always said

[richie2000]

The UUCP password for all customers on a certain large american ISP was for a very long time 'notobvious'. I still get a chuckle out of imagining how it came to be:

Technician: What should we set the password to, boss?
Boss: I don't care, just pick one that's not obvious.
Technician: Right, boss.

To be fair, it was just the password to login to the modem server, every customer had an additional real password to actually access the UUCP box behind it.

Re:As I've always said

[KDan]

Why not blame them? Maybe there should be an ADSL licence that you have to pass before being allowed online. But the fact that these 90% are complete morons is not something to be blamed on the ISP. My modem shipped with that exact same password (it's a Zyxel Prestige, of course). First thing the docs say is "change your password on your modem" - and I'm willing to be that the Sprint "set-up docs" also say that. So what did I do? I changed the damn password!

Going the "oh, they're too brain addled, you can't blame them" way is stupid. If they're too brain addled to read the installation docs and follow them, they will be hacked by someone scanning for zyxel routers and it will serve them right.

Since when is stupidity and excuse?

Daniel

Re:As I've always said

[frp001]

I agree. As a matter of fact, whether the password in '1234' or '4AQKZZZz)))@@' is perfectly irrelevant to the issue: As most devices have the same default password and average users do not change it. Any Joe with the same device can break through them.

Re:As I've always said

[Anonymous Coward]

But even if it's set with a strong password by default, if it's never changed, it's still a risk. At some point, someone will figure out that the password is the same on every unit, and then it won't matter if it's 'Ih(&*G86ti8t' or 'password'.

Re:As I've always said

[arkanes]

If you read the article, you'll notice that the mouth making the statement admits that they don't tell the customer to change the password. I also checked the website, it's not in any of the setup docs there. Furthermore, it's Sprint's modem, not the customers (they lease it), which makes it Sprints responsibility to secure. Even furthermore, a good percentage of DSL installations are done by Sprint service reps, who should be helping the customer change the password as part of the installation.

So. We've got a group of users who a) aren't technically literate enough for it to be reasonable that they should assume thier modem has a password b) aren't informed of the existence of the password, much less given instructions on how to change it c) are actively discouraged from messing with the modem, since it's not thier property and d) are being told that they should be responsible for this?!

Re:As I've always said

[pjrc]

if it's set with a strong password by default, if it's never changed, it's still a risk.

If the default is to disallow remote administration _until_ the user sets a password, then the problem eliminated.

As I said, the default setup does not need to be stupid. You can't change stupid people, but you can change stupid default setups. Just think (not even very far) outside the box.

Re:As I've always said

[Anonymous Coward]

people will always be stupid. You can't change that.

Default setup and settings don't need to (be stupid). That can be changed.

Okay, I only have only parented *two* children so far, so I don't have as much experience as others here may have. That said, it seems to me that the default settings for people pretty much can only be *stupid*. That said, I will verify that these settings can be changed, but it does takes a while.

Judging by a few folks I have met in my life, though, it seems that *sometimes* the settings may return to the defaults.

Re:As I've always said

[KDan]

Hmm, ok, fair enough.

/me kicks Sprint. :-)

Daniel

Obligatory Space Balls Quote...

[kenthorvath]

President Skroob: "What's the combination?"

Colonel Sandurz: "1-2-3-4-5."

Skroob: "1-2-3-4-5?"

Sandurz: "Yes."

Skroob: "That's amazing! I've got the same combination on my luggage!"

So, who needs Kevin Mitnick?

[Uninvited Guest]

Who needs a social engineer to get the password, when we have the fine folks at Sprint around.

Re:So, who needs Kevin Mitnick?

[SyFryer]

Whilst the post was funny, it's probably due to the complacency of choosing 1-2-3-4 or similiar as a password that got him into trouble in the first place.

DMCA

[Anonymous Coward]

Is talking about security holes legal under the dmca?

Re:DMCA

[silicon_synapse]

Does talking about it circumvent any copy protection mechanisms on a copywrited work?

Re:DMCA

[kasperd]

Does talking about it circumvent any copy protection mechanisms on a copywrited work?

No.

Re:First Post

[jbrelie]

except that yours was't first. :P

Home users

[Ogrez]

Yeah.. but 90% of home users cant remeber their email password, do you really want them changing the password on the hardware... It comes with the default password, its impractical for the isp to change them all, and should the user change it, then forget it, its a hour long tech support call to fix it. Replace user, press any key to continue.

Re:Home users

[taliver]

Not really a problem.

Lots of switches and other equipment comes with hardware passwords. When these are lost, you can call the company and get a password by reading off a serial number identifier off of the equipment. When you enter that password, the machine is reset and all information previously on it is gone.

That would be good enough for most users in any event.

Re:Home users

[Angry White Guy]

I hate to inform you, but the outlook holes are Microsoft's fault! They are the ones who programmed the executable handlers to not check what type of file was there (whether it be an exe posing as a pif file, or a screensaver).

Re:Home users

[lingqi]

oh that is so bullshit

Earthlink used Zyxel 645 too, all their passwords are changed (tried to get in, can't).

besides, who in their right mind (general populance, now) would go into their modem? to do what? if they had to, do you think they would sell at all? (in this "plug and play is good" world)

of course - Zyxels 645 are actually pretty nice if you do get inside and flash a "proper" bios - you can set it up as a rounter directly, saving you some bux on that D-Link; but no web-configure, though.

Re:Home users

[Mikeytsi]

The problem is when the user isn't told that they are required to change a password on a piece of hardware that is leased to them by another company. I shouldn't simply be expected to do that, any more than I should be expected to change the locks on a car that I rent, or a hotel room that I stay in.

Re:Home users

[xlsior]

They are the ones who programmed the executable handlers to not check what type of file was there (whether it be an exe posing as a pif file, or a screensaver).

As far as a screensaver is concerned: not really much they can do, since a .SCR screeensaver *is* a normal .EXE, by design -- That may (or may not) have been a stupid decision, but the only thing necessary to make an 'official' windows screensaver is to rename the extension, and respond to certain command-line parameters to bring up the config window, demo mode, etc.

Re:Home users

[Jedi Alec]

tech installs the actual modem in the house, tech changes password, tech writes password in big black letters on the actual modem. tech leaves. How hard can it be?

Re:Home users

[Ctrl-Z]

I seem to remember a couple of years ago working with 3com switches which had default passwords set on them. Whoever actually installed the switches had neglected to change this password on the majority of them. I rectified that fact, but still...

I think the thing is that when you are buying a $3000 switch, you are expected to be intelligent enough to read the documentation and not leave them wide open. It would be kind of like setting up an Oracle server, leaving it wide open to the internet, and leaving changing the "system" password as "manager". Or, on MSSQL, leaving "sa" without a password.

See, there are lots of situations where a password is required, but there is no safe way to communicate this password to the end user. Of course, home users would not understand this in most cases anyway.

I'm ready

[Radio Shack Robot]

The radio shack modems in the back room run on these things, but the password is the first thing we change when the modem is pulled out of the box. So, don't try to hax0r RS. heh

Re:I'm ready

[8282now]

Hate to mock. But we're all so very aware that "RS" is the bastion of elite high technology that it is. Right?

--------
For the sarcasm impaired, please tag the above as ... sarcasm.

Re:I'm ready

[Anonymous Coward]

I remember a radioshack clerk crimped a power cable for a buddy of mine. One wire. My buddie's stereo shorted everytime the thing was plugged in (it was a power extension type thing). I upgraded it to two wires and said something like "your system needed a ground return" or some sillyness etc

Isn't anyones fault.

[jb_02_98]

Anyone who install one of these modems should change the password. It's that simple. Most routers have "admin" "password" combinations. They are all the same. It is the installers responsibility to secure it.

Re:Isn't anyones fault.

[jon doh!]

what if the DSL provider installed the modem for you? is it then their responsibility to change the password? how about to at least prompt you to change it, maybe verify before they leave that you've changed it?

Re:Isn't anyones fault.

[jb_02_98]

If they installed it, then they should change it and let you know the new one. If they don't want to change it, they should tell you how to. Security is what a lot of people don't know about, and it hurts.

Re:Isn't anyones fault.

[icedivr]

In my area, where Sprint has rolled out DSL service within the past year, 'installing' the service is usually a two man job. One to navigate the menus until the exotic P-I-N-G command is found, and the other to watch over his shoulder.

My coworker and I were stunned to see them using 1234, especially at the second and third client!

Re:Isn't anyones fault.

[Anonymous Coward]

It is very much Sprint's fault. There are no detailed directions for the modem. I found out how to telnet to the modem/bridge only after goofing around. Then I looked up the model number and downloaded the specs from Zyxel. All this required considerable effort on my part and I changed my password on the modem to 123456789 ... err....wait...ummm...dang in spite of Sprint not because of them. One cannot sensibly require the average consumer to go to those lengths.

The service is great from an advertised rate of 1500/256 kb/s I am getting 1536/384 kb/s and actual of 1300/300 kb/s. One bad thing is the price $65 which is $15 dollars more than comparable speeds. I wish that I could ditch the $15 Earthlink ISP charge.

From,
LK

Re:Isn't anyones fault.

[Anonymous Coward]

True story.

We have a remote division with no Internet access. They call local telco (Sprint) who says we can set you up with DSL, no problem. Few weeks later, they come out install the equipment, verify it works, say your all set, no problems everything is working fine.

I go to remote division and run quick port scan. Every port is wide open. Take a look at the equipment and see they have ZyXEL 642. (What the heck is a ZyXEL?). Ask what the password is to get in the thing. Nobody knows what that is or where the docs are.

Go to the XyZEL site download the manual, look at page 37. Says unit has a default password 1234. Surely, the installer is not stupid enough to leave it at that! Wrong, they were that stupid.

Just for the heck of it, check a few other IP address on the same range Sprint used. After getting into 2 out of the 3 I tried using 1234, I shook my head, tried to button down our security, and said a little prayer for the others.

AT&T key lock hack and Sprint ZyXel Prestige

[neomuzic]

AT&T's key lock hack and Sprint ZyXel Prestige 642 and modems security hole sounds like a party waiting to happen.

Default passwords

[Anonymous Coward]

Why would the default be 1234? I'm surpirsed they didn't make it 'password', that'd be too classic. It could have been anything. Even 'asdfghjkl' is harder to guess than 1234. I wonder who made that decision ...

Re:Default passwords

[LinuxOnHal]

The default password on a lot of Netgeat equipment is also 1234, with a username of admin.

Re:Default passwords

[LinuxOnHal]

damn...can't type.

Netgear equipment has a default password of 1234.
Not netgeat...err

This is a suprise to everyone?

[Dolemite_the_Wiz]

This is Sprint, the ISP who doesn't do a thing about hackers originating from their domain.

I don't know how many times in the past I've tracked hackers at work to Sprint's networks.

Getting a reply or action from Sprint Security is non-existent. I guess it takes an article published in 'Wired' to get action from them.

Sprint and Prodigy are renown for not working with customers in addressing secuity issues.

Dolemite
_________________________________

Re:This is a suprise to everyone?

[Zaknafein500]

Sprint just laid off several thousand employees from its HQ here locally. My guess is the staff that runs the abuse@ account were the first to go.

My question is, why are these things even listening on the external interface? I set one of these boxes up for a friend recently, and I couldn't find a single way to block tftp/telnet/http from the outside. What's worse, is that these modems are quite clearly running Netgear firmware, which by default doesn't not allow conections externally So, someone at either ZyXEL or Sprint actively decided that these boxes should allow administrative control from anywhere.

Re:This is a suprise to everyone?

[StormRider01]

Wow, the real question emerges! Many home IP devices, like the Linksys line of routers, have default passwords. But, you can't access the interface from the wan side of the device.

Does anyone remember the $500 ZyXEL 19.2 modems?

Re:This is a suprise to everyone?

[The FooMiester]

Which is why I send my spam/hacker reports to abuse@, support@, and sales@. And be persistant. abuse@ might not net you anything, but support@ is usually staffed by someone. And if all else fails, someone in sales@ will get confused because they know nothing about computers and forward it to someone who can but doesn't usually mess with such things. And even if nothing happens, you're causing them to waste time and money by processing your emails.

Re:This is a suprise to everyone?

[kyz]

Can't you just use some "virtual servers" feature to forward ports 23, 69/udp and 80 to a box on the LAN side of the router/modem?

Even though my AMX router actually has a "external access" tickbox, unticking it doesn't actually stop the router responding to http and ftp from the WAN side. So I configured it forward those ports through to the LAN side and let my PC say "connection refused" instead.

Re:This is a suprise to everyone?

[Zaknafein500]

Unfortunately, no. These boxes also have no portfw functionality of any kind.

Re:This is a suprise to everyone?

[InvaderXimian]

This isn't really Sprints fault but then again, this default password is of no use to some wanker scanning for these *DSL modems.* I have 2 ZyXEL Prestige 645 DSL modems (thanks Earthlink!) and neither of them forward telnet or tftp ports on the WAN side. Unlike Sprint, Earthlink actually bothered to change the default password to "mspgzyx". And as far as I know, these "boxes" don't allow any type of external connections, so this "news" isn't particularily useful. Maybe try going to the ZyXEL web site, they'll give you the password there too, so you don't need to use your "uber leet" wanker skills to unravel this very secure setup.

Re:This is a suprise to everyone?

[Max von H.]

I own a Zyxel 642R router and you CAN block the external telnet/http/tftp/whatever port you want through filters to setup in the admin (telnet) interface. And it's also clearly indicated in the manual that you MUST change the password after setting it up for the first time. I agree the setup of this particular one isn't easy for your regular joe user.

The 642M/ME (bridges with a DHCP pool of max 4 addresses) series are a bit more limited but have a web interface that can be reasonably tweaked.

So far I've never had a problem with this series of Zyxel ADSL modems/bridges/routers. The only truly shitty one from them was the 630 series that connects to USB and pumps way too much power for most motherboards to work properly (gets all the power from the USB port, no external power supply).

The 650 series I'm unfamilar with, but they have a more complete function set than the previous, with now UPNP for those who need it and true port forwarding too. They have a web interface and can be tweaked quite seriously.

If you're too stupid to read the first page of the manual, perhaps getting a permanent Net connection isn't the best thing for you. Now if the gear was installed by a pro, there's no excuse for NOT changing the admin password...

Cheers,
max

Re:This is a suprise to everyone?

[Anonymous Coward]

I'm still amazed this bs has gotten so much "informed" response.

How the hell is this useful to anyone? Ok, so if some schmuck has a wide open WAP connected inside the firewall, you have a hole where someone might be able to forward a handful of ports to one machine that may or may not have a single port open or, hell, may or may not even exist.

This makes me wonder how many people on here can operate telnet, nmap, or a router for that matter, as it is pretty fricken simple to test some of these bonzo theories.

Obligatory Spaceball's quote

[cshoes]

Roland: One.
Dark Helmet: One.
Sandurz: One.
Roland: Two.
Dark Helmet: Two.
Sandurz: Two.
Roland: Three.
Dark Helmet: Three.
Sandurz: Three.
Roland: Four.
Dark Helmet: Four.
Sandurz: Four.
Roland: Five.
Dark Helmet: Five.
Sandurz: Five.
Dark Helmet: So the combination is one, two, three, four, five? That's the stupidest combination I've ever heard! That's the kind of combination an idiot would put on his luggage!

Not Sprint's fault...

[bmh5c]

As much as I don't like Sprint, it's not their fault that people aren't changing the default password. If people don't change it, it's their own fault if they get burned.

Re:Not Sprint's fault...

[rmadmin]

Sprint needs to let these people know how to do that then. More importantly, they need to get the point across that customers "NEED" to do this. For example, when a customer signs up give them a piece of paper explaining how to do it, leave a blank so they can write the password down, and explain that the paper needs to be protected, or someone can steal their e-mail. If I give a child a loaded gun, and don't tell him not to pull the trigger, IT WILL BE MY FAULT. (I hate to use that comparison, but I think it gets the point across) Just my opinion.

Re:Not Sprint's fault...

[Beatbyte]

Its your job as an ISP to supply a service. Part of that service would be protecting your customer from being hacked by :

1) turning off remote administration [it just helps their tech support be lazy anyways]

2) have the password for their equipment match their normal account password (or a randomly generated password created when the DSL is setup and logged into their account information)

3) at least explaining in the manual, after its all setup, do steps a,b,c to change the password after the account is functional for security reasons

I understand that people are computer dumb but I'm car dumb and I'd appreciate a mechanic telling me that when I retrieve my car from the shop, to make sure I fill up all the fluids in car.

Re:Not Sprint's fault...

[jovlinger]

erm yes it is.

I've had DSL for over a year and this is the first I hear about my modem even HAVING a password. For what?

And I'm in the upper n-th percentile of computer litteracy. Unless verizon and sprint differ significantly in how they do DSL, there's no WAY that Sprint's customers would have even known this password existed.

Re:Not Sprint's fault...

[scotch]

How much do you not like Sprint? Please elaborate. Thank you.

Re:Not Sprint's fault...

[bmh5c]

Agreed...Sprint should should let people know how to do this, and personally, I like your idea of leaving a blank to for a personal password. I was thinking that it would be useless for Sprint to give out random passwords because they would get a hundred calls a day (which would slow down Sprints already poor customer service...but thats just my opinion) from people who lost their password and need to know what it is. Oh, and to the person who asked me to elaborate on my disliking of Sprint, they have managed to 1) not disconnect the phone from the last place I lived, allowing the next tenants to run up a $200 bill that I am now responsible for, 2) have yet to change the name on the bill in my house, even after 3 separate phone calls, and 3) always manage to transfer me no less than 4 or 5 times each time I call and try to straighten out the aforementioned screwups. end rant

Re:Not Sprint's fault...

[Anonymous Coward]

Who looks for a password to change in THEIR MODEM???

This is fucking insane and absolute negligence. I wouldn't think that my modem would have a password. My account, yes. My email, yes. My computer, yes. But MY MODEM?

Re:Not Sprint's fault...

[Anonymous Coward]

you, sir, are an idiot. did you confuse upper n-th percentile with lowest? because seriously folks, changing the password on these things is extremely simple. i have one and would never have thought this to be an issue. some hardware out there ships with no password at all!

Re:Not Sprint's fault...

[harlows_monkeys]

As much as I don't like Sprint, it's not their fault that people aren't changing the default password

How are people supposed to change a password that they don't even know exists? If you install on Windows using the install CD from Sprint, the existence of that password is hidden. The install program deals with configuring the modem.

Re:Not Sprint's fault...

[Anonymous Coward]

please! i'm sure your modem came with a user's manual. READ IT mr. upper-nth-percentile-of-computer-literacy!

Re:Not Sprint's fault...

[Anonymous Coward]

Actually, in some places, giving a child a loaded gun would be your fault, even IF you told him not to pull the trigger. So... Maybe Sprint shouldn't give the users modems at all?

Re:Not Sprint's fault...

[m0rph3us0]

If you don't know your car needs gas you are ignorant. Your ISP's job is to provide internet service, not to secure your connection. By default when you install an OS the root password is blank, it is up to you to change it. If you are not aware of the security implications of the things you use you are being ignorant. If someone sells you a car that unlocks with a screw driver its your responsibility to know that unless they advertise otherwise.

Re:Not Sprint's fault...

[arkanes]

It is when your ISP retains ownership of the hardware and will deny you support if you change the password.

Re:Not Sprint's fault...

[Alphtoo]

If you give a child a loaded gun, odds are that you're a dumbass, regardless of what you tell him. But if you get stupid enough to do that, don't even consider TELLING him not to pull the trigger... ask him, very politely, to avoid the trigger and then offer him candy, cookies, and a soft drink. And try like hell to get the gun back. (Hell, roll him a joint if that's what it takes to get the gun back. Children can be very dangerous to themselves and to others, if they're not firmly duct taped to something solid).

Re:Not Sprint's fault...

[Anonymous Coward]

please! i'm sure your modem came with a user's manual. READ IT mr. upper-nth-percentile-of-computer-literacy!

WRONG. The modem does not come with a manual. It comes with a Windows-based install CD that makes no mention of remote administration capabilities or hardware passwords. This is 100% Sprint's fault (they are a completely incompetent ISP).

Re:Not Sprint's fault...

[bockman]

I've had DSL for over a year and this is the first I hear about my modem even HAVING a password. For what?

You are not alone. They came in small box , they are called 'Modem', and they are connected to the phone line. So people thinks they are just more complex versions of the analogic modems. Few people realise that there is a real computer inside.

Re:Not Sprint's fault...

[Beatbyte]

Fluids jackass. Also known as transmission, coolant/antifreeze, oil, etc.

And by all means, the people who order SprintDSL (mass majority), would know nothing about transmission fluid, oil, anti-freeze, etc... so I DOUBT they would know that Sprint is leasing them a modem with open access to the outside world with a widely known password that can easily give away their username and password.

Re:Not Sprint's fault...

[Anonymous Coward]

Or designing the sofware so the user must set a password immediately when the unit is first used (and checking the password's strength, too). Just like any out-of-the--box Red Hat installation makes you set the root password when you install. It's not that hard to do, but I guess anything's harder than being lazy!

Totally unprofessional

[unterderbrucke]

"Wired found that more than 90% of the modems they polled were using that default password."

Believe it or not, "polling" modems by checking their passwords is hacking. If not hacking, it is at least dishonest. How can I trust Wired not to root around my box looking through my private files now that they "polled" my computer to make sure I didn't use a default password?

Re:Totally unprofessional

[dytin]

Ok, so would you rather have wired not tell you that your modem is unprotected? If I were a sprint user, I would not be mad at wired, I would be pleased. I'd rather have wired hack my modem and tell me about it than some random script kiddie hack it and break into my email account.

Re:Totally unprofessional

[silicon_synapse]

Just logging in and leaving may not be illegal (or at least not punishable). At least not by Federal laws that I can find. I thought it was federal offense though. There are also state laws that probably apply. Check out http://www.stoel.com/resources/articles/ebusiness/ ebiz_007.shtm

Re:Totally unprofessional

[Anonymous Coward]

Because in the US, corps farking around with peons is ok. Peons farking around is bad.

Re:Totally unprofessional

[kbroom]

At least it was Wired who did it and not a real hacker with malicious intentions. If they hadn't done this, this story might have not made it to slashdot and you would never know that you NEED to change your default password.

Re:Totally unprofessional

[silicon_synapse]

I don't care what their intentions are. If they logged into one of my devices I would do all I could to dig up a law they could be prosecuted under and I'd make sure all the proper Federal agencies got wind of it. I did NOT give them permission to access my network. It would have been suficient to take Sprint's word for it and post the story. There was no need to go snooping where they don't belong.

Re:Totally unprofessional

[Anonymous Coward]

I agree, it's so much more professional to accept the word of a big company and never bother to check anything out for yourself. By the way, can I interest you in some Enron shares?

Re:Totally unprofessional

[Anonymous Coward]

But wait, I thought the standard line on slashdot was that in a case like this the script kiddies should be praised, not punished, for revealing to you a hole in your security.

Re:Totally unprofessional

[Gruturo]

Believe it or not, "polling" modems by checking their passwords is hacking. If not hacking, it is at least dishonest. How can I trust Wired not to root around my box looking through my private files now that they "polled" my computer to make sure I didn't use a default password?

Wrong story, pal.

That's RIAA.

Re:Totally unprofessional

[Anonymous Coward]

If you changed the default password, sure they did a "hacking", and should be punished. If, however, you left your password as the default, then you have given implicate permission to everyone who wants access to the device in question.

In other word: If you aren't playing by the rules of the game, then you have no reason to cry foul.

Re:Totally unprofessional

[Prior Restraint]

I did NOT give them permission to access my network.

Your network? You're the one accessing Sprint's network. Does the modem even belong to you? I was under the impression that DSL customers leased modems.

It would have been suficient to take Sprint's word for it and post the story. There was no need to go snooping where they don't belong.

Um, are you familiar with the phrase "investigative journalism"? If they had heard about this default passowrd from some other source, and Sprint had issued a denial, would it have been sufficient to take Sprint's word for it?

Re:Totally unprofessional

[shepd]

>Believe it or not, "polling" modems by checking their passwords is hacking

And testing the doorknob on every store on your street is multiple sets of felony B & E, right?

This is why the police wait for the burglar to actually _enter_ the house before charging them (well, actually, if they don't like they guy, they'll wait 'till he exits with an armload of swag), just like they wait for a hacker to _do_ something before charging them with a crime.

If you don't want anyone testing your lock, don't have one in a place they can test it.

Re:Totally unprofessional

[gol64738]

asre you kidding me? unless your lawyer costs more than their group of lawyers, you don't have a chance of winning your case.

our (US) justice system isn't about being fair, it's about who has the money. just ask OJ

Re:Totally unprofessional

[shepd]

>I did NOT give them permission to access my network.

Hey everybody! WE FOUND AL GORE!

>If they logged into one of my devices I would do all I could to dig up a law they could be prosecuted under and I'd make sure all the proper Federal agencies got wind of it.

Mmmmm, fresh barratry. Hope you don't actually get an honest (haha) lawyer ensnared into this one.

Re:Totally unprofessional

[silicon_synapse]

"Um, are you familiar with the phrase "investigative journalism"? If they had heard about this default passowrd from some other source, and Sprint had issued a denial, would it have been sufficient to take Sprint's word for it?"

Investigative journalism would entail getting written consent before accessing my network OR interrogating me; not helping themselves.

Re:Totally unprofessional

[silicon_synapse]

Oh yeah...

"Your network? You're the one accessing Sprint's network. Does the modem even belong to you? I was under the impression that DSL customers leased modems."

My network begins where I plug into the wall. Anyone coming beyond that point is on my turf. Whether I own the modem or not, Sprint has said it's my responsibility to secure it. That makes it my business even if I don't own it.

Re:Totally unprofessional

[silicon_synapse]

"If, however, you left your password as the default, then you have given implicate permission to everyone who wants access to the device in question."

So if I leave my front door unlocked and a stranger let themselves in while I was gone, that wouldn't be trespassing? You'll have to do a little better than that. Just because they didn't have to try hard doesn't absolve them from all responibility.

Re:Totally unprofessional

[silicon_synapse]

I don't have to win. I just have to cause some bad publicity.

Re:Totally unprofessional

[silicon_synapse]

You said it yourself. I should check it out myself. Wired should not take it upon themselves to check it for me.

Re:Totally unprofessional

[Anonymous Coward]

Well I think you'd have a hard time getting the guy prosecuted when the judge finds out he had the key to your house, as did 1000 other people.

Re:Totally unprofessional

[Anonymous Coward]

So if I leave my front door unlocked and a stranger let themselves in while I was gone, that wouldn't be trespassing?

Whoop! Whoop! Analogy Police! Pull over to the right!

Try this:
If a retail store left it's front door unlocked, and someone cracked the door a little to see if the door was locked or not, and then went and reported the unlocked door to the cops, would the store have them arrested for trespassing?

Nope. They didn't tresspass, they only tested the door. And they immediataly reported their findings.

Re:Totally unprofessional

[silicon_synapse]

A retail store has given implied permission for them to be there at least during business hours. I have not given permission, express nor implied, to Wired to be on my property. Therefor if they come around checking for unlocked doors, they are trespassing.

What?!

[Anonymous Coward]

That's the kind of stupid number someone might put on their luggage!

go for more security

[Anonymous Coward]

I always been told that the longer the password is, the harder it will be to crack.
7 chars or more....therefore...1234567 is good? :)
Hoooo, mix alpha and numeric, therefore :
1234abcd

My luggage PIN is 9999

HA-HA

[Anonymous Coward]

Known about this for years, I'm amazed that it took this long to come to the public eye. I'll just go home to my apartment now, knowing that my lock will keep the kid next door out (doh).

New Sprint Ad

[Lord_Slepnir]

Can j00 0wnz0r me now? g0000d!

Re:New Sprint Ad

[Anonymous Coward]

That's the funniest shit I've read in a quite a while.

Danke shoen!

Re:New Sprint Ad

[adamruck]

holy crap that was funny

1234

[qoncept]

How does it really matter what the default password was? If the default password was -8*k|-- it would still be just as easy to gain access to. The flaw is in not requiring the user to change it.

Re:1234

[kiwimate]

The flaw is in not requiring the user to change it.

Sorry, but I disagree. It goes higher than that. This is a piece of equipment provided by Sprint to paying customers in order to facilitate the network service. Therefore, it's incumbent upon Sprint to modify the default password, not the user. The user is paying for a complete service, and as such should have a reasonable expectation of at least moderate safeguards in place, particularly given the well-known dangers of a permanent Internet connection.

By the way, just to point something out: lots of other hardware/software comes with default passwords. Remember the SQL Server worm a few months ago? (Sorry, can't recall the name of the worm.) It could only get in if you didn't change the default sa password away from blank. It's not just MS, either -- Sybase has exactly the same default logon name and password, and Oracle has a default logon name of system with a default password of manager.

However, that's a different situation -- a company buys a database server with the expectation of having to perform post-purchase configuration. Did you sign up for DSL or cable service, get a modem as part of the package, and expect to have to perform some final configuration?

Re:1234

[Anonymous CowWord]

Its not the fact that there is a default thats the problem. Its what it IS that's the problem. If the default password was something like -8*k|-- , there is a lesser chance that a brute force password cracker could crack it.

With a combination like 1234, you don't even need software, just guess and you have it. Even if you use software, it will probably take 5 seconds to crack. As a result, the system can be compromised long before an admin can even check what's up with it..

Re:1234

[SlashdotLemming]

The flaw is in not requiring the user to change it.

The flaw IS requiring the user to change it. Why is remote administration even enabled by default?

Ignorant users should always be protected, while those in the know should have power. The feature should be disabled by default, and if someone knows it exists and wants to use it, they should be able to do so.

Re:1234

[Tackhead]

> [...] and Oracle has a default logon name of system with a default password of manager.

"SYSTEM/MANAGER"? Why, that's the stupidest password ever! It's the kind of password some VMS administrator might put on his DECserver's luggage!

Re:1234

[enomar]

The feature should be disabled by default, and if someone knows it exists and wants to use it, they should be able to do so.

I agree with this completely! In fact, I wish all software were shipped this way as well. I hate having a bunch of features (i.e. clippy and autoformat in MS Word) enabled by default. If I want the software to autocorrect my spelling and grammar, I'll turn on the function.

It seems that vendors are so eager to force features on their users that the software becomes more of an annoyance than a tool.

Re:1234

[Anonymous Coward]

Ignorant users should always be protected, while those in the know should have power.

That is bullshit. If you are ignorant you have 2 choices. 1. Become un-ignorant. (I know not a word, how about enlightened, that better??) 2. Stay ignorant. How is it my responsibility to look after all the idiots in the world?? Gimme a break. If they are ignorant, they get anything they deserve. To quote fark.com PERSONAL RESPONSIBILITY SURRENDERS

Re:1234

[SnAzBaZ]

I think you missed the point. There is no need to brute force or guess anything. If the universal default password is xyz, everyone who has one of these modems knows that's what the default password is.

Re:1234

[Anonymous Coward]

> Ignorant users should always be protected

Yes, they should be protected--at the bottom of the stairs.

Re:1234

[Anonymous Coward]

Both VMS and Oracle prompt you to change the default password during installation.

You're not very smart if you change it back to "manager". :-)

Re:1234

[arkanes]

I thought the Oracle one was scott/tiger. At least, thats what the Net8 tools try when you attempt to verify a connection...

Re:1234

[Ctrl-Z]

Scott/tiger is used for diagnostic purposes, but that user does not have any real power. "System/manager" is one of the default accounts. I believe that another is "sys/change_on_install" or some such.

Re:1234

[CaptainZapp]

By the way, just to point something out: lots of other hardware/software comes with default passwords. Remember the SQL Server worm a few months ago? (Sorry, can't recall the name of the worm.) It could only get in if you didn't change the default sa password away from blank. It's not just MS, either -- Sybase has exactly the same default logon name and password, and Oracle has a default logon name of system with a default password of manager.

Oh boy, how much do I agree. The difference however seems to be that Sybase makes it excessively clear that you must change the sa password after installation (even better: create an account with appropriate privileges and lock down sa) in their installation/configuration manual for the respective platform.

Evenb though I think Microsoft is a deeply unethical and dishonest company, which screws its customers from front, back and the side and have an abyssimal track record regarding security they didn't deserve the bad press regarding this "hole".

The Sprint issue seems very different though, from what I read they provide the DSL modem as an applicance, which they own and maintain and should be held responsible for their incompetence or lazyness.

If I as a database consultant set up SQL Server (or any other database engine for that matter) it is my professional responsibilty to apply basic industry standard security practices to the product, which I installed. If I ship you a CD with postgresql on it it's your responsibility to read the installation manual and apply such fundamental changes yourself. It's that simple.

Beautiful

[Beatbyte]

I find this hilarious considering I JUST got back from a friend's house where his CPE was non-functional. He'll be switching to my ISP when his 1 year contract is up.

But hey, he was only paying 30 bucks a month for the first 6 months! and surprise, he got what he paid for.

Total negligence by sprint.

[guido1]

"We recommend that customers change the (administrative) password to increase security..." said Sprint FastConnect spokeswoman Laura Tigges.

Tigges admitted that Sprint does not provide instructions for resetting the administrative password in the documentation provided to FastConnect customers.

They recommend you change it, but don't mention how? (It is listed in the modem manual, which is apparently not provided by Sprint.)

Oh, even better... In February they plan on shipping modems with this disabled. In February. Not now.

• On the other hand...

This has been around for a while. I wonder how many users have actually been affected.

Re:Total negligence by sprint.

[Anonymous Coward]

It's quit simple, really.

In the manual that comes with kit (It's a well-stocked kit - a manual, several line filters, and more) it instructs you how to physically connect the modem to the computer and then to go to 192.168.1.1 in your web browser. The manual walks you thorugh the wizard. It didn't work for me because they hadn't set up my Earthlink account yet, but after that was done it worked perfectly.

After that it says to pop-in the CD, but that is totally unnecessary. I suppose it's for people are totally computer illiterate and it double checks to see if the connection works.

Anyway, if you look through the options that are available in the web admin interface, you will find the tool for changing the password. No, the manual didn't say to do this, so most customers won't. But some will figure it out.

Randomize

[Jason1729]

ZyXel should set it so the password is randomized by default. That way, it might not be possible for the user to get in, but at least it will be more secure. For boosted security, they could make it re-randomize the password every hour.

Jason
ProfQuotes

Re:Randomize

[grub]

For boosted security, they could make it re-randomize the password every hour.

Yes, that makes a lot of sense, randomly change the password and lock out the user after an hour. Or were you suggesting something even more brilliant: change the password and display it on the user's screen?

Sheeeesh.

Re:Randomize

[Anonymous Coward]

if the user has no chance of knowing the password, whats the point of having it in the first place?

Re:Randomize

[Anonymous Coward]

That's Ralph Wiggum, not Homer, asshat.

Re:Randomize

[Jason1729]

It was a joke.

Jason
ProfQuotes

It couldn't happen here!

[Thud457]

Goddamit, that's like the eight "luggage" joke already!

You'd have to be an idiot to lock your luggage, because with today's new airline security restrictions, that would get you a suite at the GWB's Guantuanamo Hilton!

How are they supposed to know?

[jandrese]

How in the world are they supposed to expect the end user to secure the box they leased from the phone company and are told not to touch? They didn't even tell people HOW to change the password.

So heres, the situation. Joe Consumer gets a DSL modem, has it set up for him, goes through a small checklist on the sheet they provided for him, and he's online. Great. Unfortunatly his modem is now vulnerable to whatever nastyness this exploit allows. Now the Sprint guy is blaming Joe for not doing the thing they didn't tell him about?

Re:How are they supposed to know?

[Falconpro10k]

Well, you make it so they HAVE to change the password to gain internet connectivity This comes from a security paranoid linux user who also likes OpenBSD

Re:How are they supposed to know?

[SquadBoy]

I happen to agree with you on your choice of OSes and I don't think of myself as paranoid but rather what I like to call "right" and I suspect you are also. :)

In any case the problem here is that they don't want people to change the passwords and they want them to be the default or at least a well known password and any well known password *will* become public. This is of course because the vast majority of their lusers will fsck up changing the passwords and it will be a support nightmare. Also if they can get into the router, please for the love of gawd quit calling them modems, it is much easier for them to provide support. Of course the password leaked and now they need to put a good spin on it and in Amerika what better way to put a good spin on it than to blame the customer.

Yes we do in fact live in a sad fscked up world.

Re:How are they supposed to know?

[Ichijo]

How in the world are they supposed to expect the end user to secure the box they leased from the phone company and are told not to touch?

So let me get this straight. You're supposed to administer your own DSL modem ... but if you administer your own cable modem, you run the risk of the police busting down your door. Do I have it right?

What a confusing world we live in.

Re:How are they supposed to know?

[zenyu]

I got a Zyxel DSL router from my ISP and the first thing I did was change the password. As I bet anyone concerned with security at all does. But lets face it most users are running Windows so what does it matter that your modem can be 0wned when your friggin' computer can be as well?

Not that the story isn't important, if Sprint is so unconcerned as to let these modems out the door unprogrammed what's to say their whole operation isn't infiltrated?

Re:How are they supposed to know?

[sjames]

I see two solutions depending on the structure of support. One is to have the firmware refuse to actually connect until a non-default password is set locally, and make that part of the setup. That makes things somewhat secure (it doesn't keep the user from choosing poorly).

Another is to set each to a different random string and database the passwords in a tech support database (That is NOT connected to the public net!). That way, support has them and no need to worry about user forgetting or choosing poorly.

Leaving a default of 1234 is definatly at the very bottom of the list.

Re:How are they supposed to know?

[Falconpro10k]

i agree with the firmware idea, and make it so that you have a boot floppy/cd that u use to change it, *business card size* and the users will learn better to set up their equipment properly to gain access, this is not a facist idea, just simple for security, if a monkey cant keep his box secure, he doesnt need to be on the net. im tired of script kiddies

Local vs. National ISP

[wulfhere]

I work for an ISP. Lots and lots of equipment comes with widely known default passwords. We have always considered it our resonsiblity to our customers to change the default password on any piece of equipment they buy from us. Things like this are exactly why national ISP's will NEVER have customer service that compares favorably to a local ISP.

1 - 2 - 3 - 4?!

[Anonymous Coward]

What? How'd you get my luggage combination?!

Keygen for ZyXel Prestige 642 and 645 modems

[teamhasnoi]

10 Print "1234"
20 Print "Brought to you by the 133t Animal Kracker"
30 Print "Go 0wnz some modems!"
40 END

f34r my sk1LLZ!

BTW: The Animal Kracker was the name I used when I was 13 and using Locksmith 3.0 to copy Apple II games. Ahh.. the innocence of youth...;)

What is the big deal for Sprint to fix this?

[ortholattice]

They know the IP addresses of all the modems. Create a db with a random string assigned to each IP, then write a script to change the passwords (of all of the ones have the default password) in one fell swoop. They'll have the db of passwords if they need to login for maintenance. The customer doesn't even have to know about it. Any admin can do this trivially. Instead, they are just going to lamely post instructions on their web site, which probably 1% of customers are going to read. Am I missing something?

Re:What is the big deal for Sprint to fix this?

[Beatbyte]

as someone who deals with Sprint on a daily basis, you're missing the fact that they are the least pro-active LEC/Telco I've dealt with.

I had 3 T1 circuits in various locations dead for 3 months before I noticed and called them. They busied the circuits out in the switch so they didn't have to listen to the alarms. As opposed to calling the customer(myself) and getting the thing fixed!

Re:What is the big deal for Sprint to fix this?

[Anonymous Coward]

Am I missing something?

Yep. The part where ISP's are 99.9999999999999% marketing machines. The balance is technical resources, but half of them don't have a frigging clue.

Re:What is the big deal for Sprint to fix this?

[tomhudson]

But remember, if they can do it, so can any script kiddie by polling blocks of ip addresses. Lock out both sprint and the user :-)

Re:What is the big deal for Sprint to fix this?

[Anonymous Coward]

Any admin can do this trivially.

Any good Admin with experience and common sense could do this.

That disqualifies the vast majority.

Re:What is the big deal for Sprint to fix this?

[Anonymous Coward]

You had three T1 circuits dead for three months, didn't notice, and you are mad at Sprint?

WTF!

Re:What is the big deal for Sprint to fix this?

[TotallyUseless]

then sprint needs to hurry before a script kiddie beats them to it, dont you think?

Re:What is the big deal for Sprint to fix this?

[bdesham]

then sprint needs to hurry before a script kiddie beats them to it, dont you think?

>clickety click<

Oops... too late.

Re:What is the big deal for Sprint to fix this?

[iroczul8r]

I had 3 T1 circuits in various locations dead for 3 months before I noticed and called them Guess you didn't like your job too well huh?

Re:What is the big deal for Sprint to fix this?

[Anonymous Coward]

Some people have multiple lines, b1tch!

Re:What is the big deal for Sprint to fix this?

[shepd]

'Course, during Sprint's rounds they'd have compiled a list of all the hacked modems, and which customers have them, for their network.

So, call them all up and tell them the procedure to reset their modem, let them know they should buy their dose of AntiVirus (or use some magical OS that can't be infected, or get a CS degree...) and there you go. Problem solved.

Re:What is the big deal for Sprint to fix this?

[Anonymous Coward]

Am I missing something?

Yes. You're missing the fact that Sprint is a completely incompetent ISP for allowing such a problem in the first place. They could do this, yes.

Re:What is the big deal for Sprint to fix this?

[Beatbyte]

I have around 4-5 PRI cushion on all cities my ISP has access in. I had been busy on an infrastructure change and didn't notice.

Realize, though, there are such things as proactive telco's.

obligatory reference

[goatasaur]

HA! I bet you thought I was going to make another Spaceballs reference.

You couldn't be more wrong.

Anyway, making a password system like this is stupid and careless. It's a safe bet that if you EVER set up a system (especially if popular and Internet-related) involving default passwords, it'll be compromised pretty quickly.

How much harder would RANDOM passwords have been? Sprint is ignorant and careless and their mobile phone service sucks too.

Re:obligatory reference

[Zirnike]

"How much harder would RANDOM passwords have been?"

Probably, a great deal. Those passwords have to be stored somewhere... Flash ROM is most likely. All those ROMs get burnt at the same time, and come in from the board vendor in lots. Now, each time you build one, you need to go in and adjust it for a new password. Most of the test stations won't be able to handle this, they're all single use (our test stations don't manage to do more than exactly what they're supposed to do... pressure test, for example). And then you need to print it out on a label and stick it into a manual. Which probably comes pre-heat-shrink-wrapped from the printer. Plus you need to keep a log of all of them incase someone calls and wonders what the password is, as they haven't seen the manual in years.

Never mind that most manufacturers would (quite rightly, in my opinion) assume that the individual security of each is the domain of the people who buy the thing. What if some company wants to set up every modem with the same password (Sprint uses the password 'Verizon', or something)? For 'ease of customer support'? Easier to make a batch file for '1234' than for a list of random characters.

It's probably a good idea, but the manufacturer isn't all that concerned. Setup isn't something they're liable to do.

Re:obligatory reference

[goatasaur]

"...each time you build one, you need to go in and adjust it for a new password..." Those are salient points. I guess a better point is, what was stopping Sprint from *forcing* users to change their passwords before their first login? If hooking up DSL is like I think it is, wouldn't a tech have to walk them through the initial setup? Could they not choose an alternate password then?

Obligatory Cliche

[Gudlyf]

1. Set Sprint modems to insanely easy password.
2. Leak the information to Wired and Slashdot
3. ...
4. PROFIT!

security

[phantomwolph]

Why is it that ppl will spend a fortune securing their homes and cars and leave their computers wide open? Unfortunatly all these stories wind up on the tech sites but Joe six pack only reads the sports section of the newspaper.

Re:security

[RubberDuckie]

That's simple, Joe six-pack locks his house and car because he has been taught to do that since he was young. I'm sure it's second nature for most people to lock their cars when to go shopping.

On the other hand, most average people have never been taught to secure their computers. Perhaps after enough people learn (either through the pain of being hacked, or being educated) to secure their systems, then computer security will be as 'common sense' as locking a car.

Re:security

[Anonymous Coward]

Why is it that ppl will spend a fortune securing their homes and cars and leave their computers wide open?

Cost of having your car stolen and stripped by a chop-shop: thousands of dollars.

Cost of taking an evening to reformat Windows: an evening of your personal time.

I've had my car stolen and chopped. I do network security and I have to explain to admins that machine X and Y has been comprimised and needs to be reformatted. The two are not comparable.

Re:security

[vsync64]

Reformat? Why not just restore from backup? I can't imagine not dumping the entire filesystem when performing admin tasks at the enterprise level.

This is old..

[farrellj]

About a month ago, I had to help my on-site person hack into one of those Zyxel modems since they had a fixed IP, and the modem came NAT pre-enabled. Why does the world want NAT enabled?!?!

ttyl
Farrell

Stupid question

[Telastyn]

I've used Zyxel (sp?) dsl modems before, and iirc their admin interfaces were only inwardly pointing (only accessable via the ethernet i/f) Is this the case and Wired is overstating the problem, or is the outward admin IF turned on and Sprint are dumbasses? Or is there no way to set it and my memory is shot?

Re:Stupid question

[wulfhere]

You're correct By default, they (at least the Zyxel 64x series) only accepts telnet connections from the ethernet interface. It CAN be set up to accept telnet connections from anywhere. If Sprint did this, and did not change the default password, I smell a lawsuit brewing...

Re:Stupid question

[Telastyn]

Thanks for the confirmation. I'm not sure what the lawsuit could get except for damages caused if information was taken from the modems (quite likely now, but hard to prove) and perhaps force Sprint to recall the dsl modems and compensate users for downtime.

What about...

[Newskyarena]

How about continuing the poll to see how many people that changed the password to "secret" or "god" or *gasp* left it blank. I bet that is where you will find the 9.5% of the remaining 10% who did change the password.

Tons of blame to throw around

[SlashdotLemming]

The ISP is lazy, the users are ignorant, and that modem manufacturer...
My router/firewall has the same default password, but has remote administration disabled by default
Why is this feature enabled by default? The ISP doesn't need it for anything, otherwise they wouldn't tell the users to change the password (hence the ISP couldn't login)

Manipulate the system

[Mr.Dippy]

I ran into the same thing when I was at the University of Scranton. Everybodies voice mail password was defaulted to their room number at the beginning of the year. However, most people never changed it. So I would dial in to their voice mail, leave a rather rude sexual explicit voice mail greeting and then change their password. Oh the fun and the horror.

Why didn't sprint fix this quickly?

[t0qer]

Jobless, and too smart for my own good, i'm tempted to try and find some routers. Just tempted, I never do bad stuff like comprimise others networks.

Why didn't sprint fix this quietly and quickly though? It seems to me it would have been easy just to write a script to go to each modem, change the password to something random, store it somewhere safe like a customer info database and been done with it.

Now that it's been published on wired, and worse yet here, the exploit is going to be used by many people who want to just break in because they are "bored"

Zyxel's fault?

[dcavens]

As someone who just (10 seconds ago) changed the default password on their DSL router, I'm actually rather surprised. I had assumed (wrongly, I guess) that the routers would only allow telnet sessions from IP addresses that it manages (via NAT i.e 192.68.x.x..).

Wouldn't this be a lot easier and safer for the average user if it were implemented in the firmware? For 99% of DSL users, what possible use is there of having the router configurable from the 'net?

Re:Zyxel's fault?

[WaxParadigm]

I have a use, but I don't see a problem with restricting it to "internal" addresses at first, and then you can change it if you want remote access.

1234 - I declare a thumb war.

1234? That's the kind of stupid combination...

[Anonymous Coward]

...an idiot might put on his luggage!?!!

They're not the first

[Malc]

When I signed up for US Worst's (now Qwest/MSN) DSL about four years ago, the Cisco 675 modem they were shipping came with a default password. You could telnet in to the modem from over the internet, reconfigure it so that the user couldn't connect to the web and then change the admin password so they couldn't fix it! >:) To make it even easier, all the DSL IPs had hostnames containing "dsl", so a simple DNS zone transfer saved having to scan for the modems/routers.

Re:They're not the first

[Withen]

I remember finding out about the US West problem back when I was 17. After being blown off when I raised the issue to the company, I wrote a script that scanned through their IP's and logged usernames and passwords. After I had a pretty long list, I sent it to them and explained their problem (they weren't very happy...). I also contacted my local newspaper (Minneapolis Star Tribune) and you can read the article here. It would've been so simple to modify the script to change the password on the router and then change settings so that it wouldn't access the internet - would've shut down practically their whole DSL network. I wonder what I did with that list...

I don't understand how hard it could be....

[DrSpookles]

To only allow remote access once the password had been changed by the user.

xDSL passwords

[Lord Prox]

I have been doing xDSL installs for a few years and I have noticed a strange thing...

All of your big boy companies have crappy passwords. PacBell (now SBC say their commercials) I have found to be the worst... When I notify the customer they all have the same reaction *blank_look*what password*/blank_look*.

In contrast some of the smaller xDSL providers seem to be more on the ball with these things.

I usually change the password and write down the password and network info then tape it to the top of the modem with my company tech support number. What really gets me mad is the big boy providers never even bother to tell their clients about the need to change the password... I mean how goddamn hard is it to tell em that.

One more thing... one more luggage joke and I'm going to have to kill someone...


Vidomi Killer media player and network distributed video encoder.

Re:xDSL passwords

[antirename]

Nah, don't kill 'em. Just log into their router and disconnect their ass :)

Wasn't it Skoorb?

[jerkychew]

I always thought it was spelled Skoorb, whitch is Brooks (as in Mel) backwards...

Re:Wasn't it Skoorb?

[Anonymous Coward]

It's spelled Skroob, but that's still an anagram.

Re:Wasn't it Skoorb?

[sheetsda]

IIRC Brooks talks about that in the directors commentary on the DVD. "Skoorb" didn't sound quite right so they changed it slightly. Another bit of trivia: the scene with Dark Helmet playing with the dolls was completely adlibbed by Rick Morranis(sp?), Brooks just told him the concept, no dialogue, and they shot it.

Re:Wasn't it Skoorb?

[Anonymous Coward]

Similar story: Gene Wilder was interviewed on TV here in the UK the other week and he said that when shooting the sheep love scene in "Everything You Always Wanted To Know About Sex (But Were Afraid To Ask)" director Woody Allen told him to just forget the script and ad lib it. So its not so uncommon. But for my money Spaceballs is funnier.

I know ,this is offtopic even for a thread that was offtopic to start with...

Re:Unrelated, but much more serious security hole

[Neon Spiral Injector]

Maybe you missed it cause it was only posted once.

Um....

[tgd]

You mean like <a href="http://developers.slashdot.org/article.pl?s<nobr>i<wbr></wbr></nobr> d=03/01/21/1752251&mode=thread">this</a>?

Re:Unrelated, but much more serious security hole

[doja]

um... i think they did.

Re:Unrelated, but much more serious security hole

[SpamJunkie]

This is a lie. There is in fact a slashdot story on the CVS exploit. You're getting a little too ambitious about spamming Slashdot, aren't you NineNine?

On the other hand you seem to have all it takes to be a Slashdot Editor.

Pacific Bell

[Leme]

Has the same exact issue. All of the Caymen & Efficient routers are usually setup with the default password. Which by a quick google search, is easily obtainable.

This only applies to business customers who ordered the router option instead of a bridge.

Re:Pacific Bell

[antirename]

Bellsouth supplies Cayman routers to their business DSL users and they don't even have a password set by default. You have to log in and set it, and no one ever does. They REQUIRE businesses to pay for the install ($200 IIRC). I asked one of their installers to set the password... she was hesitant to do so because that would make it harder for them to get in. Well duh. What really funny is that you don't even need to scan for those routers; they have a default interface served by a webserver. So, a simple Google search for text on the admin page will turn up LOTS of those routers... no scanning required. And yes, the kiddies know about the problem, I found out about it on a wannabe hacker site (neworder.box.sk, I think). And no, I'm not a script kiddie, I've just found that it pays to keep an eye on them.

Re:Unrelated, but much more serious security hole

[br0ck]

No conspiracy here. Guess you missed it the first time. Don't worry, I'm sure it will be posted again soon.

Re:Unrelated, but much more serious security hole

[tuanjim_2001]

Oh kinda like this one that was reported yesterday?

Parent is Troll!

[KPU]

Here is the slashdot article.

been there, done that.

[zaphod.nu]

Considering how much you seem to know I'm sure this is not what you're refering to?

OFF TOPIC...

[Anonymous Coward]

...but what the hell is up with the MICROSOFT ADS on slashdot?!?!

Anyone else notice that bull? Not only is Taco not watching what posts he is reposting, but is also lax on what ads he serves! :p Time to start junkbuster up again.

Re:Unrelated, but much more serious security hole

[8282now]

Gee do you think maybe it was THIS one? http://developers.slashdot.org/article.pl?sid=03/0 1/21/1752251&mode=thread .... on the other hand, I spend altogether too much time on /. ... sigh...

Re:To add to the redundants

[Anonymous Coward]

Funny, I'd say you'd have to be an idiot not to realize that it's a quote from Space Balls... as well as a bunch of other places. Mod you down.

Re:Unrelated, but much more serious security hole

[Rich0]

Of course, /. isn't going to post an article telling about a serious hole in CVS [com.com]. Expecially considering their own Sourceforge...

Yeah! Slashdot would never post an article like that! Especially not a few days ago on the front page! (If you missed it the first time I'm sure you'll get to see it again in a few days.)

Note to whoever modded that up as informative. I would recommend at least reading Slashdot before moderating it. Then again, if those doing the posting would do the same we wouldn't have nearly as many duplicates... :)

Digital Rights?

[Anonymous Coward]

Are we allowed to secure the modems or will we get sued for modifying them?

as the saying goes

[natefanaro]

Your security is only as good as your dumbest user.

A buddy of mine and I have been uttering those words for years.

Re:as the saying goes

[Anonymous Coward]

If that is in fact true then maybe you should learn to limit the capabilities of your users on the network(s) you are in charge of, huh?
Lack of security caused by dumb users can most definitely be blamed on the ignorance of a dumb administrator.

Re:as the saying goes

[natefanaro]

This was back when we were students in high school. The dumb user was the person in charge of the lab at the time.

Wired is polling modems?

[nochops]

Wired found that more than 90% of the modems they polled were using that default password

Isn't this wrong?
Back in 1997 or so, I admin'd for my father's company. We had a massive DDOS type attack from about 100 or so IP's on our ISP's network. These were all trying to infect the machine with BackOriface, but since it was already patched, they just DOS'd the box.

When the DOS was done, I pormptly and naively swept the ISP's class-B for open port 31337 (backoriface). Well, I got about halfway through my sweep (and found about 20 infected machines) when the ISP disconnected me.

They killed my account, and when I pressed them for the reason, it finally came out that they terminated me for hacking. We went round and round, and I eventually got them to turn the account back on, but they kept their eye on me for quite some time.

I fail to see why some magazine should be able to scan the public at large with no recourse, but I cannot investigate an issue that brought down my network for several hours.

Anyone care to comment?

Re:Wired is polling modems?

[stratjakt]

You violated the AUP you signed when you hooked up with the ISP, or at least in their opinion you did. What type of connection does your fathers business have? ISDN/Dialup, DSL, fractional T1?

At any rate, Wired probably has a less restrictive leased link that they pay a ton for, and don't have anyone to answer to.

And there probably was a bit of a recourse. If sprint admins where doing their job they would have seen the scanning and fired off an email to abuse@wired.com asking them what the hell was going on.

Portscanning isn't illegal, per se. It's like loitering. It's not illegal unless theres a sign that says 'no loitering'.

Or something.

Re:Wired is polling modems?

[Kallahar]

Maybe Wired only scanned 10 modems.

Or, maybe they called their ISP, identified who they were and what they were doing, and got permission to perform the scan.

Or maybe they signed up for a specific plan that allows scanning like that.

Travis

Re:Wired is polling modems?

[suwain_2]

Portscanning isn't illegal, per se. It's like loitering. It's not illegal unless theres a sign that says 'no loitering'.

It's not illegal, and I adamantly support people's right to portscan people. However, a better analogy would be if the loitering was being done late at night in a neighborhood that was victim to a number of break-ins at night: It's not illegal, and there could be *entirely* legitimate reasons for doing it, but it's obviously going to look like you're trying to break in. (Off-topic: You can't really hang a "No portscannning" sign on your server)

What Wired did was either (depending on how you interpret the phrase "polled"):
- tried logging into people's routers with this password (blatant 'cracking')
- sent out a "poll" (as in a Slashdot Poll) to its readers asking Sprint customers to check their router and report back to Wired

In one case, I'd like to see more outrage, dropped subscriptions, and police involvement -- the fact that they're a respected magazine in no way gives them the attempt to try to crack routers en masse. On the other hand, if it's the second type of "poll," we're making a massive deal out of nothing. :)

Re:Wired is polling modems?

[SpeedBump0619]

I fail to see why some magazine should be able to scan the public at large with no recourse, but I cannot investigate an issue that brought down my network for several hours.

Simple:
1) they have more money than you.
2) they didn't get caught.

Re:Wired is polling modems?

[EZmagz]

Eye of the beholder, my friend.

Whether or not Wired "polled" all these people or not is ethical or not is one thing, whether or not it's legal is another. Is it legal? Well, I suppose that depends on whatever state you reside in, but most likely yes. Of course, after the Patriot Act, I can't answer this accurately.

Is it ethical??? That's way harder to answer. To be honest, I wouldn't care really if it was Wired probing me. However, I can see why people would be ROYALLY pissed when they read the article. Just because seeing if your neighbor's door is unlocked doesn't is legal, doesn't mean it's right.

On a related note to your story about scanning for BackOrfice on your subnet after getting nailed by DoS's within your ISP, I feel your pain. I got pissed after I got my cable modem hooked up and checked snort within a day or two. So, I fired up nmap, and looked for hosts on my subnet that seemed to like to try exploiting me...know what happened? I got a nasty letter in the mail (ESAD, RoadRunner!) threatening to cut me off for my "Hacking Attempts." All I was doing was nmaping people...not illegal over here, and I was really only scanning the people who were trying to root my box. Ironically, they still continue whereas I can't. Pig fuckers.

Point of story? ISPs can do whatever the hell they want to, and that applies to tolerance towards "Hacking Activities".

Re:Wired is polling modems?

[Politburo]

In one case, I'd like to see more outrage, dropped subscriptions, and police involvement -- the fact that they're a respected magazine in no way gives them the attempt to try to crack routers en masse. Yes just what we need, more black and white reading of the law! Law and punishment in this country is based mostly upon intent. Kill someone in self defense, and it's not a crime. Kill someone because you don't like them, and you're going to be in trouble. While Wired may have technically cracked these DSL modems, until someone either proves that they caused damage or intended to cause damage, there has not been a crime committed (imo). Yes the analogy that breaking into my house but not stealing anything is still a crime is going to come up. To head it off, when you break into someone's house, you cause physical damage. If someone managed to get into my house without damaging anything, and took nothing, I would see no reason to press charges (and more likely, I would never have known they were there). Logging remotely into a DSL modem does not cause any damage. In fact most people would agree that Wired's little escapade has resulted in benefit rather than damage.

Re:Wired is polling modems?

[Anonymous Coward]

"It's not illegal, and I adamantly support people's right to portscan people."

Do you really support it though? If I checked every door to your house and then checked every ground level window to see if they were open would that be okay? How about if I did it every day? How about if you park your car in the street and everyday I walk by and see if the doors and trunk are open. In both of these example I'm just "checking" to see what's there, but I don't think you or your startled family would appreciate it.

That's what portscanning is and outside of you own home or lan you shouldn't be doing it. Just because its virtual and you can remove yourself from it doesn't mean its okay to do.

Re:Wired is polling modems?

[Yo Grark]

Isn't DMCA beutiful? :P

Yo Grark

Re:Wired is polling modems?

[antirename]

Many routers serve an admin interface webpage with NO password set by default (see my earlier comment about Caymen routers supplied by Bellsouth and others). You can do a Google search for these: if Google found the default page and not "enter username and password" the router is vulnerable. You never have to touch it or connect to it to know, you just have to look at the Google cache. Is that wrong? I don't think so. Sort of like if you're walking around in public with a "kick me" sign on your back, and find it funny but never bother you, can you have me prosecuted for knowing that it was there? What if I tell you about it so that you can remove it? Or would you rather wait for someone to kick you?

Re:Wired is polling modems?

[antirename]

Shit, I wardialed every number (a thousand or so, I think) that my company has as part of a security check (for my company, and with their permission, to show them how a bad guy might do it). The only problem was, I decided to do it at night so I didn't interrupt business, forgetting that at night the watchmen get all calls routed to them. Oops. I quit when I realized what was happening, but the poor watchman was pissed after getting a few hundred "prank calls" in a few minutes. The phone company never noticed, so they didn't care. I'd be a little suspicious is someone made a thousand sequential calls as fast as they could, but they never noticed. No one at work the next day did either when I finished the exercise, although most of them were at lunch :) Moral: bad things happen when you expect someone else to have a clue.

Re:Wired is polling modems?

[arkanes]

Portscans are probably against your AUP. It's against mine, not that that stops anyone. The log in my hardware firewall fills up withing minutes of me rebooting it. Most of it is netBIOS traffic, about half of which are spoofed scans and half of which are unsecured machines broadcasting themselves.

Re:Wired is polling modems?

[joejoejoejoe]

Is it possible that they had 10 employees at Wired with these modems, and they found 9 of the 10 had the default password? If they got the oK from the 10 employees, it's not hacking.

While this may be unlikely, I haven't read a single post saying this *might* have been what happened...

Just saying...

Re:Wired is polling modems?

[elemental23]

And this has what to do with copyright, exactly?

Re:Wired is polling modems?

[Anonymous Coward]

I'm fine with that as long as you look, don't touch and you don't trespass.

Re:Wired is polling modems?

[kmellis]

Law and punishment in this country is based mostly upon intent.

You watch too many TV shows involving homocide. Yes, in that case, intent matters. In most others, it doesn't. One good reason is that intent is very hard to prove.

Re:Wired is polling modems?

[liquidsin]

So, a respected computer magazine attempts to see if a vulnerability is wide spread, checks some default passwords, does no damage, and reports their findings to the public...and you want them to be punished? Why? Do you think it's the magical pixies that are posting advisories to CERT? If there were no people doing this, we wouldn't know about nearly as many security holes. I applaud Wired for this, as I'm sure do all the Sprint subscribers who have now changed their default password thanks to this article.

Re:Wired is polling modems?

[Yo Grark]

Nothing, hence the sarcasm

Yo Grark

Re:Wired is polling modems?

[Anonymous Coward]

It's not illegal, and I adamantly support people's right to portscan people."

Do you really support it though? If I checked every door to your house and then checked every ground level window to see if they were open would that be okay?

As long as you just checked, and didn't enter or take anything, I'd be fine with that.

Nope, sorry, already been discussed

[plemeljr]

Hey, this story was already discussed on 15:20 21st January, 2003.

Please move along. No conspiracy here. Try not to snark too quickly.

Lazy?

[tarnin]

I think so. Seems that general laziness is more of a security threat than any other. It's much eaiser to leave a default password or make a simple one such as this than to generate either a unique one per modem or at the very least a unique one for the company.

Also, them blaming the user is totally bunk. 90% of home dsl users are lucky to beable to even run outlook express let alone go in and change a password on a router. This is more discusting than anything IMO. They should have atleast generated another password for these routers before they shiped them. Yes, people who run these types of connections should have more of a clue but companies have to start owning up to and taking actions to help prevent this when the main consumer for that product are people with little to no knowledge of comptuers.

Spammers Love 'Em!

[The Turd Report]

Spammers set up NAT to re-direct incoming port 33 traffic to AOL mail server on port 25. This way, they can still spam via a port25 blocked dial-up. Just telnet to the rooted router on port 33 and you are auto-majicly sent to AOL's mail server. Spam away!

Simple Solution

[SirCrashALot]

Disallow remote administration. Mabye this is different, but my Router (and cable modem for that matter), can only be accessed by the inside. I have changed the default password, but the fact that it is admin/admin is fine, as long as no one gets into my network.
How come sprint allows access on both adapters (LAN + WAN)??

Ack!

[Anonymous Coward]

Time to change the password on my ICQ!

Well, its 1, 2, 3...

[YrWrstNtmr]

...what are we fightin' 4?
Don't ask me I don't give a damn.
Next stop is big Bagdad.

Re:Well, its 1, 2, 3...

[tommck]

And it's 5, 6, 7...
Open up to Bill Gates!
Ain't got time for Windows' guy
Whoopee! WE're all gonna die!

SOrry... it's all I could think of... caffeine shortage..

No, Silly!

[dbCooper0]

Read the article. They polled users of these DSL modems.

Re:No, Silly!

[nochops]

But a scan of a sample of Internet addresses used by Sprint DSL customers revealed that more than 90 percent of the ZyXel DSL modems found had the widely known default administrative password.

Now that sure doesn't sound like polling users. It also doesn't sound like they had the users' permission, as others have suggested.

So can I or anyone else

[dark-br]

And i would not use them for maintenance...

Double standard!

[Anonymous Coward]

I'm supposed to change a password they never told me about for my protection.
I'm not supposed to change any other config files though, that's hacking and stealing.
I'm ~comfused~?

there is a safer way to do that.

[systemaster]

First of all access to admin from a public IP is bad...just bad. In that case I would be setup to ssh into my linuxbox and then telnet to the router. My setup is actually a bit different, my router requires a web interface from the private side so I use ssh and vnc throught my linux box, using Wake-on-lan to startup my windows box and VNC through the linux box to access the router setup through IE on my windows box. If you follow that or just the first meathod if telnet works on your router the only key is a good password on ssh on the inside box....which if you know your setting up to access from the outside you should have a good password. And those not smart enough to do that won't need to and hence no port forwarding for ssh to work at all.

Re:there is a safer way to do that.

[arkanes]

My SMC router came with remote admin disabled by default, and even when you enable it, you have to specify an IP mask. In fact, I'm not even certain you can use a mask, it might have to be a specific IP address. Not that I use it, I just ssh into my linux machine and use lynx :P

What Sprint Told Me

[harlows_monkeys]

I quickly found this problem on my Sprint DSL, and checked a few other addresses "near" mine to see if I had just overlooked something during setup where I was supposed to change the password, and found that most modems were wide open. I informated Sprint, and here was their response:

Thank you for your recent e-mail. I appreciate the opportunity to address your inquiry.

You have reached local password reset only. Please contact your local telephone company for further assistance.

We appreciate your business. If we can be of further assistance concerning
your Sprint service, please visit us at http://www.sprint.com, or you may email us at customer.servicenet@mail.sprint.com.

Aside from the total lack of security by default, and their insistance on routing everything from the Seattle area through Fort Worth, which is 100ms away on Sprintlink, they have been pretty good. :-/

Obligatory zero wing quote

[psi_diddy]

Captain: What happen ? Mechanic: Somebody set up us the Sprint DSL. Operator: We get no signal. Captain: What ! Cats: How are you gentlemen !! Cats: All your files are belong to us. Cats: HA HA HA HA ....

Why not use the serial number?

[teslatug]

Just set the password to the last 4 digits of the serial number of the modem. No need to remember, easy to find for the users, not so easy for the hackers.

Re:Why not use the serial number?

[KshGoddess]

Except that in my experience, the s/n and MAC address were identical. So much for your security plan...

Re:Why not use the serial number?

[Kenrod]

ANY 4 digit alpha-numeric password is trivial to crack.

Re:Why not use the serial number?

[LoveMuscle]

Except that in my experience, the s/n and MAC address were identical. So much for your security plan...

The MAC address isn't available off the local network segment, so this still works, unless the hacker is in your house.

Re:Why not use the serial number?

[Anonymous Coward]

Crap! My sn ends with 1234 .... now what??

I'm waiting for it...

[Anonymous Coward]

"Your /. discussion of security, and how to bypass it, on our modems is a violation of the Digital Millenium Copyright Act (DMCA). Please remove this discussion from your forums or we will be forced to take legal action."

I'm just waiting for this to show up.

Phoenix

Re:Unrelated, but much more serious security hole

[tupps]

Well there is this article... Remote Root Exploit in CVS http://developers.slashdot.org/article.pl?sid=03/0 1/21/1752251&mode=thread Posted three days ago.

Note that this is only a problem in routing mode

[harlows_monkeys]

Note that if you put the modem into bridging mode, you don't have this problem. Unfortunately, most people probably leave it in routing mode, because the modem then handles PPPoE and provides access to your computer via DHCP and NAT.

If you have PPPoE software on your OS, you can put the modem in bridging mode, and then it won't have an IP address, and so won't be remotely administratable from the WAN side. (It still takes 192.168.1.1 on the LAN side, so you can still administrate locally).

Surprisingly (at least, I was surprised...I had expected Sprint to be one of those providers that doesn't tell you much), on Sprint's support site, they have detailed instructions for switching to bridging mode, both for people with dynamic IP and those with static IP. (Look under the section on configuring for use with game consoles).

A strange loosening in my bowels...

[slarti]

as I gaze at my brand new ZyXEL Prestige 645 DSL bridge that arrived a mere two weeks ago with my DirectTV -> Speakeasy DSL transition.

and I wonder...

Re:A strange loosening in my bowels...

[Cyph]

Stop wondering. First off, Speakeasy ships their modems with telnet and FTP disabled, so there's no way to access it whether from the outside or the inside of your network. Second off, if someone does manage to get into your modem, it's going to be useless to them as Speakeasy does not use PPPoE, therefore they do not store any kind of user info in the modem.

For Sprint, this is a much bigger issue, as Sprint does store the user's e-mail address/password combo in the modem.

Re:A strange loosening in my bowels...

[slarti]

While they do ship their equipment with FTP and Telnet open (sorta, thanks NMAP) it doesn't feel like responding to requests.

Thanks for the info.

Re:A strange loosening in my bowels...

[Cyph]

The three Speakeasy ZyXEL's I dealt with required a manual reset before I could access the telnet/FTP interface.

Access from outside?

[maan]

I have one of these routers in Switzerland, and at least I changed the password to something slightly better... But I remember trying to access the administration interface from the outside, and I couldn't get in. I don't remember if there was a setting for allowing administrative access from the DSL interface, though.

So why are all these routers "vulnerable"? Mine isn't....

Maan

Re:Unrelated, but much more serious security hole

[dbCooper0]

...not yet :-)

Except you don't have the list of all their IPs

[Gorimek]

It's much easier for the company since they know all the IP addresses. You would have to figure them out in some much more tedious way.

They have messed up

[Neophytus]

Everyone is used to having their hub/router with a password on it, and in the manual one of the first things it says to change is the password. If a cable engineer installed a cable modem, though, I would not immidiately think 'oh this thing is gonna have a password' and rush off and change it. This is coming from a slashdot member - joe hardware-illiterate may not even realise that the darn thing has a password, let alone that the admin interface is publically accessable to anyone who wants to try their luck with 1234. I saw another post further up that said they didnt know it had an interface at all - this is worring.

Much ado about nothing

[twixel]

They don't mention that the telnet interface is by default only accessible from the inside of the network.

Interesting non-scientific Password Surevey

[Anonymous Coward]

Interestingly, we just conducted a non-scientific survey for a class project about passwords that people use. This included things like luggage, email, voicemail, etc., from your typical teenaged high schooler.

Results collected:

30% used 123 or abc equivalent depending on length*
19% used their name or combo (like JDoe or JohnD)
16% used a date or part of (not b-day)
9% used their birthday (or part of)
6% used their name backwards
5% used a pet name
15% other**

* 63% of the people who used 123(4) used it on their luggage.

** 3% of this other was something like "asdf" or "qwerty" or "jkl;" (presumably for computer related passwords). other also included stuff like phone numbers, names of other people, street addresses, and just some checked the box 'other' with no explanation.

100% used a xx-xx-xx type numerical combination for their lockers. not including those who jam theirs always open :p

Re:Interesting non-scientific Password Surevey

[antirename]

So, you did a "study" where you asked people for their passwords, and 97% just handed them over? In your conclusions, did you include the finding that "97 percent of those surveyed turned out to be complete and utter morons"? Now you know why Mitnick was able to pull off some of the shit he did, and why being an admin can royally suck ass at times.

Re:Interesting non-scientific Password Surevey

[Anonymous Coward]

Here's my contribution to your survey...

I use combinations of words from non-english languages conjoined by a number or special character (e.g., the ' or ~ or | keys).

Even when I TELL people my passwords, they can't remember them... because they aren't polyglots. :)

--A. Coward

Re:Not Sprint's fault... (RTFA)

[Anonymous Coward]

From the article:

Tigges admitted that Sprint does not provide instructions for resetting the administrative password in the documentation provided to FastConnect customers.

Now, who's fault isn't it again?

Re:Oh No!

[Greedo]

Isn't it great how the second post can be modded redundant?

When are they going to learn?

[TerryAtWork]

People NEVER, as a group, take that extra step.

They ALWAYS take the dumb, easy way. How do you think Bill Gates made all his money?

Re:When are they going to learn?

[baryon351]

Argh. Agreed here, people will stop at whichever step is the easiest.

When I was working a helpdesk, we had a 4-step process for installing one particular piece of software, which involved:

1. downloading
2. doubleclicking a package
3. selecting an update option
4. restarting windows.

invariably, steps 1 and 2 would be completed, and since the software was then installed and sitting on the desktop, users jump into their play mode and steps 3 and 4 were ignored entirely. some days it seemed 90% of problems were directly related to not running the update option (which then prompted a restart anyway)

All of this despite the instructions with red writing clearly saying ALL FOUR STEPS MUST BE RUN.

Of course, with a slightly better installer step 2 would start the prompting to step 3, instead of needing user interaction, which would be far more reliable than trusting a user to read instructions - which is the point I suppose.

Not Zyxel's fault

[Doogman]

I'm using a Zyxel 645r router supplied by my local mom & pop DSL provider. Sprint provides the DSL connection but they are my internet provider. Yes they did change the default password and they even support Linux, but I'm digressing.

As the router ships from Zyxel, it has a filter disabling Telnet access from the WAN (internet). So even if you did have my router's password, you couldn't just telnet into it and get all the PPPoE data.

So did Sprint disable the filter and not change the password? That would be rather strange...

Yeah...but is it encrypted?

[Newer Guy]

If it is, you just violated the DMCA by publishing an encrypted password. Off to jail for you can be as easy as: 1-2-3-4.

I wonder...

[kaoshin]

what percentage of those people changed the password TO 1234 at some point, but that it just happens to also be the default.

Linksys has a similar problem

[Drakonian]

Linksys has similarly easy password in their Gateways/Routers/Firewalls. No username and password is "admin". These routers are configurable remotely too - thank god that feature is off by default. I seem to recall them having a serious overflow bug too that would allow exploitation anyway.

This is nothing new

[estate]

Use of the default password has been going on since time immemorial. Apparently Richard Feynmann who worked on the Manhatten Project (which developped the first atom bomb) had a reputation as an expert safecracker because very few people on the project changed the combination of the safes from the way it had been programmed at the factory.

Perhaps the problem arises because we have so many passwords to remember. My solution is to have one password for most of my accounts, which I share with nobody. This led to a nasty family argument, when I refused to tell my passwword to my daughter so that she could logon to my linux box at home. That was solved by giving her an account of her own.

Another possibility is that most people are simply unaware of the need for security. I got a taste of this when I taught an introductory course on Unix to a group at one company who shared files with each other. When I asked how they did it, they told me that each one of them posted a little yellow sticky with their userid and password on their monitors so whoever had to could simply log on as them!!

Re:This is nothing new

[wcbarksdale]

My solution is to have one password for most of my accounts, which I share with nobody.

This is a pretty bad idea for anything with a security level you actually care about, because if one password is cracked (which can come about through a variety of ways) all of them are.

Re:This is nothing new

[varjag]

Perhaps the problem arises because we have so many passwords to remember. My solution is to have one password for most of my accounts, which I share with nobody.

FWIW, my solution is to use a unique password per account, and store them with KeyRing on my Palm. It has flexible password generator, Linux desktop conduit and it stores its database with 3DES-encryption. ATM I have about 70 different passwords to various accounts, and have no problems managing them.

It saved me from lots of trouble when Sourceforge password database was compromised.

Provisioning and diagnostics

[TheConfusedOne]

Obviously the Sprint techs would need to be able to access this box remotely so they would need those interfaces open. Additionally if they're like cable modems then there is some provisioning software d/l's that may go on occasionally.

There are definitely ways that they could improve that like using certs and trusted IP ranges, but they probably went for the easiest route instead.

Re:Provisioning and diagnostics

[StormRider01]

But if the customer is supposed to change the password, how would sprint know?

Re:Provisioning and diagnostics

[TheConfusedOne]

I think this more relates to TFTP and boot-up protocols. Maybe there's another account besides admin on the thing too. (It's probably set to 5678. :-D)

Windows 2000 site goes over two years without a re

[Anonymous Coward]

Windows 2000 site goes over two years without a reboot
This month is the first time that a Windows 2000 site has appeared in the 50 top sites which have the longest period of time since last reboot. www.byteandswitch.com has been running continuously since November 2000. When we first started graphing web servers uptime in the summer of 2000, many people were skeptical that a Windows machine would ever make the top 50. Perceptions change, and although two years is exceptional, several Windows 2000 sites have run for more than a year without a reboot. In the hosting industry, Microsoft partners Interliant and Divine each have sites that have not been rebooted in over a year, while Microsoft has also run several of its own sites for over a year between reboots.
-- These MS sites have to be prime targets for crackers. --

1234 on Zyxel... doh it's old old news

[Erik_]

All Zyxel mode/routers being shipped in my country come with a red warning page explaining that the first thing to do one the user is connected is to change the password of their modem/router.

Covad

[Anonymous Coward]

Covad uses modems by the same manufacturer with the same default password.

Re:Unrelated, but much more serious security hole

[Anonymous Coward]

waaahhh! I made an ass out of myself and someone noticed!
Suck it up.
You attacked Slashdot with your post, which was without fact. If you're so concerned about Slashdot noticing things, then shouldn't you hold yourself to the same standards and at least do a keyword search to see if there WAS an article before assuming that there wasn't? That's like whining because the newspapers only ran a story once. I can't even remember the last time I saw the same (print) publication run a story twice.

What about fujitsu speed port modems????

[Nonillion]

I have a fujitsu speed port modem, do these have the same problem????

Sprint Install Techs say "no need"

[Lockster]

I just had Spring DSL installed at my house YESTERDAY. I asked the tech about login info, user manual, etc for the Zyxel modem so I could get in & configure it, change admin logins, etc - his response was, "Oh, you don't need to do that, it's preconfigured already." So apparently their techs don't believe there's a need to secure them??

Greaaaaaaaaat.

Terms of Service

[nosphalot]

Has anyone bothered to check the Terms of Service for Sprint's DSL? Chances are changing settings on the modem is against them. Every time I've read one of these there is always a provision against modifing settings, prime examples being caps on cable modems. The fact that they are trying to pin this on the user is yet another instance of corporations wanting to be paid for a service that they will only provide when forced to do so, and then poorly.

My ZyXEL 600 had this problem...

[VValdo]

First thing I did with my ZyXEL Prestige 600 is change that damned default password.

To do this, at least on my 600:

1. Telnet in (make sure you have vt100). On my LAN, the Zyxel is set at 192.168.1.1 -- I don't know how Sprint has it.
2. Use the default 1234 password, and then hit return to log in.
3. At the menu, type "23" and return. 23 is the option for the "System Password" page.
4. Now type the old and new password (twice) using the TAB key to skip fields. Don't pick something obvious.
5. Go down to where it says "Enter here to CONFIRM or ESC to CANCEL" and hit ENTER/RETURN to save your new password. (You may be asked to confirm that you want to do this.)
6. When you get back to the main menu, exit your telnet session by typing "99".
7. Try telnetting in again using 1234 and make sure it doesn't work. Now try to use your new password.
8. Profit.

I'm guessing that if these aren't the exact instructions for the later Prestiges, it'll be pretty close.

Even better than changing passwords is to disable remote login from outside the local network. (I hear this is the default on new Prestige modems). Or, depending on how insecure your LAN is, you can assign particular IPs permission to get in and block all others. This is accomplished using a "filter", just like a w/ a firewall.

To block incoming telnet sessions on the WAN, check out this page. This page also offers a "probe" you can use to discover vulnerable modems.

Finally, check this list for common default passwords. This is an important page, so check it for any equipment you might be using.

W

You can't fix STUPID

[ic3scrap3r]

Come on, leaving the default passwords on ANYTHING connected to your PC....You are STUPID and deserve what will inevitably happen.

My ZyXEL 645

[Anonymous Coward]

I noticed it had telnet disabled, and ssh enabled. I couldn't even hit SSH locally or from the Internet. I had to do it from one of my ISP's internal IPs (they have a shell box.)

Back up a minute...

[Anonymous Coward]

Why are these devices accepting admin connections from the WAN port by default. That's just plain nuts!

It's a good thing...

[SCHecklerX]

...that although Sprint provides my physical DSL, I actually use a different ISP. I bought a 'dumb' modem from ebay, and am very glad I did. Web interface for a simple bridge? No thanks.

I have one of those

[katsushiro]

The local DSL monopoly here in Puerto Rico, (PRTCDSL) uses those same modems. I got them pretty early on, and, indeed, the modem was set to 1234. First thing I did was change that to as long and complex a password as I could, especially after I relazied that I could basically go into any other DSL user's Zyxel and not only find out their username and email, but change their internal modem settings, so that, for example, all their ports were blocked, their DNS numbers were wrong, and basically just make their connection unusable. I also urged all my acquaintances who had the service to switch their passwords. nealry 2 years later, PRTCDSL is finally changing this.. the modems now arrive preconfigured with a password that they don't tell their clients. It's pretty much a very closely kept secret inside the company, they don't tell it to anyone. If you want to change any of your DSL settings, you have to call their Tech Support nd have someone do it for you. However, I'm pretty sure that it's the same 'secret' password on *all* the new modems.. so, if someone finds out what that password is and lets it spread, we'll have the same problem as before, except worse, because the home users won't be able to go in and change the passwords themselves'cause they're locked out.

Re:I have one of those

[flowerp]

If you really want to know that "secret"
password, try soldering out the EEPROM
or FLASH chip on the modem, read it out
with an interface and scan the resulting
hexdump for the password.

I doubt the modem stores a hash of the password
only. My bet is that you will find it as
plaintext.

Afterwards you can solder that eeprom back
in place and hope the modem still works ;)

Smoking?

[Bios_Hakr]

What are you smoking....and can I have some?

Disclaimer: I work with Cisco equipment most of the time. I also have worked with long-haul telecommunications gear like Fore Systems ATM, ADNX/Promina, and other gear.

First, having a 'master code' would be dumb. The master code would get out quickly and then you would have people shutting down equipment remotely. Even having a password based on the serial number of a specific peice of equipment would create a logistical nightmare.

Most of the equipment I have seen has a console port and a reset switch. If you reboot the equipment, you have about 15 to 30 seconds where you can drop in a break code. The break code will not clear the memory, but it does boot in a clean mode where you can reset passwords or make config changes.

Re:Smoking?

[vsync64]

First, having a 'master code' would be dumb. The master code would get out quickly and then you would have people shutting down equipment remotely. Even having a password based on the serial number of a specific peice of equipment would create a logistical nightmare.

Well, I'm 99% sure your parent isn't talking about a "master code". As far as the "logistical nightmare", Honda did it with the stereo in my car ('95 Civic EX Coupe). There's a code burned into the stereo's ROM. If the power is disconnected, as I did today, you have to re-enter the code. Since I bought it used, I had to Google to find out they usually stick a white card with the code in the glovebox. If I didn't have it, though, I would just have to call Honda and have them look it up.

Now, if the code is generated from the serial number (which it might be, because there is a Web site that tries to charge $24.95 to get it for you; I don't know if they generate the code or call Honda for you), that would be bad in terms of preventing stereo theft. I'm hoping it's randomly generated and just stored in a big database somewhere. For routers it might not be so bad, though, because without the password how are you going to get the serial number anyway? (Social engineering? Anyone who will read the router's serial number to a random caller will probably give them any passwords they have anyway...)

Re:Smoking?

[42forty-two42]

Use a public-key scheme. Take the serial number, encrypt it with $privatekey, have the phone decode it. As long as the private key dosen't get out and someone dosen't brute-force it (possible with the length of numbers the user is likely to enter), you're fine.

Sprint, firewall it

[loncarevic]

Ok, there is default password on ZyXEL *DSL equipment, but in order to access ZyXEL device you need telnet access to it (or SNMP).

SPRINT should firewall outgoing telnet connections to their DSL customers with ZyXEL and end of story.

Last time I checked, those ZyXEL devices had no SSH port enabled :).

Re:Sprint, firewall it

[Vanguard(DC)]

that is perhaps the WORST security advice i have ever seen.

so you want them to cut off my entire ability to telnet into my home boxes?

ach. Fix the problem without creating new and larger ones...

GIVE EACH NEW CUSTOMER A SHEET OF PAPER THAT SAYS IN 48 POINT TYPE: "CHANGE YOUR DAMN PASSWORD AND HERE IS HOW..." or better yet, have ZyXEL get off their asses and set a custom password on every new modem with eable a removable sticker telling the customer how to change it upon installation...

-vanguard

keeping their eye on you?

[brer_rabbit]

how exactly do you come to the conclusion that your ISP was "keeping an eye on you"? I mean, what evidence did you see...

% wget http://some.site.out.there/foo
--15:23:09-- http://some.site.out.there/
=> `foo'
Connecting to 1.2.3.4:80... connected!
HTTP request sent, awaiting response... 200 OK
Length: 666 [text/html]

0K -> .....we... ...are.... .watching. ..you..... [100%]

Re:Unrelated, but much more serious security hole

[Anonymous Coward]

Hahaha.... the 0wner got 0wned.... Anyway, keep trying :) Style of the troll was good, research is just the easy work, you will get there!

Except you don�t have nmap

[dark-br]

nmap -sP xxx.yyy.*.*

Voila! A loooot of IP address to play with...

Ugh...

[goatasaur]

Why did parent get modded as "Troll"?

Giving the same default password to all your customers and then not forcing them to change it, not even showing them how to change it, is ignorant and careless. A company that has been in the tech business as long as Sprint should have known this.

Re:Not Zyxel's fault

[awx]

So who is you local mom&pop DSL provider? C'mon, give a good company some publicity here! I'm in the UK, makes no difference to me but I just like to see smal companies given a chance....

My former DSL ISP was even more stupid

[dbc]

They refused to let customers have the DSL modem password, so that they wouldn't screw it up. While waiting on hold for oh, about 3 hours, to get a tech to fix one of their screw ups, I downloaded the manual. I figured out how to fix the problem, and then, just for grins, tried the factory password. It worked. I fixed the problem. About that time the tech answered. I told him how I fixed the problem. He asked me not to change the password, as it was their policy to leave them *all* at the factory default so that they could easily acess them. They had actually thought about the problem, and made an active management decision to require fsck'ed up security. Sheesh.

Actually....

[Anonymous Coward]

I had one of those modems when I tried to set up my earthlink dsl I used to have. (Went with verizon because earthlink couldn't get their sh*t together over several months...) It had the exact same default password...but the interesting thing was how earthlink dealt with me. I telnetted into my modem a number of times to try to see what was going wrong with my connection etc., and went I told the tech support people about it they griped at me as I apparently wasn't supposed to do that...when that is the only way to change the PW. (And the modem comes with instructions in REALLY fine print that tells you how to do it.)

Pretty crappy.

saw it already

[Anonymous Coward]

i saw this almost 2 weeks ago with cayman dsl routers at http://www.pivx.com/kristovich/adv/mk003/

seems to be about the same thing

Sad

[James Littiebrant]

This is the sadest thing i have ever heard of in the security world. I would expect at least a password that is different for each modem. I do not know how Sprint overlooked this but lets hope it does not happen again.

It wouldn't take very long to crack.

[Mustang Matt]

4 numerical digits... So it would take 9999 tries to guess the password?

That's not very secure if you ask me.

Re:It wouldn't take very long to crack.

[westphalia999]

Well, its a heck of a lot better than _1_ try.

Re:It wouldn't take very long to crack.

[Anonymous Coward]

Actually there are 10,000 possibilities, but statistically, it would take on average 5,000 guesses if they try sequentially and the codes are random.

Who cares what you said?

[jasonrocks]

I know this is flaimbait, but any security breach could be a serious problem, social engineering or not.

Damned if we do...

[gizmonic]

...damned if we don't!

So, let me get this straight. If I do not access my DSL/Cablemodem and change the settings, it's my fault for having a unsecure system. Yet, if I do access my DSL/Cablemodem and change the settings, I can expect the FBI to come barreling through my front door with guns drawn?

Nice.

I remember when society used to have common sense. I miss those days.

How we asked

[Anonymous Coward]

No, actually we handed out papers with check boxes on them and asked people to check what kind of passwords they use. Like, for email do you use ()1234, ()your name, ()pet's name, ()other. We had many options as to not influence or make people settle for a "best fit answer". Like that is how we did it. I forget exactally the details, my partner did the questionaire. It was also anonymous and people turned the papers into a box so you couldn't tell who submitted what.

Come on, we aren't that stupid. If we asked:

Name ______________
Email password _____________

Who really would have responded? I may be in high school and that makes you feel superior, but I am not that dumb. And neither are the people we surveyed. I think that you would find the average high schooler more computer (and password) savy than the average person Mr. Mitnick queried.

Re:How we asked

[antirename]

No, I don't feel at all superior because you're in high school. I guess I misinterpreted the results of your study, as far as individual identification goes. Didn't mean to imply that you were up to something, just making a joke about the cluelessness (is that even a word... it should be) of the average user. Good job, man.... reminds me of the things I used to do to piss off my teachers and professors :)

And in other news...

[Hanji]

99% of owners of linksys routers haven't changed the password away from 'admin'.
99% of owners of wireless networks haven't bothered to add any sort of access control.

What else is new?

Surely You're Joking, Mr. Estate!.

[/Idiot\]

Why is it that people always say "Richard Feynmann, on of the guys on the Manhatten Project"?

I propose we say instead:
"Richard Feynmann, a guy who achieved much more than working on the Manhatten Project"

- or just ignore me.

Re:Surely You're Joking, Mr. Estate!.

[Anonymous Coward]

I'm not joking, and don't call me Shirley.

Sprint waits for the worse to happen

[m0i]

According to a bugtraq post, uploading a dummy rom file with a valid size will automatically render the box unusable (reboots itself, can't do anything but upload a new valid firmware thru serial port using x-modem).
Now, some script kiddie will do a massive DoS against the users, and some Sprint sysadmin will go nuts discovering the whole mess they're now in.
G'd luck to the QA department overthere.

Re:Sprint waits for the worse to happen

[Vanguard(DC)]

not going to happen unless that kiddie is well versed in spoofing the source of the rom. for most cable and dsl providers, they send the rom's down to the modem on the initial handshake, and it is from a specific source (server). in order to deliver a dummy rom, that server must be spoofed. (man in the middle attack). SO, that said, the likelihood of a mass DoS attack is slim. it may be POSSIBLE, just not likely.

Doing this yourself is actually one way to hack your modem to turn bandwidth throttling off... check bugtraq archives.

-vanguard

even netgear does this

[ppetrakis]

on their consumer routers. admin/1234. If you dont change it, its your ass.

Peter

Re:Hey!

[Anonymous Coward]

Yeah, I feel sorry for you, since the only way you can really be safe from nested posting is to get first post, but even then you might get a -1 redundant score!

It's not just Sprint who uses these modems.

[Xii]

I have Earthlink DSL which came with a ZyXEL 645m and after seeing this story I checked my modem. For over a year I've had the combination to the air supply on Princess Vespa's planet as the password for my modem. How was I supposed to know there was even one to begin with? None of my other modems have ever had one (phone, cable or DSL). I guess next time I'll RTFM a little more closely.

Lots of devices have the same problem!

[dont_stand_so_close_]

Well check out This website for many common passwords..

From the site:

"NOTE: This listing is only provided as a resource to network administrators and security professionals. It is also meant to remind people that a serious problem exists when people configure a network or a computer system and do not change these passwords. The manufacturers of the listed devices, software or systems are not to blame for this problem, and we are not trying to discredit them or their products. A default login is a means for an end user of a product to complete the initial setup of the device or system. Most manufacturers strongly recommend their end users change these logins and passwords for security reasons."

Sprint Posted Instructions

[BMcWilliams]

Sprint posted at its DSL support site today some instructions on how to disable remote management in the ZyXel P645 modem. They are available in PDF here

In a nutshell, they instruct you to use the unit's system management software to turn on some filters that block incoming port 80, 21, 23, and 69.

This was funny

[Anonymous Coward]

Really securing these routers was the responsibility of the people who bought them from Sprint. That said I am sure Sprint did nothing to advise these people of the importance of changing their passwords to something secure. Generally anything vaguely technical or security related is hard to get past an ISP's marketing division. They believe such information scares away potential customers.

I have to say...

[FauxPasIII]

That's the funniest post I've ever read with a subject of "Shit".

are Fujitsu DSL modems vulnerable?

[redacedude]

I've got a Fujitsu DSL modem. Not even aware if there is an admin interface to it. Anyone know?

not the telco's in all cases

[swschrad]

unless you are using MSN on a qwest line, you have to buy the cpe from them. you can't get out of it. if you have a closet full of 678 dsl modems from past hookups, they will be sending out the current intel or actiontec unit if it looks in the records like a new install. no way out. it will be on your next bill.

you have to read ALL the small print, or hassle the sales person until you get the information, no matter what service you're getting.

Duh?

[LogicFlow]

I changed the password the first day I got my 642M, a little over a year ago. A quick search on google provided the password.
And this may be of intrest. Not too long ago I switched to a static IP, but it wouldn't work.
Trying the provided software, and updates, on a Windows box, and it *still* wouldn't work.
After days of talking to the tech support monkeys one finally suggested removing all the software are simply setting it as the proxy.
This didn't work, either.
What I had to do was log in, and access a *hidden* menu, to set up a static bridge.
When you start off with a static, it's pre configed would be my best guess.
I couldn't find anything about on Sprints site, Earthlinks, or Zyxels, and the tech support drones didn't believe me. Thank goodness I had been curious beforehand.
Just log in, and try random menu numbers, there's 4-5 IIRC.

Re:Duh?

[LogicFlow]

Oh, and by the way.
If you actually bother to log in and check,
at least the 642M has access control lists too.

It really is a nifty piece of equipment, it's just crappy defaults and accepting masses.

default password

[Anonymous Coward]

1234 has been the default password on every piece of zyxel equipment i have worked with/used/0wned.
I once had an account with ISP image.dk (later worldonline.dk, now tiscali.dk) and they supplied zyxel equipment themselves, you could scan their entire IP range and log into hundreds of ISDN routers with the password 1234. easy as 1234 indeed!

Go to jail

[CaptainZapp]

don't pass start, don't collect 200$.

"System/manager" is one of the default accounts. [...] another is "sys/change_on_install"

You where just caught redhanded by providing instructions to circumvent security measures on a device...

(I hope the humor impared get it...)

Completely Sprint's fault on many accounts

[boarder]

Firstly, I use Covad as my DSL provider and I have the CPE that is mentioned (645). The difference is that Covad was smart enough to ship the 645M which is hardwired as bridge only and not as a router. The 645R is the router version (not mentioned in the Wired article and not even denoted on the hardware itself). The router that Covad sends its business and SOHO customers is configured better and comes with better docs.

Secondly, Sprint didn't include documentation on how to change the password (or even tell you to change it). They sent out a router to ALL of their customers when a bridge is sufficient, AND they didn't include documentation to help those people for whom a full router is overkill.

I think they should be a little more interested in their customer by at least providing docs, if not actually understanding their customer's needs.

Re:Completely Sprint's fault on many accounts

[gene_tailor]

Thanks for the info. I was just sitting here staring at my Covad DSL modem which sez "645" on the bottom and trying to decide if I needed to take action, but it sounds like I'm safe on this particular SNAFU.

whoops, forgot to mention

[boarder]

in bridge only mode, the 645 can't be telnetted into at all. so the bridge mode (which can be set on the router version) is safe regardless of passwords.

duh

[astrotek]

and at cox.net (cable) formly @home the default password for all email and web services is password

its not like this type of stuff is uncommon.

dsl modem

[Anonymous Coward]

when i had my dsl from qwest/msn i had sum crappy arescom modem the most u could do with it is see your ip network ip and connection stats and u could only access it from your local/networked pc. there was no security risk since there was no way to login to the modem only risk was nonupdated os / no firewall

Re:Unrelated, but much more serious security hole

[Anonymous Coward]

Read it here if you're too impatient to wait for the dupe.

Re:Unrelated, but much more serious security hole

[Anonymous Coward]

Read it here if you're too impatient to wait for the dupe.

Re:Unrelated, but much more serious security hole

[Anonymous Coward]

Read it here if you're too impatient to wait for the dupe.

Re:Unrelated, but much more serious security hole

[Anonymous Coward]

Read it here if you're too impatient to wait for the dupe.

Passwords are the PROBLEM

[skatedog]

IMHO the dependence on passwords, any password, even the 8+ character, alphanumeric and special character passwords never written never given out to anyone under threat of death are NOT the best way to secure ANYTHING! I thought the /. crowd would at least have more well-thought ideas like some smart card technology. RSA SecurID has some good products, we use their keyfobs that have a randomly generated 6-digit number that is used in conjunction with a 4-digit PIN and while this isn't perfect and is not "free" (like traditional passwords) we are very confident in the protection of our data. Isn't anyone working on an inexpensive SMart Card or embedded Proximity Card that we can slip under our fingernails? Come on /.'ers!

Re:Unrelated, but much more serious security hole

[Anonymous Coward]

Troll, no, flamebait maybe, but if the poster the comment was for wasn't such a /. bashing ass it would have never been needed.

obligatory

[Anonymous Coward]

all your modem are belong to us!

You have to remember...

[Anonymous Coward]

The moderation system is for the sole benefit of the reader, not the poster, so the effect on a poster's karma is not taken into account when moderating a post.

Re:Not Sprint's fault... (RTFA)

[Anonymous Coward]

Now, who's fault isn't it again?

The owners.

Re:Unrelated, but much more serious security hole

[Anonymous Coward]

Whoa - who has all the mod points anyway? Every post in this thread got modded down... Anyone who would bother to look would notice the posting times on the replies were all so close that probably nobody replying even realized that somebody else was already in the process of doing the same. Time to do some metamoderation - I'm sure I'll hit at least one of these mods...

Perhaps the reason you got 13 replies in 10 minutes was because it was obvious to any regular /. reader that your posting was factually incorrect?

Re:Not Zyxel's fault

[euskodiac]

Why would Sprint change the defualt factory settings of the BIOS? To my knowledge the Zyxel 645R comes with remote mgmt already disabled. At least that is how my Sprint modem came configured. Second, who would not change their password as soon as configed? Then again how many wireless routers can we get access on?

Well, damn now I have to change my password

[toolafial]

There are just too many passwords to keep track of. Hell, I even forgot that my password to my DSL modem was 1234. But, to all you script kiddies I changed my password so don't even come poking around where you are definatly not wanted.

legislation!

[bingbong]

if congress were to provide legislation that ensure that tech companies have the same liability and accountability as most other industries - they would actually put some effort in prevention.

Consider that someone sues macdonalds successfully for the hot coffee they ordered burning them, yet if you use technology and get totally burned, it's your own fault.

something is awry in the legal system

Sprint can fix this easy and fast

[dspisak]

About a year and a half ago I started working for a DSL ISP that shall remain unnamed. Well, on my first day their they were having problems with customers going dark because someone was systematically hacking into the DSL routers at the customer premises and trashing the configs on them so no one could remote into them any more.

Of course that was possible because the morons at this company had the same manufacturer default password on all their customer DSL routers.

The solution? Some quick Expect script writing skill and a little perl and I had a script that walked every customer router, logged in, changed the password (different one for EACH customer, kept in a MySQL database for support to lookup). Took about 5 hours for the script to run its course locking down all the remaining vulnerable customers.

Of course I doubt anyone at that part of Sprint even has ever heard of Expect scripting so they probably see themselves as hopelessly screwed and unable to affect such a huge change quickly.

Said the man with nearly 2000 comments

[Anonymous Coward]

You do know, judging by your uid, that probably equates to about 2.3 posts per day, every day since your account was created. Yep, I'd better back away from the computer. Veeeeerrrryyy slowly. Man, you look dumb. At least this thread appears to have gotten bitchslapped. That's exciting.