Slashdot Mirror
Sprint DSL's Security Hole Easy As 1,2,3,4
An Anonymous reader points to this Wired article, excerpting "Sprint officials acknowledged that remote access to the administrative software embedded in the ZyXel Prestige 642 and 645 modems is by default protected with a password of '1234.' But the company said users are responsible for securing the equipment, which stores login data, including the user's e-mail address and password." Wired found that more than 90% of the modems they polled were using that default password.
The biggest security hole is not buffer overflows, ICMP packet manipulation, or poorly written software.
The easiest security breaches are to be had via social engineering, such as human manipulation and simple password guesses such as the default password for a certain system.
You can have all the conferences on security and corporate code reviews you want, but people will always be stupid. You can't change that.
Reply or e-mail; don't vaguely moderate. Ex-O'Reilly/MIT employee, now a full-time Google employee.
As much as I don't like Sprint, it's not their fault that people aren't changing the default password. If people don't change it, it's their own fault if they get burned.
How does it really matter what the default password was? If the default password was -8*k|-- it would still be just as easy to gain access to. The flaw is in not requiring the user to change it.
Whale
Tigges admitted that Sprint does not provide instructions for resetting the administrative password in the documentation provided to FastConnect customers.
They recommend you change it, but don't mention how? (It is listed in the modem manual, which is apparently not provided by Sprint.)
Oh, even better... In February they plan on shipping modems with this disabled. In February. Not now.
This has been around for a while. I wonder how many users have actually been affected.
Why is it that ppl will spend a fortune securing their homes and cars and leave their computers wide open? Unfortunatly all these stories wind up on the tech sites but Joe six pack only reads the sports section of the newspaper.
Ok, so would you rather have wired not tell you that your modem is unprotected? If I were a sprint user, I would not be mad at wired, I would be pleased. I'd rather have wired hack my modem and tell me about it than some random script kiddie hack it and break into my email account.
Jobless, and too smart for my own good, i'm tempted to try and find some routers. Just tempted, I never do bad stuff like comprimise others networks.
Why didn't sprint fix this quietly and quickly though? It seems to me it would have been easy just to write a script to go to each modem, change the password to something random, store it somewhere safe like a customer info database and been done with it.
Now that it's been published on wired, and worse yet here, the exploit is going to be used by many people who want to just break in because they are "bored"
As someone who just (10 seconds ago) changed the default password on their DSL router, I'm actually rather surprised. I had assumed (wrongly, I guess) that the routers would only allow telnet sessions from IP addresses that it manages (via NAT i.e 192.68.x.x..).
Wouldn't this be a lot easier and safer for the average user if it were implemented in the firmware? For 99% of DSL users, what possible use is there of having the router configurable from the 'net?
But remember, if they can do it, so can any script kiddie by polling blocks of ip addresses. Lock out both sprint and the user :-)
Your security is only as good as your dumbest user.
A buddy of mine and I have been uttering those words for years.
I don't care what their intentions are. If they logged into one of my devices I would do all I could to dig up a law they could be prosecuted under and I'd make sure all the proper Federal agencies got wind of it. I did NOT give them permission to access my network. It would have been suficient to take Sprint's word for it and post the story. There was no need to go snooping where they don't belong.
Well, you make it so they HAVE to change the password to gain internet connectivity This comes from a security paranoid linux user who also likes OpenBSD
If you have PPPoE software on your OS, you can put the modem in bridging mode, and then it won't have an IP address, and so won't be remotely administratable from the WAN side. (It still takes 192.168.1.1 on the LAN side, so you can still administrate locally).
Surprisingly (at least, I was surprised...I had expected Sprint to be one of those providers that doesn't tell you much), on Sprint's support site, they have detailed instructions for switching to bridging mode, both for people with dynamic IP and those with static IP. (Look under the section on configuring for use with game consoles).
I hate to inform you, but the outlook holes are Microsoft's fault! They are the ones who programmed the executable handlers to not check what type of file was there (whether it be an exe posing as a pif file, or a screensaver).
You think that I'm crazy, you should see this guy!
I'm using a Zyxel 645r router supplied by my local mom & pop DSL provider. Sprint provides the DSL connection but they are my internet provider. Yes they did change the default password and they even support Linux, but I'm digressing.
As the router ships from Zyxel, it has a filter disabling Telnet access from the WAN (internet). So even if you did have my router's password, you couldn't just telnet into it and get all the PPPoE data.
So did Sprint disable the filter and not change the password? That would be rather strange...
Linksys has similarly easy password in their Gateways/Routers/Firewalls. No username and password is "admin". These routers are configurable remotely too - thank god that feature is off by default. I seem to recall them having a serious overflow bug too that would allow exploitation anyway.
Random is the New Order.
Portscanning isn't illegal, per se. It's like loitering. It's not illegal unless theres a sign that says 'no loitering'.
:)
It's not illegal, and I adamantly support people's right to portscan people. However, a better analogy would be if the loitering was being done late at night in a neighborhood that was victim to a number of break-ins at night: It's not illegal, and there could be *entirely* legitimate reasons for doing it, but it's obviously going to look like you're trying to break in. (Off-topic: You can't really hang a "No portscannning" sign on your server)
What Wired did was either (depending on how you interpret the phrase "polled"):
- tried logging into people's routers with this password (blatant 'cracking')
- sent out a "poll" (as in a Slashdot Poll) to its readers asking Sprint customers to check their router and report back to Wired
In one case, I'd like to see more outrage, dropped subscriptions, and police involvement -- the fact that they're a respected magazine in no way gives them the attempt to try to crack routers en masse. On the other hand, if it's the second type of "poll," we're making a massive deal out of nothing.
________________________________________________
suwain_2
What are you smoking....and can I have some?
Disclaimer: I work with Cisco equipment most of the time. I also have worked with long-haul telecommunications gear like Fore Systems ATM, ADNX/Promina, and other gear.
First, having a 'master code' would be dumb. The master code would get out quickly and then you would have people shutting down equipment remotely. Even having a password based on the serial number of a specific peice of equipment would create a logistical nightmare.
Most of the equipment I have seen has a console port and a reset switch. If you reboot the equipment, you have about 15 to 30 seconds where you can drop in a break code. The break code will not clear the memory, but it does boot in a clean mode where you can reset passwords or make config changes.
I'd rather you do it wrong, than for me to have to do it at all.
...damned if we don't!
So, let me get this straight. If I do not access my DSL/Cablemodem and change the settings, it's my fault for having a unsecure system. Yet, if I do access my DSL/Cablemodem and change the settings, I can expect the FBI to come barreling through my front door with guns drawn?
Nice.
I remember when society used to have common sense. I miss those days.
WWJD?
JWRTFM!
Why is it that people always say "Richard Feynmann, on of the guys on the Manhatten Project"?
I propose we say instead:
"Richard Feynmann, a guy who achieved much more than working on the Manhatten Project"
- or just ignore me.