Slashdot Mirror
Convicted VoIP Hacker Robert Moore Speaks
An anonymous reader writes "Convicted hacker Robert Moore, who will report to federal prison this week, gives his version of 'How I Did It' to InformationWeek. Breaking into 15 telecom companies and hundreds of corporations was so easy because most routers are configured with default passwords. "It's so easy a caveman can do it," Moore said. He scanned more than 6 million computers just between June and October of 2005, running 6 million scans on AT&T's network alone. 'You would not believe the number of routers that had "admin" or "Cisco0" as passwords on them,' Moore said. 'We could get full access to a Cisco box with enabled access so you can do whatever you want to the box. We also targeted Mera, a Web-based switch. It turns any computer basically into a switch so you could do the calls through it. We found the default password for it. We would take that and I'd write a scanner for Mera boxes and we'd run the password against it to try to log in, and basically we could get in almost every time. Then we'd have all sorts of information, basically the whole database, right at our fingertips.'"
It doesn't seem too hard to ship the routers with random passwords. Is it just cheaper to not bother? Just thinking here...
- They must run a test suite before shipping them so it should be easy to make that tool generate a random password and assign it to the router
- You would have to print it on the router, or on a slip of paper
- If it is printed on the router itself then you could make the router's reset button go back to that password, instead of Cisco0.
Even if you don't implement that last bullet, it still seems like it would help a lot.
What ever happened to the supercool hacking-thang called "not getting caught"?
/.
Oh like that'll get you a book deal and job in the computer security field.
If you don't get caught you'll never even merit an article on
Why would they care, if it just works?
I think I had 5 routers in my neighborhood on channel 6, with default passwords.
I logged on into each and switched them to different channels.
Nouvelles de jeux et technologies en français. TC
The weakest link is often the user: leaving the default password of a router,
Are you sure it's the user?
So, let me ask you this - why is the default password on routers all the same? Why isn't it different for each unit, and imprinted on the box or something? Such a trivial thing to do, yet it would do so, so much for improving security, and would have a trivial effect on usability.
Routers are security devices. Other security devices (such as bike locks) have the default being rather secure, why can't routers?
I have no problem with your religion until you decide it's reason to deprive others of the truth.
why is he going to prison? why don't make him like a password administrator or something where he finds all the default passwords( seems like he had the time back then) and ask those owners to change them? and of course got paid for that. like that what's-his-name guy in the 'catch me if you can' movie..
"Two things are infinite: the universe and human stupidity; and I'm not sure about the universe."
Even if we try to do the RIGHT thing, we end up punished and bashed for 'doing wrong stuff', when you're dealing with a bunch of joe averages [specially one being your boss], sometimes it's better just watch it crash down and burn than to try to fix/warn the bosses about a potential security breach.
:)
i used to work as a cybercafe admin in a hotel [ClubMed(R)] and someday, when i was messing with the routers telnet interface, i decided to do a quick check on the pdf manual i had about it and look for the default password,i input the default username and password and bam, got in.... all free for me to change, as it was a leased line, i could give real internet ips to inside machines by just specifying ip+mac, could reflash the whole thing, could destroy it... instead... i've prepared a paper describing the security risks of leaving the main hotel's router [the one that serves both the guests internet access and the company private data system] using the default password, documented everything with screenshots and whatnot, and put it on my boss's desk.
guess the result!?
even trying to explain/teach/advise him about the risks , saying that he should call the leased line company and complain about them putting an unsecured device in his network, the retard fired me for 'hacking attempt' and said that i shouldn't be 'trying to sneak in places where i shouldn't' (damn, i just found a BIG flaw and got bashed for finding it!).
2 days later : the fscker changed the password.
when i think of it, i regret not arriving at home at that day and reflashing the modem's firmware with zeroes or something and hitting reboot. that would be total chaos and give them a nice big lesson
I used to work in a MAJOR telecom firm. I had a list of about 10 common passwords which granted me root permissions on 99% of machines. My boss had a similar list for cisco boxes. When we needed to change/check something we just used password after password till we hit the right one.
:D In the even more rare case that the admin didn't want to tell such a sensitive data via phone, we'd just start reciting him our root-password list to prove him we were who we pretend to be. That always did the trick :D
The other option, the proper procedure, was to sent an email to the bureaucrat boss of sysadmins. He then would send order to an admin to temporally change the password for the machine you needed and give you that password. Then when you finished he would change the password again. The problem was the sucker usually just ignore your requests, or take weeks to give you access. So if we wanted to end our job in time, we had no choice.
In 1% the rare cases that the password was different, we just directly phone one of the admins bypassing his boss, and ask him the password
So users are not always the problem. Stupid policies are also to blame.