Verizon Changing Users Router Passwords

Kohenkatz writes "I have Verizon FIOS at home and my Verizon-supplied Actiontec router had the password 'password1' that the tech assigned to it when he set it up three years ago. I received an email from Verizon that said 'we have identified that your router still had a password of either password1 or admin1 and we have changed it to your serial number.' I checked and it actually had been changed. I believe this to be in response to the Black Hat presentation about the hackability of home routers. I am upset about this because Verizon should not have any way to get into my router and change the settings, especially because I own the router, not them! I looked in the router's settings and I see port 4567 goes to the router and is labeled 'Verizon FIOS Service.' Is this port for anything useful other than Verizon changing settings on my router? What security measures does Verizon have to protect that port from unauthorized access?"

Comments

uhhh

[buddyglass]

Maybe they were able to access your router because the password was still password1 ?

Re:uhhh

[cosm]

End of thread. No further comments are necessary.

Re:uhhh

[Kohenkatz]

I thought that blocking administrative access from WAN would have been enough.

Re:uhhh

[Alsee]

About 12 out of the 20 posts so far all say the same thing. It's time to kill this entire story. It never should have appeared in the first place.

-

Re:uhhh

[phoenixwade]

I thought that blocking administrative access from WAN would have been enough.

I'm gonna get modded troll for this, but "Thinking" was not what you were doing.

You missed thinking in three key ways:

• you didn't change the default password to something other than a common default password
• You apparently were upset by them doing you a favor and changing the password
• And the least amount of thinking in this entire thing: You told the Slashdot community about this? you deserve every thing you are about to read.

Re:uhhh

[commodore64_love]

>>>A UK citizen...threatened with exportation & 20 years imprisonment by the current administration.

Also this is a clear indication of a double standard and Inequality under the law. If a government or corporation leaves the password as 'password1' and a citizen enters that computer, then the citizen will be severely punished. BUT in the opposite case of government/corporation entering a citizen's private computer or router?

That's okay.

Re:uhhh

[Ksevio]

No, they were able to because they used their backdoor which has it's own password to login and change it.

Realistically the password of the router doesn't matter if you have remote management turned off, but Verizon thinks that people are going around cracking the WEP keys and changing peoples routers.

They did the same to my router so I blocked port 4567.

Re:uhhh

[complacence]

What are you all on about? He said he disabled administrative access from outside. No matter the password, there's intrusion going on here, so there is something to talk about.

If a password was all there is to protect your router from outside, all hell would break loose for simple brute forcing. You also can't expect Aunt Irma to change her password first thing when she gets net access.

Finally, even disregarding all that, even if he was stupid and careless, they can't just access the router if he didn't explicitly give them the right in a contract somewhere. I get you're all supercomputerexperts, but maybe we could talk about what he's asking?

Why is there an open forced access port/back door?
Is that ok without telling the owner?
What security is in place that entities besides Verizon can't access it?

Re:uhhh

[gparent]

If they can access the router when administrative access is disabled, what makes you think they cannot bypass the password system anyway?

Re:uhhh

[harlows_monkeys]

A UK citizen who used a similar backdoor (typed the default password) to get into a US computer is now being raked-over-the-coals and threatened with exportation & 20 years imprisonment by the current administration. If it wasn't okay for him to enter a privately-owned computer, why it is okay for Verizon to enter a privately-owned router?

Did Verizon leave threatening messages promising continued disruption? Did Verizon attempt to conceal their activity by deleting log files? Was Verizon attempting to gain access to the user's private data?

The answer to all of these is "no", making this totally different from the McKinnon case. (And these are just the things McKinnon admits to. He's alleged to have been much more destructive).

Also, the router is connected to Verizon's network, and was set up by Verizon for the customer. Even if the customer owns the router, it is is quite likely there is a contract between the customer and Verizon allowing them to access it for administrative purposes. Did McKinnon have a contract with the owners of the 96 or so computers he hacked? Were they on a network he owned and using a service he provided?

Re:uhhh

[Anonymous Coward]

Except they didn't change it to "something random without telling", they changed it to something very specific and THEN FUCKING TOLD HIM.

Re:uhhh

[Ksevio]

If that were the whole story then it would be end of thread. Verizon changed the LAN side password remotely using their backdoor to the system. The backdoor uses a completely different authentication system. The only time the LAN side access password is useful is if you're already on the network, at which point there are probably more pressing security issues.

Re:uhhh

[mystik]

If you read the ToS (for VZ Fios, Even Cox Cable has a similar provision) by agreeing to service, you authorize them to access your equipment.

See here: http://www.verizon.net/policies/popups/tos_popup.asp

Search for "Monitoring of Network Performance by Verizon"

I soooo wish there was more competition for broadband in the states :(

Re:uhhh

[Jah-Wren Ryel]

I have fios and I have gone to my own software router running in a VM. But before I completely dumped the actiontec (which is really nice hardware for a router, but not all the well supported by alternative firmwares due to actiontec being asses about the GPL for a really long time), I noticed traffic on that port. After only cursory investigation, the impression I got was that the router was "phoning home" to verizon. That's how it got firmware updates and, I presume in this case, the password was changed. That "phoning home" behavior was something that creeped me out because I have no idea what it's reporting or what changes might be made, so it's what goosed me to start looking into alternative firmwares and eventually go the VM route instead.

Re:uhhh

[Anonymous Coward]

If his FIOS router is something like the Actiontec MI424WR, the datasheet specifically states it supports TR-069

http://en.wikipedia.org/wiki/TR-069

Its their CPE, not his router, even if he changed the passwords and changed the firewall.

Re:uhhh

[Anonymous Coward]

If you're too stupid to know to ALWAYS CHANGE THE DEFAULT PASSWORD perhaps you're too stupid to save the settings after "disabling" administration from WAN

Re:uhhh

[Kalriath]

They can. Siemens Gigasets have this functionality as well - it allows the ISP to push Firmware updates and config changes to attached CPE via the ACS server using TR-069.

Re:uhhh

[Roger W Moore]

He said [slashdot.org] he disabled administrative access from outside.

Given the level of competence he has displayed I frankly suspect that he failed to do that correctly or, if he did, he probably ended up blocking access from outside the ISP subnet.

Finally, even disregarding all that, even if he was stupid and careless, they can't just access the router if he didn't explicitly give them the right in a contract somewhere.

He probably did - there is usually some clause somewhere where you agree to let them take action to prevent security breaches or some such. Failing that there is always a clause which lets them disconnect incorrectly configured hardware which poses a risk to the network which this arguably does. So would you advocate disconnecting the router and sending letter that customers have to reconfigure the default password before it will be allowed to reconnect? It's hard to see how anyone can complain about their actions. There is no private data stored on the router nor did they change any setting beyond the minimum needed to secure it. This is the sort of thing that a sysadmin does for you and that people usually say "thank you" for.

Re:uhhh

[darthwader]

I purchased a combination lock for my front door three years ago. Today, saw a note on my kitchen table from the locksmith. I said "I noticed that the lock I sold you three years ago still has the default combination on it. That's really insecure, so I changed it to your phone number. No need to thank me."

Did the locksmith do anything wrong by breaking into my house to change the combination on the lock?

Verizon can probably get away with this, because on page 239 of the user agreement he signed it says "Verizon reserves the right to do anything we want to you and your property, forever, because we know you won't read this far into the agreement, you're just going to sign it after skimming the first page. Sucker." But still, even if the poster did agree to this in a user agreement, Verizon should NOT be hacking into and reconfiguring other people's equipment, even if they think it's a good idea.

Re:uhhh

[INT_QRK]

I got the same message from Verizon FIOS. All I can think to say is, "thank you Verizon" for being proactive in addressing an identified security issue about which I was previously unaware. Please keep up the due diligence.

Re:uhhh

[Ksevio]

But if that's their fear, they should force people to use WPA2 (the option they have listed as "Recommended")

Re:uhhh

[Anti_Climax]

What are you all on about? He said [slashdot.org] he disabled administrative access from outside. No matter the password, there's intrusion going on here, so there is something to talk about.

Administrative access was not used for this. His actiontec, along with most other telco distributed CPEs use the TR-69 remote administration spec to allow for reconfiguration of services, firmware updates and other crap that used to require a technician to be sent out.

If a password was all there is to protect your router from outside, all hell would break loose for simple brute forcing. You also can't expect Aunt Irma to change her password first thing when she gets net access.

Which is why they changed his password from the default to a unique one. Even with remote access disabled, a default password on your router is a risk. see Pharming

Finally, even disregarding all that, even if he was stupid and careless, they can't just access the router if he didn't explicitly give them the right in a contract somewhere. I get you're all supercomputerexperts, but maybe we could talk about what he's asking?

Telcos are typically behind IBM and God on how many lawyers they have on staff. I'll eat my fucking shoe if it's not explicitly laid out in the TOS for FIOS that they can and will access the router for remote configuration changes, particularly for security reasons.

Why is there an open forced access port/back door?

There is a backdoor to allow changes in configuration that are usually, but not always, related to connectivity and function of the actual connection to the provider - the minutiae that even a field tech doesn't want to have to waste time with.

Is that ok without telling the owner?

Are we that sure it wasn't in that contract he signed?

What security is in place that entities besides Verizon can't access it?

A properly implemented TR-69 system is going to be more secure than any machine this guy is running on his network, guaranteed. The administration server address cannot be changed from the user accessible interfaces, the connection is initiated from the CPE to that server instead of the reverse and there are multiple layers of verification and encryption in use before anything is actually allowed to be updated or changed.

Re:uhhh

[harlows_monkeys]

No, they just sent one indicating that they had already perpetrated a DOS attack

A DOS attack? Really? What service was denied? There's no indication the customer's service was interrupted at all.

Re:uhhh

[luca]

What are you all on about? He said he disabled administrative access from outside.

He disabled the user visible administrative interface.

Google for tr69 and you'll be enlightened.

In my router it's impossible to disable, however in some normally hidden menu I could modify the "call home" url, rendering it ineffective.

Re:uhhh

[David_W]

Its their CPE, not his router, even if he changed the passwords and changed the firewall.

Not exactly (and this is why I hate how some devices blur the distinction between CPE and personal equipment, like cable modems). The Actiontec they give you with the service IS yours; if I were to cancel my FIOS service today they can't ask for me to return the router. I would be free to take it elsewhere and use it on something that isn't their service.

That said, I always figured there were "gotchas" like this in the supplied router, which is why I stopped using it shortly after I got FIOS. I like the clear distinction where their control point ends (the ONT) and mine begins (my FreeBSD box).

Re:uhhh

[Zen Hash]

If that were the whole story then it would be end of thread. Verizon changed the LAN side password remotely using their backdoor to the system. The backdoor uses a completely different authentication system. The only time the LAN side access password is useful is if you're already on the network, at which point there are probably more pressing security issues.

It's also useful if an attacker can, by any means, get any one of the people already on the network to visit a URL. If an attacker knows that many people are using the same password on their routers, he simply has to setup the exploit once then use any technique he prefers to bring in visitors. (ad networks, gain access to a popular site and modify a page or two, spam the URL all over the place, etc.)

Re:uhhh

[jcostom]

Interesting.. When we first got FiOS, they were only doing Internet & Phone (TV came 2 years later), and handing out D-Link routers. Since I work for a network manufacturer, the first thing I did was swap it out for a real firewall. 2 years later, they started doing TV in our area, they brought out an Actiontec, wanting to replace my firewall with theirs. Fortunately, I came upon a solution that worked perfectly, and doesn't involve using their router directly (shocked the installers that came out to do our TV install). I've got the Ethernet WAN port of their router plugged into an isolated zone on my firewall (where my Guest WLAN also lives), with the cable wire still connected (so the cable boxes can get guide data). This isolated zone has access to the Internet only, nothing on my "regular" network at all. Works like a champ. Get your FiOS Internet delivered over Cat5 if you can get the installer to do it, then hook up the router that way. The cable boxes don't seem to mind 2 layers of NAT, so I see no reason not to deploy like this.

Re:uhhh

[SuperTechnoNerd]

My friend works for Verizon and warned me about port 4567 so I blocked it as soon as I got the service. This is scary because they can install any software on your router at any time.. Even to monitor your traffic on you LAN side. Even though I blocked the port, after hearing this, now may get rid of the actiontech, although it is a nice router.

Re:uhhh

[Anonymous Coward]

and thank you Verizon for stopping by and diddling my wife, I was previously unaware of how unsatisfied she was.

Re:uhhh

[surferx0]

I purchased a combination lock for my front door three years ago. Today, saw a note on my kitchen table from the locksmith. I said "I noticed that the lock I sold you three years ago still has the default combination on it. That's really insecure, so I changed it to your phone number. No need to thank me."

Did the locksmith do anything wrong by breaking into my house to change the combination on the lock?

Bad analogy, since this is leased equipment from Verizon, it's more like you rent an apartment and the landlord changes the busted up locks on your door or performs other various maintenance on their property for you. If you haven't rented before, I can tell you that is quite normal.

Re:uhhh

[Anonymous Coward]

I worked for fios tech support (well a 3rd party contractor) and we never got calls about this port being open. The few people that did call knew it was the Verizon management port. The thing is used for calling home and for Verizon to enable things like caller id on stbs, remote dvr, Diagnostics, etc without the customer having to open ports for these features. I think it's a good idea for them to change the passwords, more then half the people that called had the default password set and trying to walk them to even change the router password was a complete nightmare sometimes. Also the OP notes that "especially because I own the router, not them!", as far as I am aware this is not true. Every time someone did a disconnect they had to send back equipment or pay a fee for not returning it. In addition if the router failed Verizon will drop-ship one free of charge so it is Verizon's, else they would charge a replacement fee. The only way I know of to own one is to cancel fios and not return the router, pay the $100+ fee and then sign up for fios somewhere else.Tech support reps have limited command which include reset the router password to default (which is now serial number, cannot be set to anything else), reset wep/ssid to default (can be set to anything, protocol requires verifying it with the cx before setting), factory reset the router, reboot the router. get the status of the ports, see a list of ip leases (shows ip address, mac address, and a name of the device), ping the router, Ping the internet from the router (never works), and see a snapshot of the current speed up and down. I don't think any of those command would violate privacy.

I would equate it to almost being a voluntary recall, the router was technically "faulty" because, it used a default password that was exploitable so, they sent out a fix. I would add that anyone who wants to change the password back to password1 can go right ahead ;-)

Re:uhhh

[Sl4shd0t0rg]

Would you feel differently if this was a bunch of email accounts that had a default password of "password" and they were all hijacked to send spam? Would it be ok to change the passwords on all the email accounts to something else immediately and then notifying the user after the fact?

Re:uhhh

[someone1234]

That password was owned by Verizon. He should have changed it to 'own' it, but he didn't.

This situation is like: you go into the shop, pay for some item but leave it on the counter.
The vendor notices it, runs out of the shop and hands it to you, again.
You scream a hissy fit that the vendor dared to touch YOUR ware.

He should have learned from this lesson and not be a dick and post this on Slashdot.

Then change your password

[Anonymous Coward]

Maybe they were able to change it because you were too lazy to do it in 3 years. For the first time, I think Verizon did the right thing in this case instead of letting stupid users be online and get potentially hacked and become a nuisance to the internet.

Re:Then change your password

[jasen666]

There's no protection for having a stupid password to gain entry to a system.
You may as well have not had one.

Re:Then change your password

[iburrell]

Didn't you read about the recent DNS rebinding attack on wireless routers? It works on routers with remote access disabled but with the default administration password. The attack basically tricks the user's browser into attacking the local administration interface.

Putting things in perspective

[BondGamer]

You had kept your password as password1, yet are complaining about Verizon being able to change your password?

Re:Putting things in perspective

[PinkyGigglebrain]

I think his concern is that Verizon was able to change it from the outside.

That he left it with such a weak password is beside the point. The routers I've worked with will not allow administration level access over the outside port or wireless connection unless explicitly allowed by the admin, so Verizon being able to do just that should raise a few questions.

He owns the router, right, and yet Verizon thought they had the right to log in and change his password.

Makes me wonder if they have a firmware coded backdoor/admin password into the router.

Perhaps a little cheese with that whine?

[wiredlogic]

Every broadband provider has access to the modems connected to their network to perform maintenance and updates as necessary. It's part of the fine print you agreed to. If you didn't want them getting into your router configuration you should have changed the default password.

Re:Perhaps a little cheese with that whine?

[thestuckmud]

My provider allows third party modems. Absent a conspiracy between manufacturers and providers, there is no way they can force updates on my equipment.

You are correct about the fine print, though. They reserve the right to update their software on my equipment (including computers). The simple solution there is not installing their software in the first place.

I'm upset

[OverlordQ]

I am upset about this because Verizon should not have any way to get into my router and change the settings, especially because I own the router, not them!

I'm upset they let people like you on the internet. Change your passwords from the default and use something secure. Instead of waiting for somebody to do something fun like log in remotely to your router using the default login and hosing your settings so your internet goes down.

Re:I'm upset

[Kohenkatz]

You can't get in to my router from outside except on Verizon's maintenance port - and I didn't know they can do password changes from there.

Re:I'm upset

[dogsbreath]

I am upset about this because Verizon should not have any way to get into my router and change the settings, especially because I own the router, not them!

I'm upset they let people like you on the internet. Change your passwords from the default and use something secure. Instead of waiting for somebody to do something fun like log in remotely to your router using the default login and hosing your settings so your internet goes down.

This is a TR 69/TR 98 device and you can't disable ISP access. Well, not through any normal user level screen. You'd have to hack it.

Changing the default login will not make any difference.

Ummm...try changing the password!

[mhkohne]

If you don't want them to access the router, change the bloody password. Like you should have done 3 years ago!

Re:Ummm...try changing the password!

[fuzzyfuzzyfungus]

There is no particular reason to suspect that changing the password would alter their level of access.

On most consumer routers, "the password" is what controls access to the dinky webserver serving the configuration interface, on port 80, LAN side only. According to TFS, Verizon's pet routers have something listening to port 4567, WAN side. There is no particular reason to believe(and, indeed, reason to disbelieve) that the password controlling access to the port 80 web interface and the access control mechanism on the port 4567 WAN management interface are at all connected. Assuming they aren't total morons, I'd imagine that they would use some flavor of keypair auth for that one.

We would need somebody to grab the firmware for the router in question and have a look to actually settle the issue.

Re:Ummm...try changing the password!

[memyselfandeye]

Confirmed. Non-default password here, firmware 'magically' updated periodically. Modem web-server recently updated to display "westell" instead of "Verizon" as the logo following the Verizon to Frontier transfer in my area.

Unless all these geniuses can figure out how to put their modem behind a firewall, I don't think you can keep Verizon out. And if you did, I wouldn't be surprised if Verizon helped you on their end by blocking port 80, 8080, 25, 22,exec... until you let them back in.

Still kinda scary, but I'd hope Verizon has things protected by a good hash, and not just a super secret admin account.

Re:Ummm...try changing the password!

[fuzzyfuzzyfungus]

I don't have access to one of these routers to check; but googling around for "port 4567 verizon" returns all sorts of hits, the gist of which is that this "feature" is on by default and cannot be turned off. In what I imagine is an oversight on Verizon's part, it is apparently possible to set a firewall rule that blocks that port, which is the closest you can get to disabling it in the default firmware.

As for what it is capable of, reports suggest that it can be used for firmware updates, and TFS suggests that it can see(and change) password hashes on the system. If it can do that, it seems reasonable to assume that it can probably access the entire local filesystem on the device. Further, if it can update the firmware, Verizon could always push a firmware update giving their remote management interface any powers that it currently lacks.

In addition to unnervingly paternalistic, but more or less benign, firmware updating and password securing; it isn't exactly tinfoil-hat territory to postulate that it might be used for market research(number of devices/household, manufacturers, determined by MAC, of those devices, etc.)

I would assume, though, that any heavy network monitoring/secret sinister CALEA/NSL stuff probably isn't handled on the router. Verizon, being your ISP, controls the other end of the connection(and, unless you take specific steps to the contrary, is your DNS provider), so they hardly need to build any serious spying power into their routers(especially since that would raise BOM cost for a device that they order millions of, and expose their sinister program to anybody with some basic linux hacking chops who either downloads and disassembles the firmware, or snags a used router on ebay, or signs up and investigates his own router(and, given that techies are more than usually interested in high-speed internet, the odds are very good of this happening). Therefore, I would expect that this management interface offers an upsettingly comprehensive set of functions for controlling the router and accessing its filesystem; but contains no overtly sinister embedded logic. Any of that that exists would be closer to the center of the network.

You're joking, right?!

[dave562]

Your router was set to the default password after 3 YEARS and you're claiming to be upset that Verizon secured it for you? Are you kidding me? I'm all for letting people wallow in their own stupidity and ignorance, but come on buddy. They did you a favor. In all seriousness, they shouldn't have left it default in the first place. It should have been set to your serial number from the factory.

Wow... retards abundant

[Raxxon]

I have Verizon FIOS. Tech came out to make sure everything worked and told me that despite the fact that I am a network engineer and it is a Business Class account that he was required as part of his job to install their crappy router and verify connectivity with it. I allowed him to do it and 20 minutes after he was out the door I had my router in place and everything secured to my specifications.

Funny enough, I haven't been contacted by Verizon about the fact that my router is insecure or has default passwords. They haven't changed the password(s) on my router or reconfigured anything other than when I called them 2 weeks ago to make them give me more speed for less money (Packages changed, double the bandwidth I had for $15/mo LESS).

Please contact Verizon, ask them to cancel your service and GTFO the internets plz.

Re:Wow... retards abundant

[LynnwoodRooster]

retards abundant? yes, apparently there are. Retards like you... I don't care weather it was a stupid thing to do

Not to mention those retards who cannot write. Like whether to use 'whether' or 'weather'...

unauthorized access is unauthorized

[Anonymous Coward]

It doesnt matter what his password was, they broke into his router illegally

Re:unauthorized access is unauthorized

[blackraven14250]

No, they entered a router which they lease to him with the intention of making their network more secure. You don't get the right to update your firmware just using your own modem on a cable network, so this is likely covered by the contract.

Re:unauthorized access is unauthorized

[Nikkos]

So what if they sold it to him? If it's his, and they accessed it without permission (no matter what the password) then they broke the law.

Re:unauthorized access is unauthorized

[blackraven14250]

Not if the router is leased rather than owned. Since that's the way most internet companies work, I'm going to bet it's leased, and there's a clause in the contract that lets them access it for security purposes.

Re:unauthorized access is unauthorized

[flosofl]

You don't get the right to update your firmware just using your own modem on a cable network

Yes, I do. And have. However, if an update borks my connection, I'm shit out of luck as far as support from them is concerned. (I made a point of looking at my TOS when I did the update to make sure they couldn't kick me off for doing it).

Re:unauthorized access is unauthorized

[whoever57]

No, they entered a router which they lease to him with the intention of making their network more secure

What part of "I own the router, not them" do you not understand?

That goes for you too, mods!



I expect that I'll be modded down as a troll for pointing out facts that contradict the parent post.

Re:unauthorized access is unauthorized

[Jane Q. Public]

You don't get the right to update your firmware just using your own modem on a cable network, so this is likely covered by the contract.

Since when? The law allows you to use your own equipment (as the writer did; he said it was his OWN router). I too use my own cable adapter and router, which are both better equipment than the cable company leases. And the cable company has neither the legal or contractual right to access them without my permission. If they did, they would be guilty of illegally accessing my computer equipment over a network, which can be prosecuted as a FELONY in some cases.

Re:unauthorized access is unauthorized

[Lordnerdzrool]

A lot of people think they own their equipment, when in reality, they do not. As many have stated, companies tend to lease the equipment for use on their networks.

So let's see...

[mandark1967]

Lazy Fuck receives router with password set to password1
Lazy Fuck doesn't change it for THREE fucking years
ISP decides to secure router for Lazy Fuck since Lazy Fuck evidently cannot
ISP Emails Lazy Fuck with new password
ISP changes password so Lazy Fuck doesn't get wtfpwn3d
Lazy Fuck whines like a petulant little schoolgirl

How did this retard even find slashdot, let alone create an account and post?

lazy fuck could be lit on fire next to a pool and he'd burn to death.

Re:So let's see...

[ntdesign]

lazy fuck could be lit on fire next to a pool and he'd burn to death.

And complain if someone pushed him in to it.

Or maybe...

[segin]

It's because the router is Verizon property and they probably have access to it no matter what your password is?

Actually, I've never used FiOS but I've always assumed that the routers remained property of Verizon, same as the set-top-boxes for television do. If someone can prove this, one way or another, I'd like to know.

P.S., on another note, has anyone tried to port a free router distro to the Westell 9100EM routers specially made for Verizon as FiOS routers and MoCA gateways. It seems Westell released the Linux-based firmware source which, although I've not looked at it, is probably the same Linux firmware that Verizon ships these things with, except without Verizon's branding and webapp look-n'-feel. I'm surprised that no-one has tried to port another Linux distro to it, but I guess that if Verizon owns the routers, the customers with the know-how won't bother trying.

Easier way to find out new password

[spartacus_prime]

hey, if you type in your pw, it will show as stars
<Cthon98> ********* see!
<AzureDiamond> hunter2
<AzureDiamond> doesnt look like stars to me
<Cthon98> <AzureDiamond> *******
<Cthon98> thats what I see
<AzureDiamond> oh, really?
<Cthon98> Absolutely
<AzureDiamond> you can go hunter2 my hunter2-ing hunter2
<AzureDiamond> haha, does that look funny to you?
<Cthon98> lol, yes. See, when YOU type hunter2, it shows to us as *******
<AzureDiamond> thats neat, I didnt know IRC did that
<Cthon98> yep, no matter how many times you type hunter2, it will show to us as *******
<AzureDiamond> awesome!
<AzureDiamond> wait, how do you know my pw?
<Cthon98> er, I just copy pasted YOUR ******'s and it appears to YOU as hunter2 cause its your pw
<AzureDiamond> oh, ok.

This is News for Nerds, Stuff That Matters?!?

[djlowe]

Hi,

I checked and it actually had been changed.

OMG! So, you tried the new password, and it worked? Why didn't you change it then? More importantly: Why didn't you change it the first time?

I am upset about this because Verizon should not have any way to get into my router and change the settings, especially because I own the router, not them!

No, you're upset because you are clueless, though you think you are not, just discovered it and are pissed off because your router had the same password for 3 years as a result, and Verizon was forced to change it because you were too ignorant to do so yourself earlier.

I looked in the router's settings and I see port 4567 goes to the router and is labeled 'Verizon FIOS Service.' Is this port for anything useful other than Verizon changing settings on my router? What security measures does Verizon have to protect that port from unauthorized access?"

I imagine they at least understand the importance of password security, where you apparently did not.

You're not a nerd, this isn't news that matters... slow day, Timothy?

Regards,

dj

Re:This is News for Nerds, Stuff That Matters?!?

[phantomfive]

You're not a nerd, this isn't news that matters... slow day, Timothy?

It is so beautiful though. I have thoroughly enjoyed this thread. The innocent naivete of the original poster. The confusion of the geeks wondering if such incompetence is truly possible in someone who figured out how to post a Slashdot story.

Slashdot should start a new Sunday feature, call it, "Is it Real?" or something, where they post stories like this and make us try to guess if the original post is real or not.

This man (original poster) should never change. He should preserve himself as he is, so all of us can look at him and wonder, how is such a thing possible. It is a sterling example of what the human race is truly capable of.

The opening line is the best, let me quote it again just because it makes me laugh out loud every time I read it:

I have Verizon FIOS at home and my Verizon-supplied Actiontec router had the password 'password1' that the tech assigned to it when he set it up three years ago.

Seriously, how on earth could anyone think that was a clever thing to write? He's an Eliza-bot or something.

Re:This is News for Nerds, Stuff That Matters?!?

[Anonymous Cowpat]

It is so beautiful though. I have thoroughly enjoyed this thread. The innocent naivete of the original poster. The confusion of the geeks wondering if such incompetence is truly possible in someone who figured out how to post a Slashdot story.

I have thoroughly enjoyed watching dozens of geeks, who believe themselves to be technology gurus in general, get so UTTERLY confused about what password was changed and what it normally does and fly off in uncontrollable rage at the original poster over a situation which they have so comprehensively misunderstood. The password which Verizon changed exists only to stop technologically illiterate people who live in the same house from mucking the router up. Assuming that OP was right when he said that WAN access was off, then Verizon has not made ANY APPRECIABLE IMPROVEMENT TO HIS NETWORK SECURITY, all they've done is annoy their customer.

Re:This is News for Nerds, Stuff That Matters?!?

[phantomfive]

I hate to break it to you, but you are the utterly confused one, and on top of that, you can't read. The link to the vulnerability is in the summary. The guy had a link to the vulnerability in the summary he wrote. It is too sweet.

Re:first post!

[0100010001010011]

All I see is:

if you were first instead of *********, you would not have had any trouble. I had lots of trouble deciphering the summary, though...

At least you knew your password

[IBBoard]

At least you knew your password! Sky in the UK ship out Netgear routers and don't tell you the password. I "brute-forced" it in about three attempts, but that's not the point (in fact, perhaps it is, since it was something like "admin" and "sky"!).

The worst part was that we later complained about speed issues on the line and they got back to us saying "sorry, we seem to be having problems accessing your router". Erm, yeah, that'd kinda be the point - I don't want my router open and available with any backdoors on the Internet!

In his defense...

[sanosuke001]

Most routers do not allow remote administration unless you specifically enable it. If it was disabled; he shouldn't have a problem with a bad password. The router "shouldn't" allow anyone to log in remotely.

Unfortunately, we all know that not enabling something doesn't always mean it can't be accessed and he should be kicked off the internet for being ignorant.

Re:In his defense...

[lordlod]

He does have a problem with a bad password, there are some fairly clever javascript attacks that target exactly this situation, remote admin disabled and all.

The web browser is tricked to connect to a default router address (like 10.0.0.1) with a default login (admin/password1) and changes whatever settings it wants, perhaps just opening remote administration. Because the connection to the router comes from the local PC this isn't "remote" administration. There are few enough possible combinations that you can brute force the default login really easily and enough people with default set ups to make it very worth while.

If Verizon has all of their customers with the same router, the same network setup and the same password... it would be negligent not to do everything they could to help protect their customers.

An insider says:

[dicobalt]

Comcast and AT&T have access to routers that they supplied as well. This isn't limited to Verizon.

Erm.... TR-069, anyone?

[jimicus]

AFAICT, many ISPs that supply their own routers are actively looking at (if they're not already) supplying routers which support TR-069 and setting up infrastructure to configure them.

This is a protocol intended for the management of home routers - unlike SNMP, it's got some semblance of security (it's actually based on SOAP over HTTP, optionally HTTPS) - IIRC the CPE initiates the connection and can get things like configuration and firmware upgrades automatically.

I don't see how this is drastically different in concept from cable modems, which are more-or-less invariably heavily managed using DOCSIS.

Re:Slashdot for Schmucks

[WeatherGod]

Wait a minute... Giligan's Island is on Hulu?! Awesome! Best... Thread... Ever...

How to disable the backdoor

[duppyconqueror]

http://www.broadbandreports.com/forum/r21990593-modemrouter-Remove-the-actiontec-verizon-backdoor-on-port-456 Haven't tried it, but worth a shot. Took a (very) little bit of googling to find which was still less effort than lambasting the OP.

Re:It's not your router.

[mysidia]

In other words it's part of the ISP-Owned CPE. This is typical of customers purchasing leased line services.

And the OP naively assumed that the equipment being in their house automatically transferred legal ownership of it?

The ISP usually owns the router, and everything after the Telco demarcation up to the customer's cable, which is referred to as "CPE" (Customer-Premises Equipment)

This is useful to the ISP for various reasons, it can assist with troubleshooting. It can enable the ISP to implement end-to-end QoS, and implement traffic engineering / access restrictions (such as spoof prevention or anti-malware port 25 blocking), before the packet even goes to the ISP's distribution/aggregation router.

They were kinder than you deserved

[SuperKendall]

After three years, they changed the password to something you could easily find just by looking at the device.

I would have changed the password to something totally random, and made you sit through four hours of voice menus on the phone to figure out what the new one was, for fear you would change it back.

Verizon deserves a medal for restraint on this one.

Re:Use a different router

[djlowe]

No, the person who was home for the installation is a noob. I was upset when I came home and found out.

Then you're to blame threefold: 1) By your own admission, you let a noob stand in for you: If you'd cared to have it done correctly, you should have scheduled the installation around your availability so as to ensure that it met your requirements. 2) You apparently didn't do anything to correct matters afterwards, despite the fact that it wasn't to your satisfaction, and 3) Now you're whining about it on Slashdot.

Fourfold, if you expected anything other than what happened... and fivefold, if you expect to get any sympathy here for it.

I know it's harsh, but Timothy should never have accepted your submission. IMO, he threw you under the bus, and I am sorry for that.

My advice? First, change the password on your router, ASAP. Secondly, call Verizon, and inquire about changing from coax to Ethernet. Worst case they can't/won't, but you'll at least know.

Regards,

dj

DNS hijacking for fun and profit

[Anti_Climax]

I looked in the router's settings and I see port 4567 goes to the router and is labeled 'Verizon FIOS Service.' Is this port for anything useful other than Verizon changing settings on my router? What security measures does Verizon have to protect that port from unauthorized access?

That would be the security used by the TR-069 spec for CPE remote management. If implemented correctly by hardware manufacturer and service provider, it's almost certainly more secure than any of the computers you have connected to the internet, even if you're not the kind of person that leaves a default password set on their router...

Seriously, having the default admin password set has been a bad idea with routers for a very long time. Think along the lines of a webpage doing a redirect attempt to the local gateway address with different providers default router passwords and then changing a setting like your DNS server...

Sound unrealistic? Already happened on a large scale years ago. Didn't work if you had changed your password or at least had a unique one in place like the device serial number.

So rest assured that what they did has actually increased the security of your network and has left no gaping hole in it's place.

RTFA

[pgmrdlm]

From the article:

am upset about this because Verizon should not have any way to get into my router and change the settings, especially because I own the router, not them.

He owns the router, they don't. He doesn't lease it.

Re:RTFA

[BlackWind]

If the guy has Verizon FiOS, and is using the ActionTec router that was installed as part of the service, he does not own it. Verizon does NOT sell the router to the customer. (Buying the router is never an option.)
Verizon supplies the router to support TV & Internet services over FiOS, and Verizon will repair or replace the router at any time that there is a problem with it without charging the customer. (With the exception of incidents of vandalism, or a pattern of abuse requiring multiple swaps of the router over time.)
[I currently work for Verizon, and install FiOS every day. (Yes, the majority of the STUPID configuration decisions are forced on us by management to save time & effort from dealing with the average tech knowledge of both customers and other technicians with little or no knowledge about networks or security.)]

A matter of necessity

[GothPanda]

I used to work for a call center that did the tech support for Verizon DSL. We had an internal system that's responsible for line testing, and this system also let us push changes equipment we've provided. Most agents didn't know how to use the functionality of this system, but it's almost required, because some customers aren't able to change the settings with or without our help. "We need you to reset your modem. Hold down the little button on the back. You can't find it? You don't know how a button works? Fine, just let me do it from here." To OP, it's a modem that happens to have a router, not just your router. You may own the equipment, but it's still connecting to the Verizon Network, and since Verizon provided the equipment, they're going to make sure that they can make it work if you fraked it up.

Yes, but...

[Jane Q. Public]

The "regulated monopoly" of the phone lines was actually a huge success story for the United States. While we were building a coast-to-coast, 100% compatible and interoperable, relatively inexpensive telephone system, most other countries that had competition in that market ended up with multiple incompatible systems. In many cases you could not call your neighbor down the street, because he was on a different phone system that didn't play nice with yours. There were huge redundant mazes of wires overhead, belonging to different companies and systems, and completely incompatible switching systems. Often they operated at very different voltages and current.

Of course, since then the situation has been straightened out in most countries. Nevertheless, for decades the regulated monopoly gave us tremendous advantages that "free market" competition could not and did not achieve in those other countries. I am generally not one to support laws and regulation but that is the factual, undeniable history.

If it were not for the fact that Bell blatantly violated court orders, and greedily used its given monopoly of the lines to also create a monopoly of hardware, we might very well still be on a universal Bell system. Which would not be good: the breakup occurred at a fortunate time, when the technology actually allowed competition in the hardware. But it should be noted that after the breakup, when competition was allowed in the area of infrastructure (telephone lines), prices did NOT go down! Phones got better and cheaper, but access did not.

For something like phone line infrastructure, and now network infrastructure, the regulated-monopoly model is actually a very good and workable one. Of course we already had competition in network infrastructure, so establishing a regulated monopoly is probably out of the question. But what we have is a few big players, not many small ones. So it may not be a monopoly, but it's definitely an oligopoly, which is nearly as bad. Surveys of other countries that have better network access (i.e., cheaper and faster), show very clearly that laws mandating leased access to infrastructure, so that the "little guys" can participate, is essential to opening up the market and gaining the benefits of actual "free market" competition. Allowing the oligopoly to remain has already caused the US to fall behind much of the developed world in network infrastructure. If we continue to allow that, without mandatory leased access to the infrastructure, we will only continue to fall farther behind.

Re:Yes, but...

[commodore64_love]

>>>The "regulated monopoly" of the phone lines was actually a huge success story for the United States.

Yes and it was for Cable TV too, in order to get wires running-out to suburbs of cities in the 80s, but its time has passed. The Bell Monopoly hung-on far too long, and stifled innovation. From the 1950s to the mid-80s telephone network speeds only grew from 110 to 1200 (+30 bps/year). Then the monopoly was broken-up and other competing companies were allowed to sell modems too. The speed increased from 1200 to 56,000 in just a little over ten years (+5000 bps/year). The monopoly had stifled not just freedom of choice, but also progress. When you are the only choice, there's no need to waste money on improvement.
.

>>>most other countries that had competition in that market ended up with multiple incompatible system

Which countries?
.

>>>(telephone lines), prices did NOT go down!

Sure it did. I used to pay 25 cents per minute of long distance under the Bell Monopoly, which is equivalent to 49 cents in today's devalued paper. But now that I'm not stuck with a monopoly, I can choose any carrier, and it only costs me 5 cents. A 95% reduction. And of course the quality is much better because competitors laid-down fiber optics. Without that competition we'd probably still be using Bell's noisy copper - talking to distant California would be filled with static.
.

>>>So it may not be a monopoly, but it's definitely an oligopoly, which is nearly as bad

I have a duopoly. So just like when I vote, I have no real choice. The Republicans/Verizon is a little better than Democrats/Comcast but not by much. I just get screwed less often.

Re:You failed to consider: this person is clueless

[e4g4]

Every ActionTec router from Verizon that i've encountered (a dozen or so) had remote administrative access disabled by default.

Leasing routers happens

[davidwr]

1) Leasing routers happens, especially if it's a modem-router, which is becoming more and more common.

2) Even if you own your modem, as a condition of service the telcos will typically insist on enough control of your equipment to manage "their side" of the connection. The same goes for cable-tv and cable-internet providers who let you use your own modems and cable boxes.

As far as #2 goes though, they typically "enforce" it by simply blackholing any device which doesn't give them the control they need. If you want your device to work you get to choose whether to keep being their customer on their terms or look for service elsewhere.

Re:it up to you

[fishexe]

if you had changed the password yourself, this wouldn't have happened.

I like how the fourth, fifth, tenth, whatever, redundant post saying this same sentiment STILL gets modded insightful. You know, mods, we DO have a '-1 Redundant' mod.

TR-069 TR-098

[dogsbreath]

Not taking sides here but for an explanation of what is going on, you might want to look at Motive's HDM (home device management) application which works with TR69 enabled devices. I am not a Verizon customer so I don't know what the service EULA looks like but if this was a Verizon supplied device then it is likely enabled for some home device management system and such management is OKd in the service agreement. Again, I am just making some assumptions here and not saying this is kosher.

TR69 devices register with a pre-determined server when they are powered on and go through an ISP determined process to do things like password setting. If you could sniff the line side, you should see an initial HTTPS session briefly set up, pass some traffic, and then shut down.

You might want to google TR-098 which is the Internet Gateway device specification within TR-069

http://www.broadband-forum.org/technical/download/TR-098_Amendment-2.pdf

http://www.actiontec.com/products/datasheets/MI424WR%20Verizon%20FiOS%20Router%20Datasheet.pdf

Companies like Verizon and (I believe) British Telecom have gone this route to drive down help desk costs by enabling managed firmware upgrades and remote parameter setting of a subscribers device. ie Subscriber calls and complains "my internet is broken"; Tier I help desk remotely resets the subscriber's router to the original configuration and voila: the internet is unbroken!

HDM systems also gather metrics from the subscriber routers.

As far as the ISP is concerned, your FIOS/Cable/DSL router is the same as a TV set top box or satellite receiver. Cable and IP STBs are capable of sending back extremely detailed stats of anything that happens on the box, including your viewing habits.

From the ISP point of view, this gives them a powerful tool to deal with systemic failures due to firmware bugs, network attacks, and user finger problems. It also provides a method of getting network stats back from the field devices so that an overall picture of network health can be evaluated. Most subscribers will have no clue what is going on and mostly don't give a fig.

Safest approach is to assume that the access layer router is owned (in the control sense) by your provider and put your own security layer below it. Be warned that you likely can't put your IP TV STB behind your own security layer unless you make sure it can pass multicast.

Again, I am not saying this is hunky-dory but it is what I have seen.

Re:Hello? McFLY! YOU let the tech in already!

[ohtani]

Good job using so much caps dude. Calm down. Yelling doesn't make you look good. There's two ways to look at this:

- Verizon is doing people a favor by securing their routers a little more
- Verizon has a backdoor

FYI the option to backdoor isn't set by the tech per-se. The tech runs a program that executes several scripts. Whether the default firmware for these devices has this option on by default OR if the script does it I am not sure of. But it's normal practice for them to have this setup as is. The issue at hand is that they have a way back into your router. My guess is that, for the most part, it's there for maintenance, status checking (i.e. do you have an actual internet connection) or password resetting if the user forgets it. POSSIBLY for data monitoring, but I'm not going to say that's true, nor am I going to rule it out.

But Jesus, next time don't use such harsh words. Try thinking first.

Port 4567 can't be disabled

[robot5five]

For reference port 4567 is listening on the OUTSIDE interface...the side that faces the internet. This came to my attention some time ago when I decided to switch from Comcast to Verizon. I did a tad bit of research when I was in between jobs and kept a blog on my adventures with port 4567....that CAN'T BE DISABLED. There are ways to keep verizon from spying on you and illegally entering your computer network. My blog posts are here: http://robot5five.blogspot.com/2009_07_01_archive.html Cracking the password hash was trivial, although it took me a little time until I found several other folks had already done it.

Related WiFi Router Vulnerability Just Announced

[WidgetGuy]

You didn't specify which password Verizon supposedly changed, but from the context in your message I'm guessing it was your router's administrative password.

Ownership shouldn't matter. Knowledge of your router's administrative password does matter. If you were too lazy or clueless to change that password before the tech who installed it got to his/her truck, you got better than you deserved. You should go immediately to your email program and write a nice thank you note to Verizon for doing a security sweep for a WiFi router administrative password vulnerability recently (2010-7-21) announced (by Seismic) on behalf of its customers. In particular danger are routers with no administrative password set (or ones set to known values used by technicians installing routers, like "password1"). A complete fix for this vulnerability will require firmware updates to the affected routers. But, making sure you have a strong administrative password activated is a good stop-gap measure. And, given the timing, I would bet this stop-gap protection is what Verizon was trying to provide for its customers.

Router security

[SlashDev]

1) Since it's 'your' router, maybe you should have secured it better, I bet you didn't even know its password. They actually did you a favor, this is the same logic as hackers hacking into systems to discover their security holes. 2) I'd really like to see most of the Verizon FIOS customers configure 'their' Verizon FIOS router. Please quit whining, and be thankful they changed the default password instead of some cracker changing the router's DNS settings and ruined your life.

Re:I used to work Verizon tech support...

[guyminuslife]

Mmm. I suggest working out in the call center trenches for a few months before you call anything a tier 1 agent does a "power trip."

On the other hand, good for you, with your router.