Slashdot Mirror
Dutch ISP Discovers 140,000 Customers With Default Password
bs0d3 writes "In Holland, a major ISP (KPN) has found a major security flaw for their customers. It seems that all customers have had the same default password of 'welkom01'. Up to 140,000 customers had retained their default passwords. Once inside attackers could have found bank account and credit card numbers. KPN has since changed all the passwords of the 140,000 customers with weak passwords. They also do not believe anyone has actually been burglarized since discovering this weak spot in security."
had to ban the password abc123 on thier ADSL network years ago..
Those filthy communists enabling others to pirate through their connection would be in jail now.
It's their fault for not (1) randomizing the initial password, and (2) forcing new subscribers to immediately change their password after the first login, both of which are standard practices on properly secured systems.
When I was a sysadmin at a certain Bible college known for its weak security, I collected the password hashes of the students & faculty and ran them through a cracker (John the Ripper if I remember correctly), then sent out a mass email with the decrypted passwords, sorted by the amount of time it took to crack them.
Yeah, the majority of them were cracked within five seconds. Of course, I omitted the information on just whose passwords they were.
Dunno if it resulted in anyone actually doing something about their passwords though.
In times of universal deceit, telling the truth gets you modded -1 Troll
welcome01
willkommen01
aloha01
benvenuto01
So let me get this straight, and ISP just told us the password to 140,000 of its clients? I would seriously consider changing ISP's.
http://interserver.net/
They also do not believe anyone has actually been burglarized since discovering this weak spot in security.
Sure, that's believable. It'd be bad if googling 'welkom01' turned up hits on free password sites but that'll probably never happen.
What's particularly humorous is forcing google to not include pages from the last week. One of the first pages is this gem from 2010.
http://www.autoitscript.com/forum/topic/118849-import-csv-file-to-add-users-in-ad/
Almost looks like the ISP's admin asking how to make it so new accounts get the right password in a scripted fashion. There are a few other admin type questions on pages asking how to use SAMBA and other cruft that include that password.
Well they are no longer the current password to those accounts, and with regards to other sites it's no less secure than someone who has a password on the top 10 most popular passwords list.
For heaven's sake what's wrong with burgled?
All offending passwords were changed to "welkom02." Crisis averted!
"We have discovered you have been using default password 'welkom01'. This represents a grave security risk. Therefore, we have changed your password to 'welkom02'."
how many pairs of boxer shorts should you own?
I had to do some support for a satellite office in Rotterdam and they had KPN as a broadband provider in 2007. I had to deal with the a couple of times and I thought they weren't terribly good, even compared to British Telecom - which is saying something!
Unfortunately I can't recall specifics. Just a general sense of "Arrrrghhh!"
Love the Dutch as a people though :)
It's twice as bad as the summary makes it sound: "It seems that the Usernames were easy to guess because it was comprised of the persons zipcode + street address."
But at least then it'd have to be targetted. What isn't clear is what the login actually does. The article says it was the "account management" login. So to use Time Warner as a comparison, I assume that means they would change the ISP-based e-mail account passwords from there and read their e-mail via a webmail interface not to mention reset their passwords for online banking sites then verify the change via that e-mail. But to say they could retrieve their credit card numbers is ridiculous. No webpage displays all digits of a stored credit card like one on file for ISP bill payments. It's always just the last 4 digits.
Just lost about 140K bots on my net...
No. Well...maybe. Actually, yes. It really just depends.
Well they are no longer the current password to those accounts, and with regards to other sites it's no less secure than someone who has a password on the top 10 most popular passwords list.
Some users think passwords are a nuisance or a bother and resent having to stop and take the 2 seconds necessary to type it in. Others appreciate the safeguard that it represents and treat it accordingly. Both reap what they sow.
There is definitely a strong overlap between that first group, and this more general (sadly widespread) mindset that ever putting any thought into anything is some kind of terrible burden to be avoided at all costs.
It is a miracle that curiosity survives formal education. - Einstein
uses similar default passwords for pppoe authentication, mail and wireless routers... pretty much leaving everyone that doesn't do a self install (and know what they're doing) vulnerable.
The only thing missing from your post is something about wooden shoes and windmills. Thanks for the generalization, again.
Just for the record, it's no a normal or common thing to have sex with underage eastern european girls here.
Right. And we can't be any more inviting than allowing foreign people to "come in" our country.
Can't be much more inviting than cheap pot&prostitutes and identical passwords for everybody that translate as "Welcome".
Doesn't surprise me much... KPN is a shit company who are still benefitting from being the previously state-owned telecom provider, meaning they can milk their customer base without having to do too much about anything, including security.
The only thing missing from your post is something about wooden shoes and windmills. Thanks for the generalization, again.
This, and that war-driving has to be done on a bicycle.
Right. Now the password is 'welkom02'.
Cox isn't much, but I don't actualll get a default account, except for email, and that is just email.
My account info is not necessary to use service, just to automate payment, and I have to set up everything, no defaults.
My real concern is how this ISP determined using defaults made any sense. Really?
deleting the extra space after periods so i can stay relevant, yeah.
KPN didn't discover it themselves. An ICT company did (accidentally even), and reported the flaw to an IT site (webwereld.nl) instead of contacting KPN directly.
Dutch link: http://tweakers.net/nieuws/82955/kpn-maakt-blunder-met-standaardwachtwoord-z-adsl-accounts.html and http://webwereld.nl/nieuws/111057/140-000-kpn-adsl-accounts-lek-door-welkom01-fail.html
Sounds like users have had it with passwords...
or is the problem still between the keyboard and the chair?
A blog I run for the wealth
You forgot the tulips & orange!
welcome1 is the default Frontier DSL password.
The ISP replaced it with another weak password? What? welkom02? Why not a strong password? Strong passwords do not have to be hard to remember or type, see: http://xkcd.com/936/
assignment != equality != identity
The word you are looking for is burgled.
At least you didn't write 'gotten burglarized'...
The problem is that there are simply too many sites asking for passwords these days..
The sensible thing is obviously to use a different password everywhere, but you will never remember them and end up keeping them written down somewhere. Either somewhere inconvenient, so that you don't have access to the password when you need it, or somewhere convenient where it could more easily fall into someone else's hands.
So people reuse passwords across sites, the problem with this is that you don't know how a given site will store your password... It might be in plain text, or using a weak algorithm... A compromise of one site (see linkedin) thus compromises your accounts on other sites.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
welkom01 and welkom02 have to be great passwords. The (Dutch) company I work for gave me an internal SVN user whose password I can't change. However, they require me to change it every month (because they're very security-conscious). Since I can't do this, the account gets locked every time. When this happens, I just call the helpdesk. They will then reset the password for me. They usually provide me a new password like 'welkom01'. This, and the fact that 140,000 other people are using it, proves to me that it is one of the best passwords around.
What are the odds that they've changed 140 000 passwords to "sukkel01" now, I wonder.
To be, or not to be: isn't that quite logical, Slashdot Beta?
In Holland, a major ISP (KPN) has found a .
First sentence, guys. A grammatical mistake in the First. Fucking. Sentence.
The 9 year olds in the special school I tech for can construct full sentences. They can also read through their work and pick out mistakes. You, as paid editors, have no excuse. I don't care if this is a missing angle bracket on a tag or other technical issue; It's inexcusable.
Finally had enough. Come see us over at https://soylentnews.org/
On a system I manage we have rules in place to prevent the reuse of passwords, simple ones like you cannot use a password you used the previous 31 times and such with limits on how often you can change them.
Well unless we put a limit of changes that were beyond a day you can guess what many users figured out to do... Forcing users to change passwords doesn't always end up with the results you expect.
Oh, mixed case and numbers... don't even get me started. Surveyed users on how they handled that and its pretty hilarious at times.
* Winners compare their achievements to their goals, losers compare theirs to that of others.
Shtop! It'sh too much!
The problem is that there are simply too many sites asking for passwords these days..
The sensible thing is obviously to use a different password everywhere, but you will never remember them and end up keeping them written down somewhere. Either somewhere inconvenient, so that you don't have access to the password when you need it, or somewhere convenient where it could more easily fall into someone else's hands.
So people reuse passwords across sites, the problem with this is that you don't know how a given site will store your password... It might be in plain text, or using a weak algorithm... A compromise of one site (see linkedin) thus compromises your accounts on other sites.
A nice solution is to use a browser add-on (Firefox has a few like this, other browsers probably do, too) that generates a strong per-site password for you.
The way it works is that you choose one good master password. The add-on then makes a cryptographic hash of the site's domain name and your master password. This produces a password that is unique to each site, can be safely stored without fear of compromise, and provides a high degree of entropy (looks like random characters). You only have to remember one good password.
It's definitely a solvable problem. Most modern browsers can also store the passwords you use. This is locally insecure, unless you have a browser master password with which that database is encrypted and then decrypted only as-needed. The problem is coming up with consistently strong passwords for each unique site. That's why I like those add-ons better.
It does not take very much determination, nor very much regard for one's own security to find that such solutions exist and are freely available. The very biggest problem with average users is that they seem to have no initiative, not even when it's their own ass that will suffer the consequences of failure.
It is a miracle that curiosity survives formal education. - Einstein