Australia's Biggest Telco Sold Routers With Hardcoded Passwords

mask.of.sanity writes "Hardcoded usernames and passwords have been discovered in a recent line of Telstra broadband routers that allow attackers access to customer networks. The flaws meant customer unique passwords could be bypassed to access the device administrative console and LAN."

Comments

Comcast routers

[onix]

Some Comcast Xfinity routers have WiFi SSID and WPA encryption key hardcoded. It can be changed via software interface only to be reset when Comcast sends a firmware upgrade.

Re:Comcast routers

[Anonymous Coward]

All of them using the exact same SSID and WPA (hardcoded) or each device has it's unique SSID and WPA hardcoded, big diff there.

Re:Comcast routers

[__aaltlg1547]

Some Comcast Xfinity routers have WiFi SSID and WPA encryption key hardcoded. It can be changed via software interface only to be reset when Comcast sends a firmware upgrade.

That's a little different. If Comcast changes my SSID and password, the first thing I'm going to notice is my wireless devices are no longer connected to the network. Where's the security problem in that?

Re:Comcast routers

[ppanon]

You think that a company that is going to hardcode the SSID/WPA password into firmware updates (instead of keeping your current settings) would go to the trouble of customizing a different firmware file for each user so that they can get a high security hardcoded default? Really?

Re:Comcast routers

[DarwinSurvivor]

Shaw does.

Re:Comcast routers

[green1]

Most residential broadband routers are factory configured with their own unique SSID/WPA key, this information is typed on the sticker on the bottom of the router, and is more or less unique to that specific router. Some companies have a habit of resetting everything to factory defaults when they do firmware upgrades, hence wiping out any custom SSID/WPA key and resetting to the one printed on the bottom of the device.

Personally I recommend to most customers that if they aren't comfortable messing with the settings on the router on a regular basis they are much better off just using the ones printed on the router. They're mostly as secure as your own settings, and you don't have to worry about what happens if the thing gets reset. It also has the added bonus that when they forget it (and yes, people do regularly forget the ones they set themselves) it is printed right on the bottom of the device.

Re:Comcast routers

[Anonymous Coward]

The problem with that, as with many fairpoint routers, is that the passphrase (usually WEP) is able to be easily figured out by the SSID, but not as if hacking WEP is hard anyways, but still a bad practice.

Re:Comcast routers

[wvmarle]

Average security-illiterate consumer that just wants stuff to work: "I want to connect to my WiFi. Let's check the manual... oh that's network 'mycomcastrouter' and key 'mycomcastkey' as written on a sticker on the bottom of the device. That's easy." Selects network, enters key, connects to his WiFi router, and is happy.

Note the absence of the "sets up a WiFi password" in the above sequence.

Re:Comcast routers

[WaffleMonster]

No one serious about security would use Comcast anyway.

Like your choice of ISP magically changes the reality of Internet being a fully untrusted and untrustworthy network.

Always assume your pipe is compromised and use end-to-end security if you care about the confidentiality and integrity of any data you transmit over the Internet.

I don't know anyone in the tech field that uses them

LOL I know of many network engineers who work for first and second tier operators who use comcast at home.

CenturyLink is so reliable that they own the market for professionals. I used Comcast for a while, but the 200+ msec ping made SSH unusable

YMMV... my pings are about 30ms to google and 20ms when using comcast as a WAN link to our corporate office.

like everyone else that needs a reliable connection, gave up on them years ago. They don't try and don't care.

These comments are pointless. If you look for it there will always be someone saying megaco x is horrible because y happened or megaco a is great because b happened. Our personal experiences mean squat. You would be on better footing by citing the results of a customer satisfaction survey.

Re:Comcast routers

[Drakonblayde]

Full Disclosure: I am a network engineer for Comcast. They are indeed hardcoded, but they are unique to each device. When you're deploying customer CPE, it's a damned if you do, damned if you don't situation. Either we provide the same defaults, and no one ever changes them, which leads to an increase in the amount of security incidents, or we don't set them and the customer chooses their own and then forgets them and complains to our support about it because we don't know their passwords. Or they can be hardcoded, with the option to let the customer change them. Most folks don't and just go with the defaults. Since they're unique defaults, this cuts down on the amount of security incidents, and since it's hardcoded, if the customer ever forgets their password, it's as simple as resetting the device to factory default and telling them to look for the sticker (if they did change them) or telling them to just look at the sticker (if they didn't).

Re:Comcast routers

[ziggit]

It seems to be a regional thing. I've heard of people getting fantastic results from Comcast, while CenturyLink in my home town is so shoddy, you're almost better off using something like a MiFi (And I hate using those with a burning passion).

Re:Comcast routers

[Wandering Voice]

Yes Century Link cares, only as far as receiving your payment, however. I had Qwest when I first moved into Denver area. A month later, Century Link took over and disregarded the install payment plan we had arranged with Qwest, and received a disconnection notice as our first contact from Century Link.

I made a payment with the credit card over the phone for $100, and said I can pay the other $30 with my next bill. OK says the CSR, and 10 days later my net and phone are disconnected. Finally finding a payphone, I call and am told that that there was no payment plan agreement and if there was, $100 paid and $30 next cycle is not acceptable, and service will not return until it is paid in full. They also said that phone service should not have been interrupted, but I guess that may have been due to the telco box on my building missing its cover and having a trash bag taped on with electrical tape, which facing west into the wind, the bag is shredded, leaving all wires exposed. A year later, and the box is still vulnerable. Oh, and I am with Comcast now, and have refused to pay Century Link another dime. I'll take the hit on my credit score.

Re:Comcast routers

[mattr]

Wonder why Comcast is not in trouble for hacking if they change the password you set yourself...

Re:Comcast routers

[Anonymous Coward]

Full disclosure: I am not an engineer at Comcast, but a lowly technician. When a firmware update goes through, it resets defaults on everything. Thats how hardware works.

Also: my captcha is unionize. Don't do that when I type the word comcast, it makes me think big brother is looking.

Re:Comcast routers

[Anonymous Coward]

are you sure it's in the firmware (what's your source, you're a Shaw techie?)? I'd guess just it's just a nvram_config, not firmware (EEPROM).

Re:Comcast routers

[r1348]

Funny, last week I updated the firmware of my Fritz!Box and it magically kept all the custom settings I made, including my wireless password...

Re:Comcast routers

[ardor]

What if the router gets upgraded, but since you aren't using WiFi much (perhaps because you only enabled it for your someone else's laptop), you don't notice the SSID and WPA key got reset?

Re:Comcast routers

[Anonymous Coward]

Wonder why Comcast is not in trouble for hacking if they change the password you set yourself...

Because it's not your device, it's theirs.

Re:Comcast routers

[Anonymous Coward]

Would that be any different to having no wifi password by default?

Re:Comcast routers

[L4t3r4lu5]

Unique != Secure. If the two are in any way related (Key = base 16 encoded SHA1 of SSID + salt, for example) then the key can be broken trivially.

Basically, I don't trust you (the company) to not be lazy^Wcost-effective in your key generation procedure. There are numerous sites listing tables of default keys for brands of router, ripe for abuse. Those could only have been leaked by an insider (which means you've kept a copy of all of the keys, for some reason) or they weren't truly random, and therefore insecure.

Re:Comcast routers

[DNS-and-BIND]

"Customer CPE"?

Yeah, I believe you work at Comcast.

Re:Comcast routers

[Anonymous Coward]

In my area, pings are under 15ms to Comcast's peering location 50 miles away.

Re:Comcast routers

[Anonymous Coward]

I believe the correct term is "Customer CPE Equipment"

Re:Comcast routers

[redback]

ATM Machine

Re:Comcast routers

[wvmarle]

Yes; for the very fact that the user thinks the password protects them, while in reality it's not so much. More and more users these days are aware of the idea of password protecting wifi networks. Routers should simply require the user to set a password (or intentionally open up the network) on first installation - using some kind of setup tool and network cable.

Re:Comcast routers

[BrokenHalo]

I have one of the devices referred to in TFA (since I now live out in the sticks and can't get anything better) and discovered this flaw straight away. Telstra supplies a unique SSID/WPA password on a printed card, but the device also has a generic username/password combo for its own login page.

The good news here is that this login profile doesn't have sufficient privilege to change much in the way of settings, but it's an ugly situation nonetheless.

Re:Comcast routers

[Anonymous Coward]

You should also point out that residential and business Comcast customers have very different support methods.

I was a comcast residential customer for about a decade and I brought my own cable modem. Comcast had complete control over it - probably due to the tftp configuration loads. I dunno. I sorta freaked me out.

About 2 yrs ago, my company decided to put a business-class connection into my home. Comcast provides the router - they own it. I cannot replace it. Comcast manages the WAN connection and has root on that router. They manage the routes for all 5 IPs, using the highest as the gateway for all the others - that's fine, actually seems pretty smart to me.

I have a customer administrative login, but if I change that password - I use a password manager - it locks me out. I've contacted the business-class support team 4 times about this. No one there even knows the real rules for password complexity OR length. The Tier-3 (or was it 4?) guy I finally got hold of was bored and we tested for about an hour on a Sunday morning. He claimed that the router root password was changed daily to prevent technicians that left the company from screwing with clients. The "custadmin" password could not
* be 20 characters long
* have any punctuation or special characters
* have more than 1 digit
Basically, it was alphas with 1 number and short. This bothered me. Most of my passwords are 50+ characters - heck, it is in a password manager so I'll never need to type it anyway. Longer is better than shorter provided the internal hash supports it, right?

I should point out that I worked for AT&T and deployed a DSL CPE management system for them. I was in the systems architecture group - not the daily, ops groups. Managing the end-device password is the easiest part of the problems folks. There are all sorts of complications like firmware updates for 30 different devices, which level of encryption does each device support, what happens when 10 million devices all get power cycled around the same time and check for firmware updates within a 2 hour period?

With u-verse it is even more complicated. I left that position before u-verse was being rolled out, so I do not know the details.

Re:Comcast routers

[Type44Q]

Cradlepoint routers each have a unique password encoded in the firmware...

Re:Comcast routers

[AmiMoJo]

That's why Sky did in the UK. Their routers generated the WPA key from the wifi MAC address and the SSID was hard coded, along with the customer's ADSL login details. Totally insecure.

Re:Comcast routers

[AmiMoJo]

Most people don't ever change the password. As long as it is securely generated in the first place that isn't too much of a problem, except that Comcast engineers can probably access your internal network whenever they like.

Re:Comcast routers

[bhmit1]

Hardcoded initial passwords should never be used for anything other than the first access to a device (after a reset) to configure it with the customers own password and settings. It should also not be usable from any public facing interfaces, but that's a side issue. This is no different from being given a temporary password and told to change it when you first login to a computer or web site.

Leaving default passwords, even if they are unique per device, exposes the security risk that someone will discover those passwords. With unique passwords, all someone needs to find is the database or printing records used to create all those unique labels, or they can discover an algorithm used to generate the unique passwords. Once hacked, unique passwords provide only marginally better security than identical default passwords, but they create a bigger issue because of the false sense of security they have given users that assume they are secure.

Re:Comcast routers

[realityimpaired]

More likely, they do what Bell Canada does, which is to have the firmware read the serial number and apply an algorithm to that in order to create the default SSID/key on each modem. On the 2Wire modems, the default SSID was always BELL{last 3 digits of s/n}. I never did figure out what the algorithm was for the default key, but it is different on every modem, and on the Sagemcom modems, it's a different algorithm to figure out the default SSID as well.

Re:Comcast routers

[jameshofo]

Well I can't speak to Xfinity, but I know my FIOS router has a hardcoded _default_, but having the ability to change that in the UI does not make the wifi password/key itself hard coded. If you can change it through the software interface it is not by definition hard coded, and yes the article cites "unchangeable default logins".

Re:Comcast routers

[wed128]

Thats how *Comcast's shitty* hardware works.

FTFY. There are better ways of doing things...

Re:Comcast routers

[geminidomino]

Full disclosure: I am not an engineer Comcast, but a lowly technician. When a firmware update goes through, it resets defaults on everything. Thats how hardware works.

Reason 0xF21C to never use Comcast as a provider.

Re:Comcast routers

[alexandre]

Not mentionning that Bell forces people to rent a VDSL modem even when they are not their customer! :(

This is what I've gathered from forums and verified from the latest modem they seem to be shipping for VDSL service:
http://wiki.reseaulibre.ca/hardware/modem/vdsl/sagemcom/F__64__ST2864/

If anyone manages to rip Bell's parallel connection from there it'd be nice, though I'm wondering why they are the only one managing the firmware upgrades (and the many backdoors!)

Re:Comcast routers

[X0563511]

Who says you have to explicitly code it in? It could be derived from the device's S/N or MACs.

Re:Comcast routers

[green1]

But can this login page be accessed from the WAN side of the device? if so, it's a serious security flaw. If not, it's not that big a deal as you likely already have physical access to the device anyway.

Re:Comcast routers

[green1]

Possibly, but not necessarily. I have yet to find any way of doing that for the devices we use (I'm not saying it isn't possible, but the searches I've done so far have come up blank)
And if there is in fact no way to link the 2 (say that the SSID and WPA key truly are randomly generated separately) then how is this still a bad practice?

Re:Comcast routers

[bleh-of-the-huns]

The hard coded default.. is not actually hard coded. The Actiontecs just use the mac address as the default password, and I believe the Serial number as the SSID (I forgot, I have not used it in years, I completely bypassed it with the use of a dlink MOCA adapter to my FBSD firewall.

Re:Comcast routers

[StuartHankins]

If the wifi use is that occasional, why not just turn it off? Seems like just another security hole. Maybe you're using some combo device instead of a separate WAP. Still seems easier to just unplug the WAP when not in use.

Re:Comcast routers

[tlhIngan]

Unique != Secure. If the two are in any way related (Key = base 16 encoded SHA1 of SSID + salt, for example) then the key can be broken trivially.

Usually the default SSID is based on the WiFi MAC address, while the default password is based on the serial number of the device (which isn't broadcasted over the air, but which the ISP knows since they have to activate it). The serial number is typically the unique ID assigned to the WAN side port...

Re:Comcast routers

[cusco]

In my neighborhood, only three miles from downtown Bellevue, Comcast was the ONLY high speed connection available until last year. When dealing with existing infrastructure in established neighborhoods you frequently don't have much choice.

Re:Comcast routers

[canadiannomad]

No network setup tools... Just if the router isn't configured yet, the network should be "open" but force redirect any page request to the configuration wizard page (maybe with a default password or require serial number or something to prevent accidentally letting someone change settings who shouldn't). That should walk them through setting a password, selecting an SSID, setting a wireless password, and writing it down in the manual..... It isn't high security, but at least those that need that type of walk thru are given a viable option.

Re:Comcast routers

[cusco]

Century Link **IS** Qwest. Some executive decided that changing the name would somehow magically improve revenues, so USWest became Qwest which became Century Link.

Re:Comcast routers

[cusco]

You would be amazed at the number of SECURITY devices which don't even allow you to change the default password, cameras especially. As a policy we recommend to customers that they not purchase Camera X because of this reason, but if that's their company standard that's what we have to install. Even on those which allow password changes none of our competitors change them unless the customer specifically requests it (and not even then if they think the customer won't check). In 90 percent of cases when we have to work on a system that we didn't install we can just look up the default password, log in, and take over the device. Of all the IP security camera vendors, only Axis and Pelco seem to have any concept that a security camera should actually be secure.

Re:Comcast routers

[Anonymous Coward]

> YMMV... my pings are about 30ms to google and 20ms when using comcast as a WAN link to our corporate office.

And here is my 200+ ms ping to speedtest.net from Comcast:

http://www.speedtest.net/result/2168496420.png

I don't understand why someone would defend Comcast. Is it Stockholm syndrome?

Re:Comcast routers

[Anonymous Coward]

> Always assume your pipe is compromised and use end-to-end security...

True, but here's an example of where I screwed-up. An iptables rule to open MySQL to only what you would assume are local addresses:

iptables -A INPUT -p tcp -s 10.0.0.0/8 --dport 3306 -j ACCEPT

And the grant to allow access including updates to any table:

GRANT ALL ON *.* TO 'mysql'@'10.%' IDENTIFIED BY 'deletedpwd';

Both are very common examples you see documented in lot of places from books to product documentation to web pages. With my Comcast connection, I see a lot of traffic from other 10/8 addresses. I've even seen connections to port 3306 from outside of my own network. With my back-up CenturyLink connection, I have never seen traffic that wasn't destined to my static IP addr. The Comcast connection is bridged, and the CenturyLink connection uses layer 3 routing. It is superior for security.

Re:Comcast routers

[thegameiam]

My complaint is that the comcast wireless router I was given doesn't let you disable the wireless! I have a much better Apple wireless router, and now this crummy one interferes with it. Grr...

Re:Comcast routers

[mk1004]

Actually, it should read "When you're deploying CPE..." CPE = Customer Premises Equipment. It's an acronym used by several telcos, not just Comcrap.

Re:Comcast routers

[Anonymous Coward]

Maybe it's just you. Here is my 174 ms ping to the same server you used. Oh, yeah - I'm just outside Washington DC.

http://www.speedtest.net/result/2306174807.png

I don't understand why someone would assume their experience is everyone's experience. Is it some sort of delusion? Extreme self-centeredness?

Re:Comcast routers

[BlueBlade]

A firmware shipping with default settings isn't an example of hardcoded credentials. They're just default, not hardcoded. Hardcoded means that there are credentials that are inside the source code itself and they always work, no matter how the device is configured.

By definition, if the credentials can be changed by simply configuring the device, they aren't hardcoded.

Easy fix

[Artea]

Chances are this is the remote admin password for easy customer service. The devices are probably just rebranded Netgears or Belkins. Flash the firmware from the Vendor's support site, and clear off the Telstra "customer friendly" version of the firmware and this becomes a non-issue. I recall even manually adding a variable into the url enabled "advanced mode" to change this stuff without flashing the firmware.

Re:Easy fix

[Artea]

After bothering to Read TFA, these are Netcomm mobile broadband modems. So disregard nearly everything except the vendor firmware bit I guess.

Re:Easy fix

[green1]

What's the likelihood this is even a remote exploit? I bet it's a LAN admin password, (the article doesn't say) which means that 99% of the routers are no less secure because of it. (in most cases if you are connected to the LAN, you already have physical access to the router, and there's nothing much that secures it against that)

Re:Easy fix

[WaffleMonster]

What's the likelihood this is even a remote exploit? I bet it's a LAN admin password, (the article doesn't say) which means that 99% of the routers are no less secure because of it. (in most cases if you are connected to the LAN, you already have physical access to the router, and there's nothing much that secures it against that)

Welcome to the global good luck alchemy network (GGLAN) where we turn your bad luck into good luck. Glum? Tired? Board? We can help! To get started

<A HREF="http://192.168.1.100/does+something+really+bad">Click here</A>

Re:Easy fix

[kiddygrinder]

it *looks* like (shitty article) that you can bypass unique wireless passwords with a default admin password.

Re:Easy fix

[Wandering Voice]

Reminds me of when a spam email went around in the late 90s or early 00s which informed people of a virus infection and if you had an AOL icon on your desktop, you were infected. Hahah. AOL was flooded that day with tech support calls from many who were not able to dial in. Post a similar threat warning on Facebook (fAOLbook?) and we'll have come nearly full circle again.

Re:Easy fix

[Hal_Porter]

Hey! He read the TFA! We'll have to keep and eye on him and put a bullet in his brain when he turns

Re:Easy fix

[Anonymous Coward]

people still capitalize html tags?

Re:Easy fix

[green1]

That's not how I read the article at all, the way I read it was that if you were already connected to the wireless (or wired) network, you could log in to the router with a default password to be able to change the wireless settings. Which is a much less severe problem.

Of course, as you point out, the article is awful, so there's no real way of telling which one of us is right, or even if we're both wrong and it's something completely different.

Re:Easy fix

[green1]

That's assuming that there is in fact also a way of passing dangerous information to the device by requesting a specific URL, And that you can even enter the username and password through the URL request as well. Sure, that would turn an almost non-issue in to a moderately bad exploit, but it also seems like a large stretch from what was listed.

More the reason ...

[lsllll]

... for Open Source. Compile it yourself if you want to, or download it from a reputable place and trust it.

Re:More the reason ...

[Cimexus]

Or, indeed, try to avoid using the modems/routers sold by telcos/ISPs. The ones they try to sell you usually suck anyway ... I've always preferred to use my own. Bought a good high-end ADSL2+ modem/router quite a few years ago and it's served me well through 3 or 4 ISPs.

Also, people should be avoiding Telstra as a matter of principle anyway :)

Re:More the reason ...

[Midnight Thunder]

... for Open Source. Compile it yourself if you want to, or download it from a reputable place and trust it.

For the non-tech that's akin to doing brain surgery, so that changes nothing. For the average tech, downloading a precompiled firmware is still preferable in many cases. Having the source available will allow more eyes on it and the chance to improve it, but still an easy option to 'make firmware' and be done is appealing.

Re:More the reason ...

[mjwx]

Or, indeed, try to avoid using the modems/routers sold by telcos/ISPs. The ones they try to sell you usually suck anyway ... I've always preferred to use my own. Bought a good high-end ADSL2+ modem/router quite a few years ago and it's served me well through 3 or 4 ISPs.

This. Most ISP's including good ISP's like iinet and Internode (now part of the iiborg) sell the finest, cheapest Belkin for about twice what you'd pay outright for them. I think an ISP sold Fritzboxes for a while (but they may have become part of the iiborg by now). If you want a quality ADSL modem/router for use with an Oz ISP you need to buy it yourself. Chances are it'll be cheaper than going through an ISP anyway. (you can take my Linksys WRT54G from my cold dead hands, I'd probably die of old age long before it did).

Also, people should be avoiding Telstra as a matter of principle anyway :)

To be fair, Telstra Mobile pre-paid is not bad these days for price, speed and coverage. VHA and Optus both have terrible networks, plus I refuse to do business with Optus on principal. However I'd happily avoid Telstra's other services.

Re:More the reason ...

[Anonymous Coward]

This. Most ISP's including good ISP's like iinet and Internode (now part of the iiborg) sell the finest, cheapest Belkin for about twice what you'd pay outright for them. I think an ISP sold Fritzboxes for a while (but they may have become part of the iiborg by now).

Internode don't sell Belkins, but they do still sell Fritzboxes.

If you have a MAC...

[Nutria]

Step 1 of 3: Install the BigPond Elite Network Gateway on a Windows computer by using the installation USB stick that came with your kit.

WTF are these people thinking?

Re:If you have a MAC...

[crafty.munchkin]

You should've seen the installation tech who came to install Bigpond Cable at our office. He needed a PC to activate it, I brought out my linux laptop - I've never seen anyone so confused. He asked for Internet Explorer, I told him he could have Firefox or Chrome. I think he nearly cried.

Re:If you have a MAC...

[DarwinSurvivor]

We have a friend that works for HP, so we got him as our rep for maintaining our business line computer. We were having an issue and he decided the best thing would be to update the firmware (it was fairly out of date). That was when we both realized he had no idea how to do it from a non-windows computer. Turns out all you have to do to "reimage" an hp printer is *litterally* print the firmware file from any computer!

Re:If you have a MAC...

[green1]

I install ADSL service for a Largish telco. I am always THRILLED when someone brings out a computer that isn't running windows. The reason? Windows machines support our company's software install, which is mandatory, can't be skipped, and takes 15 mins+ to install the first time you open a browser. However, if you are using a Mac, or Linux, or various other devices, the software install fails right away, gives you a warning telling you that your system doesn't meet our minimum requirements, and then without further ado activates the connection so everything works. Net benefit is that it saves me 15+ minutes, and the customers are happier because they don't have 4 more programs installed on their desktop!

Re:If you have a MAC...

[Anonymous Coward]

Imagine if it was a server without X/vnc.
Lynx, emacs, or nothing!

Re:If you have a MAC...

[SeaFox]

Forget the platform restrictions. Since when does one need to "install" a piece of hardware that's supposed to function independently of a computer.

Anytime I see instructions saying I need to install software for a router to work I mentally add "so we can install our spyware on your computer" to the step.

Re:If you have a MAC...

[wvmarle]

The last few times I had Internet installed at either office or home, the tech always took their own laptop to set it up. So at least he has all the tools he needs at hand. I really don't understand that Bigpond Cable tech didn't carry his own laptop...

Re:If you have a MAC...

[Nutria]

Those are *completely* absurd statements that indicate an *utter* lack of comprehension as to how computer and peripherals actually are and how they work.

Besides being stupidly paranoid.

Re:If you have a MAC...

[Joe_Dragon]

and you don't get a black mark for a no install?

Re:If you have a MAC...

[Anonymous Coward]

Lmao -- so, a -1 eh? That's a bit self-congratulatory, since anyone WITH a brain knows that Apple's ENTIRE MARKETING SCHTICK has been derivations of "Hey, we' know y'all are WAAY to stupid to use REAL computers, but that's okay, because we dumbed-the-shit WAY WAAAY DOWN for you! -- AND we're even happy to treat y'all like the nigh-retarded-school-children y'are to boot! All of which will ONLY cost you a 25% premium on the price! (and a 90% reduction of autonomy)" ...to which Apple users all loudly cheer, and carry on with their mindless idiotic ways... (usually going and getting back in line at the Apple store for whatever the iShit is that'll be released tomorrow, and which makes the iShit they bought yesterday obsolete)...

-AC :)

Re:If you have a MAC...

[kiddygrinder]

that is kinda ingeneous

Re:If you have a MAC...

[Maow]

Those are *completely* absurd statements that indicate an *utter* lack of comprehension as to how computer and peripherals actually are and how they work.

Besides being stupidly paranoid.

Then explain why a router would need any software on a PC to make the router run?

DHCP should be all that's needed, and it ought to be part of a base install of all systems out there.

Re:If you have a MAC...

[Anonymous Coward]

Router software (if provided) is basically a config file that sets up permissions etc. A good one can save lots of work.

Re:If you have a MAC...

[oobayly]

Don't ascribe to malice ...

One of our [self employed] brokers called me over to have a look at his laptop - BT (UK ISP) help centre wanted to update. Out of morbid curiousity I ran it. All it was was an program that launched a URL in Internet Explorer (not the default browser) and took you to their help website (no activex etc). What the fuck did it need to be updated for? All they needed to do is create a http shortcut on the desktop or start menu, but no, some dimwit decided they needed an executable to do the job. Probably because they got a splash screen.

Re:If you have a MAC...

[Neil Boekend]

Isn't that usually done with a simple webinterface?

Re:If you have a MAC...

[SeaFox]

They could.

I know from personal experience that they generally are not good, and are more work than just telling the user how to access the web-based admin interface.
Is there any reason this easy setup wizard couldn't be just part of the web admin? Nope.

Re:If you have a MAC...

[Nutria]

You need to re-read the OP.

The Windows-only software is needed to install updated router firmware. The firmware that comes factory-installed on the router doesn't need Windows.

(That's still an incompetent updating method; other routers have had browser-based updating for 10 years.)

Re:If you have a MAC...

[crafty.munchkin]

Well, that WAS an option, but I was hoping to actually complete the install, rather than have him crying in a corner and reporting it couldn't be done... ;)

Re:If you have a MAC...

[crafty.munchkin]

You clearly haven't encountered Telstra, and all their incompetence.

Re:If you have a MAC...

[green1]

I think you misunderstood. It's not mandatory that I run some install CD or something like that, it's that the first time you try to access the internet your browser redirects you to a webpage that forces you to install software before it will let you access the internet. For non-windows machines it simply bypasses the software install because it's windows only software. but on windows machines it won't let you access the net unless the software fully installs.
My ratings for installs are based on several factors. To get credit for doing the install I just have to say I'm done and fill out my time sheet, but I also get marked on whether the customer had to call back in within the first 7 days, and on a customer satisfaction survey done by phone the day after I complete the job, I also get one random job a month inspected by one of our quality inspectors.

So no, I'm quite happy if their system doesn't support our software install. It means I'll likely get a better rating on the satisfaction survey, and it saves me time. It's win-win. I just wish I could convince our higher-ups that nobody actually wants that stupid software installed!

Re:If you have a MAC...

[cusco]

Wow, I haven't seen anything like that since the late '90s. Don't know how many times I killed the 2mb USWest "mandatory" download (after which it would connect fine) on our 28.8 modem, before my wife logged in and let it complete.

Re:If you have a MAC...

[green1]

On our system, it's not just downloading it, you can't get online until it installs successfully and reports back that it did so. Or you can simply not run Windows (which is my preferred option anyway)
On a side note, Android phones are a good way around this too (iphones and ipads can't even get far enough to "fail" though so you can't get online that way)

Re:If you have a MAC...

[ColdWetDog]

However, if you are using a Mac, or Linux, or various other devices, the software install fails right away, gives you a warning telling you that your system doesn't meet our minimum requirements, and then without further ado activates the connection so everything works.

Words fail me.

Re:If you have a MAC...

[green1]

I should clarify, only one device in the house needs to go through this process before everything has full internet access. so use your android phone first, and then your widows PC won't have to get the software.

Re:If you have a MAC...

[green1]

The failover part where it warns you and then lets you continue to a working connection is the one part that's done right. The alternative would be that it insists you somehow find a windows machine to install on when you don't want it.

Of course I still think a better option would be allowing a connection from the start without forcing the software on anyone... but I don't get to make those decisions.

Re:If you have a MAC...

[Anonymous Coward]

So, why don't you just get a laptop of your own that's otherwise a POS and install a Linux instance? The use that?

Re:If you have a MAC...

[green1]

A few reasons. First of all it would be a big violation of company policy, and could get me fired. Passive options like registering the user's Android phone before their windows desktop are one thing, but dragging in another device specifically to counteract company policy? That sounds like a recipe for getting fired.
Beyond that, I don't believe I should have to use any personal equipment at work, any tools needed for my job are supplied by the company, I'd like to keep it that way.

I don't always agree with company decisions, but they are my employer, there is only so much I can do to bypass their decisions without risking my job.

Not surprised at all.

[crafty.munchkin]

Telstra are a notoriously dodgy company with a history of being idiots when it comes to customer's privacy and account security. Have a read of this for one of their latest privacy blunders...

Re:Not surprised at all.

[SirAdelaide]

...and for this reason, if someone chooses them as their ISP, then having a backdoor to their network probably IS necessary, as they are the type of person who will forget their password and lock themselves out of their router, and not be able to find the factory reset. Telstra were just being proactive in their service offering. For this same reason, noone that cares about security was affected.

Re:Not surprised at all.

[mjwx]

Telstra are a notoriously dodgy company with a history of being idiots when it comes to customer's privacy and account security. Have a read of this for one of their latest privacy blunders...

Never blame malice for what can easily be blamed for stupidity.

Telstra's consumer level staff are notoriously incompetent. Their linesmen are generally OK (thanks to the union pushing for training) but their helpdesk/home support is an insult to trained monkeys everywhere.

Re:Not surprised at all.

[crafty.munchkin]

I agree re helpdesk, and I'd like to agree with you re linesmen, however at my former employer, it took 13 visits by linesmen to get 6 lines installed at new premises, over the course of 3 months. It was an absolute disaster.

Re:Not surprised at all.

[tlhIngan]

Never blame malice for what can easily be blamed for stupidity.

Telstra's consumer level staff are notoriously incompetent. Their linesmen are generally OK (thanks to the union pushing for training) but their helpdesk/home support is an insult to trained monkeys everywhere.

Actually, in this case, it's probably the manufacturer of the router. Basically the ISP says "I want a modem+router for CPE (customer premises equipment), and I'll pay you $20 per unit". Yes, CPE is built down to a price because the ISP doesn't want to pay much for it. So shortcuts are always taken to meet the requirement - cheap processors barely able to keep up, low features, barely the minimum amount of RAM, etc. Which is why these routers will flop if you try to push any traffic more demanding that websurfing through them. No ISP cares about what it does - as long as it lets traffic through.

The only way to get things properly done is get a modem only if you can, get it set to bridge mode if you can't (or supply your own if it's an option - this isn't necessarily the case). Use your own router, because the router they give you will be crap, and there's a reason why routers sell for $20 and $200.

Re:Not surprised at all.

[kiddygrinder]

heh, their help desk is hilarious, had to get a dsl password reset, after 30 mins on the line to one of their staff from Papua New Guinea (i believe they actually give them english lessons to get them into the role) and them attempting to sms me the new randomised password 5 times and receiving nothing we were at an impasse. i gave up for the night, called back the next day to get one of their remaining australian staff, he reset the password and told me it over the phone and i was rolling. about a week later one of the sms came through with my new *email* password. efficient.

Re:Not surprised at all.

[mjwx]

I agree re helpdesk, and I'd like to agree with you re linesmen, however at my former employer, it took 13 visits by linesmen to get 6 lines installed at new premises, over the course of 3 months. It was an absolute disaster.

Were they Telstra linesmen or contractor linesmen?

The old Telstra employed ones were good, the contractors are shite. A lot like Aus Post, the old posties used to be decent, the contractors throw parcels out the window of their van, you're lucky if it hits near your front door.

Unfortunately, shite contractors are what happens when you farm work out to the cheapest contractors.

I feel like this post should end with a stern warning for young people to vacate my greenery.

Re:Not surprised at all.

[crafty.munchkin]

They were Telstra linesmen for almost all of the visits. The contractors actually bothered to contact me when they were coming - the Telstra tech's just turned up, did the work incorrectly, and then left. The last one who came was a contractor, and he fixed up the patching to the MDF from the building sub-exchange on all six lines. Even he couldn't believe how badly it had been botched. Crossed pairs, pairs tagged incorrectly, and since Telstra only issued one job for one line at a time, this had meant so many different visits.

To be fair the building sub-exchange was a confusing point for them all. After the 8th visit turned out to not have any tags at the MDF, I put up a sign on the sub-exchange door. As to the following 5 visits, well, who knows what those morons were smoking.

Re:Not surprised at all.

[oztiks]

Funny story about Telstra. Wife called them up concerned that she couldn't find the latest Twilight movie on TBox. Sufficed to say the "accented man" Filipino / Indian guy gave her a bittorrent address and told her she can download the movie from there :)

Re:Not surprised at all.

[cowstaker]

FYI I work for Telstra. Telstra carries secure networks for foreign governments, defense departments and large corporations. There is a large difference between an enterprise product and one for a consumer. Given the size and scope of the company, and the inevitable nature of dealing with customers and employees, situations like this simply happen. Judge the company on the response not on the issue itself, especially considering that our routers are sourced from an external company. I guess this is a case of we sold you the rope with which you hang us. At some point every carrier in Australia uses our plant or equipment ranging from fully provisioned data networks to rack space and so on. I would object to the label of dodgy when clearly we have a transatlantic network that is sufficient for you to post on slashdot with.

Re:Not surprised at all.

[Anonymous Coward]

Yea, the prison colony is not known for its ... robust or well thought out network infrastructure.

Re:Not surprised at all.

[realityimpaired]

I would object to the label of dodgy when clearly we have a transatlantic network that is sufficient for you to post on slashdot with.

Assuming you actually do work for Telstra, I can judge the company as quite dodgy, and completely incompetent based on this statement alone: Australia is in the Pacific, not the Atlantic, and if your network is transatlantic, you clearly have no idea what the hell you're doing.

Re:Not surprised at all.

[Anonymous Coward]

I would object to the label of dodgy when clearly we have a transatlantic network that is sufficient for you to post on slashdot with.

I agree with your objections. Having worked with Telstra as a web hosting partner and used them as a customer, I label them as fucking dodgy.

When working with them as a web hosting partner: even a single-line change on a web page required sign-off from 45 line managers; they threw about terms like "blade server" and "SSO" (Single-Sign On) with no clue as to what they meant or how to use them; half their business processes are run out of Excel spreadsheets. Excel is not a fucking database!

When using them as a customer my custom e-mail address had been registered in their web portal for a good four years with no problem. Within four days of e-mailing them from that address with a technical support enquiry I started receiving SPAM/UCE on it trying to sell me iPhone applications. But no, of course they don't sell e-mail addresses to spammers. Liars. Arseholes. Fucking dodgy.

So what are they?

[Xtifr]

Don't be coy. What are these passwords? :)

Re:So what are they?

[Anonymous Coward]

Id wager it is:
123456
or
admin

Re:So what are they?

[Macgrrl]

I thought they picked something secure like Hunter2?

Re:So what are they?

[Anonymous Coward]

Here you go:

Hard-coded credentials and command-injection vulnerabilities on BigPond 3G21WB

ADVISORY INFORMATION
Title: Hard-coded credentials and command-injection vulnerabilities
          on BigPond 3G21WB
Discovery date: 17/09/2012
Release date: 11/10/2012
Credits: Roberto Paleari (roberto@greyhats.it, @rpaleari)

VULNERABILITY INFORMATION
Class: Authentication bypass, command-injection

AFFECTED PRODUCTS
We confirm the following device models to be affected:
      * BigPond 3G21WB

Similar routers are probably vulnerable to these very same issues.

VULNERABILITY DETAILS
The firmware running on the affected routers is subject to multiple security
issues that allow an unauthenticated attacker to gain administrative access to
the device and execute arbitrary commands. In the following paragraphs we
describe the details of the vulnerabilities we identified.

a) Hard-coded credentials
      A user can authenticate to the web server running on the device using the
      credentials "Monitor:bigpond1". These credentials are hard-coded, and cannot
      be changed by a normal user.

b) Command-injection vulnerability
      The "ping.cgi" web page is subject to a command-injection vulnerability, as
      the server-side script does not properly validate user-supplied input.

      The following URL exploits this issue, executing the "ls /" command:
      http:///ping.cgi?DIA_IPADDRESS=;%20cat%20/etc/passwd

REMEDIATION
We are not aware of an updated firmware that corrects the issues described in
this advisory. We suggest users to disable web access on the WAN side.

DISCLOSURE TIME-LINE
        * 17/09/2012 - Initial vendor contact.

        * 18/09/2012 - Vendor replied asking for details.

        * 19/09/2012 - The author replied and asked for a technical
                                      contact. Disclosure date set to October 10th, 2012 (3
                                      weeks).

        * 19/09/2012 - Vendor replied, providing the phone contact number of the
                                      Technical Support Department.

        * 20/09/2012 - The author replied, asking to keep all the communication
                                      through e-mail, in order to keep track of the whole
                                      conversation.

        * 24/09/2012 - No response from the vendor. The author re-sent the last
                                      e-mail.

        * 04/10/2012 - No response from the vendor. The author re-sent the last
                                      e-mail (again).

        * 11/10/2012 - Still no response from the vendor. Disclosure.

DISCLAIMER
The author is not responsible for the misuse of the information provided in
this security advisory. The advisory is a service to the professional security
community. There are NO WARRANTIES with regard to this information. Any
application or distribution of this information constitutes acceptance AS IS,
at the user's own risk. This information is subject to change without notice.

Re:So what are they?

[WGFCrafty]

12345

Re:So what are they?

[leathered]

I thought they picked something secure like *******?

I don't get it, why would you want ******* as a password?

Re:So what are they?

[oodaloop]

That's the kind of password an idiot would use on his luggage!

What's the IP block for D'OH!

[Chas]

You'd think these people would learn.

But NOOOOOOOOO!

Why not just pre-infect the fucking things and sell them to a damn botnet...

Idiots...

Merely a time saving measure

[Grayhand]

Just image all the man hours of hacker's time think saved! If only other companies were as forward thinking.

No problem

[slazzy]

This is why I always change my password to "secret" right away.

Re:No problem

[ArcadeNut]

Damn it! Now I have to change my password! Thanks!

Re:No problem

[dcrisp]

Damn right!.. I use that one as well. Everybody[1] keeps telling us that the password must be secret. So I made it secret.
[1] The Royal Everybody.

Re:No problem

[trancemission]

Surely "itsasecret"

Re:No problem

[Anonymous Coward]

Don't you know, when you type in your pw, it come out as "secret".

"secret"

See. I just type in my password...it's a little bit more advanced than displaying asterisks foreach character...

A flaw, really?

[JayTech]

Just a simple flaw? That's what they want you to believe. Hard-coded passwords are NOT a flaw, they are an intention back door for... company engineers... company spies... the government... Just sayin'!

Re:A flaw, really?

[fuzzyfuzzyfungus]

Just a simple flaw? That's what they want you to believe. Hard-coded passwords are NOT a flaw, they are an intention back door for... company engineers... company spies... the government... Just sayin'!

It isn't an either/or.

Hard-coded credentials are a backdoor, whether covert or just buried in fine print; but they are a flawed backdoor because they are far too trivial for malicious 3rd parties to exploit on top of the intended malicious users.

Something like, say, an SSH client with a hardcoded public key, to which The Man holds the matching private key, is a non-flawed intentional backdoor; because it keeps unintended 3rd party malice to a minimum, while still letting the backdoor users in.

Neither is desirable, from the user point of view; but they are very different things.

Re:A flaw, really?

[bmo]

>Something like, say, an SSH client with a hardcoded public key, to which The Man holds the matching private key, is a non-flawed intentional backdoor; because it keeps unintended 3rd party malice to a minimum, while still letting the backdoor users in.

Until the private key gets leaked.

Key escrow is always bad.

--
BMO

Re:A flaw, really?

[JayTech]

I used a little hyperbole to make a point about the passwords being a backdoor. Your argument is valid, absolutely; but that assumes The Man is efficient and crafty - none of which are generally equated with governments these days. This is a lazy man's backdoor, through a gate that appears to be normal both inside and out. On the other hand, a black hat implementing your proposed covert SSH backdoor would fit right in line with their known weapons of fear, surprise, and ruthless efficiency.

Re:A flaw, really?

[Anonymous Coward]

Now I fear that the Spanish Inquisition is behind all this.

Re:A flaw, really?

[Anonymous Coward]

Key escrow is great if you're the guy who wants to create a backdoor. Remember that to "The Man", as the GP puts it, perfect security is a flaw in itself. The ideal situation for him is that he has a copy of every private key, and nobody else does. That's pretty much key escrow.

If The Man's copy of private key gets leaked then security is lost, but that's true however many people had it to begin with.

Re:A flaw, really?

[bmo]

>If The Man's copy of private key gets leaked then security is lost, but that's true however many people had it to begin with.

"Three can keep a secret, if two of them are dead." - Benjamin Franklin.

I reiterate: key escrow is always bad.

--
BMO

Aussie cousins to NSA/CIA?

[Anonymous Coward]

A family member works for Comcast (I won't say what his position is). The person commented that, "In the United States, that'd be the sort of thing the NSA and CIA would use for access. They have back-doors into everything."

Sasktel is the same

[xQuarkDS9x]

I found out last year when me and my girlfriend moved into this apartment together that Sasktel (DSL internet provider for Saskatchewan Canada) apparantly also uses 2wire Routers/gateways and this one was literally screwed into the wall with a mounting bracket. Also disturbing was just doing a quick google search and sure enough in under 30 seconds I found default passwords for 2wire routers/gateways... what a suprise.

As I have been an Access Communications customer for years with a cable modem and my own router currently using a Linksys WRT400N and before that a Linksys WRT54GS that I donated to my sister a couple years ago I basically said screw sasktel called up Access and they setup my VOIP phone server and internet access.

Funny thing is you use any wi-fi device to look for routers nearby and you see about 20-25 2wire(3 digit number here) routers then my router that I named "2 Girls 1 Router" just to be different and hopefully give some people a laugh. :)

Re:Sasktel is the same

[xQuarkDS9x]

Meant to say VOIP phone service and also meant to add that man oh man do they ever try to shove sasktel down your throat when we moved in... if you didn't know about Access Communications which competes with them in this province especially if you moved in from out of province or from a different country you'd probably get suckered into Sasktel and their crown corporation garbage.

Re:Sasktel is the same

[Anonymous Coward]

Yes but does that default password do anything from the wan side? Does the default password get you onto the network? Or is that the password to login to administer the router once you're already inside the secure lan?

HP printer firmware upgrade via print ?

[johnjones]

are you serious ?

so your telling me that I can screw your entire print service and DOS it by sending it a print job ?

is this only over USB or Networked as well ?

(this is not a bad solution to upgrade the firmware but I bet they dont sign their firmware only use a magic hexcode to initiate the upgrade )

regards

John

Re:HP printer firmware upgrade via print ?

[dbIII]

so your telling me that I can screw your entire print service and DOS it by sending it a print job ?

That sounds like HP all right. A simple nmap portscan kills their Jetdirect cat5 to parallel boxes dead. Not factory reset dead, but desolder a chip and replace it with a new one dead.

Re:HP printer firmware upgrade via print ?

[azalin]

fun times. That reminds me of the (far less lasting) joke of sending a raytracer written in postsrcipt to the printer. Took about half an hour for the single page to print.

Re:HP printer firmware upgrade via print ?

[DarwinSurvivor]

It's a network printer and yes, I was amazed at how rediculously insecure it was as well. Even if they DID sign it, and I'm certain they don't, all it takes is for HP to release 1 buggy version, which would be signed, for someone to screw up a printer. BTW, you can also print (and update the firmware) over an unprotected FTP port which is enabled by default.

In other words, thou shalt firewall thine printers!

Re:HP printer firmware upgrade via print ?

[girlinatrainingbra]

Is that kind of problem the reason that they invented PDF format so that PS programs that might run for too long got truncated into known-to-stop printing commands?

Re:HP printer firmware upgrade via print ?

[Shimbo]

so your telling me that I can screw your entire print service and DOS it by sending it a print job ?

..and halt and catch fire, possibly. http://redtape.nbcnews.com/_news/2011/11/29/9076395-exclusive-millions-of-printers-open-to-devastating-hack-attack-researchers-say

HP do now support code signing, whereas previously they had code singeing. And of course, everyone with a networked HP printer has applied the patches, right?

Re:HP printer firmware upgrade via print ?

[ediron2]

I'm hearing similar rumblings for a high end LG fridge. Think we're going to be seeing more of this as time goes by...

Telstra-Microsoft Sales Conspiracy?

[Anonymous Coward]

Seems Telstra's upgrade page has a small sales conspiracy to get users away from Macs. From the upgrade instructions:

If you have a MAC

Step 1 of 3: Install the BigPond Elite Network Gateway on a Windows computer by using the installation USB stick that came with your kit.
Step 2 of 3: Follow the upgrade instructions for Windows users above.
Step 3 of 3: Once you've upgraded your device, you can continue using your device on your Mac as normal

Cisco

[BlackPignouf]

Cisco has backdoors too
https://www.networkworld.com/community/node/57070

Isn't that common practice?

[aaaaaaargh!]

In Portugal, the passwords of the routers of the biggest telecom (TMN) are available and easy to find on the Net, and each router doesn't have just one but usually several admin and root accounts. I guess they think that as long as you can access it only from LAN and via "official channels" that's secure enough.

Re:Isn't that common practice?

[Inda]

I thought it was common too.

There's an app on Google Play that tries default passwords on wireless access points. I forget its name, as I only tried it a few times, and routers I was trying to connect to probably didn;t have this exploit.

ezNetScan rings a bell.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Why worry about Huawei?

[gtirloni]

I think Telstra is doing a fine job on screwing .au

Re:Why worry about Huawei?

[fa2k]

Well sure, but now all Australian hardware has to be banned because this is clearly intentional government spying. Telstra was even part of the Australian government :O

Sounds like a reasonable way to proceed

[golodh]

Explained this way (the hard-coded password device-specific and printed on a sticker inderneath it), what you sketch here sounds practical and thoroughly reasonable (something you couldn't possibly guess from the usual Slashdot headlines though).

username admin : password admin

[Anonymous Coward]

I have worked for telstra in the past in tech support for their broadband department (BigPond). The default username and password for most routers provided by tesltra is admin/admin. It has been this way for years over multiple incarnations of router. Their own troubleshooting guides list these passwords and usernames and recommend that if the customer cannot gain access to their router they factory default the router which will re-set the username/password and the ssid/wpa keys (These are unique to each device and printed on a sticker attached to each device at the base).
It is a trivial matter to gain access to any telstra customers router if one has physical access to the router and slightly more difficult but still possible to gain remote access via wifi and reset the router remotely via SSH. The scariest part is that some lines of telstra supplied modems including the latest releases, have the firewall disabled by default, the vast majority never change this, and the router/modem allows remote login via the internet (This 'feature' is also used by support to enable easy set-up of new installs remotely). There is no way for a telstra customer to properly 'secure' their wifi and router without using SSH and a complex set of commands that is well beyond the understanding of the majority of telstra customers and there is absolutly no way to secure a telstra supplied modem from someone who has physical access.

Comcast did the same thing

[koan]

Set up neighbours Comcast router they bought from Comcast only to discover it had a fixed password, you would have to flash it to get rid of the password.
Not something my neighbour even knows about or can do by himself.

This saves a lot of time and money

[sl4shd0rk]

* Do not have to wait for customer to come back from lunch to get passwords when in field.
* No danger of leaving password written down on sticky note
* Saves money in costly bandwidth due to encrypted data
* Lowers customer's TCO; no encryption royalties

You're on Telstra...

[Anonymous Coward]

If you're on Telstra, you have nothing worth a hacker's time. Continue as you were...