Slashdot Mirror
Lizard Stresser DDoS-for-Hire Service Built On Hacked Home Routers
tsu doh nimh writes: The online attack service launched late last year by the same criminals who knocked Sony and Microsoft's gaming networks offline over the holidays is powered mostly by thousands of hacked home Internet routers, reports Brian Krebs. From the story: "The malicious code that converts vulnerable systems into stresser bots is a variation on a piece of rather crude malware first documented in November by Russian security firm Dr. Web, but the malware itself appears to date back to early 2014. As we can see in that writeup, in addition to turning the infected host into attack zombies, the malicious code uses the infected system to scan the Internet for additional devices that also allow access via factory default credentials, such as 'admin/admin,' or 'root/12345.' In this way, each infected host is constantly trying to spread the infection to new home routers and other devices accepting incoming connections (via telnet) with default credentials.
Factory passwords is what separates humans from the beasts.
Dark Helmet: So the combination is... one, two, three, four, five? That's the stupidest combination I've ever heard in my life! That's the kind of thing an idiot would have on his luggage!
Get free satoshi (Bitcoin) and Dogecoins
Because it would be an exceptionally onerous burden to bear to, say, randomly generate a password that gets printed on a piece of paper that ships with the router.
We are not gods, after all.
You already have to do that with the MAC, the s/n, etc. so what difference does it make?
Just make the default password be the serial number of the device.
Right because its completely impossible you could ever visit a site with some malicious site that runs a little JS to build a form on the fly and submit forged request to your internal router if it were completely unauthenticated.
Don't be stupid, while its a good control to only allow these things to be managed from the inside, and you probably don't need to go overboard you DO need at least a username and password and you DO need to change the defaults!
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Why do all routers of the same model need to come with the same initial credentials?
It makes printing the manual and setup instructions easier.
It makes writing any 'plug-in-and-configure' style utilities easier.
It makes providing support easier.
It saves a step of changing the password for each unit after its made and flashed, documenting the new password, and including a printout of that new password in the shipping materials.
I'll just leave this here : http://www.cbits.co.uk/ourblog...
I'd like to see the router simply refuse to communicate with the outside world until that username/password combo is changed. You can print the default user/password right on the device, so when you forget the password you can simply reset to factory settings - and trying to access any site will instead redirect you to a "Hey, change this password!" notice.
If 2Wire (the worst fucking router manufacturer on the planet) and ATT (if not the worst, in a close race with Comcast) can manage it, ANYONE can!
Routers are configured with an individual MAC address (which is stored in the configuration flash partition and printed on the label on the bottom of the device), so configuring a random default password and printing that on the bottom of the device is hardly extra work. AFAIK all router manufacturers currently do this. In the past, some manufacturers derived the wireless LAN key and the device password from the MAC address, which was a stupid idea and led to exploits. Devices with static default passwords are probably mostly legacy devices which are still in use (or business grade devices, where this practice is still common).
Most home routers I've dealt with don't enable remote administration by default. Allowing administration from outside one's LAN seems like a more serious problem than using a default password.
Oh! I know this one!
World Wide Web, right?
Not random enough I'm afraid - If you understand how the s/n is formatted, you can brute force the password rather easily.