Comment by Kenji | Hacker News Reader

Comment by Kenji | Hacker News Reader

• 29% of all devices tested had at least one default username and password stored in the firmware, enabling access to the device if administrators don’t change these credentials.
• We identified 76 instances of firmware where the device was, by default, configured such that a root user with a hard-coded password could log in over the SSH protocol, providing for default backdoor access.
• 8 different firmware images were found to have pre-computed authorized_keys hard coded into the firmware, enabling backdoor access to the holder of the private key.

• 424 different firmware images contained hardcoded private SSH keys, which can enable a man-in-the-middle to manipulate and/or decrypt traffic going to the device.

What a witch hunt... This is state of the art in the industry. Everybody does it like that. No intelligence agency has to be involved at all, it's basic negligence. If you're behind a NAT, your device is unlikely to be attacked via these vectors.

Negligent or malicious, no matter which, I would not want to deploy devices that had hardcoded ssh private keys.

Default passwords can be dealt with.

How many companies would be left on the market if a default password or hardcoded account or sloppy programming was enough to put them out of business? If we treated them all the same.

A default password and hardcoding a private key are two very different things.

Yes, it is. I'm just pointing out that defaul password was a common practice couple of years ago, and one of the companies caught with hardcoded private key is Cisco. If we treated them all like Huawei, we wouldn't have much of the infrastructure left. Which means the whole affair around Huawei is blown out of proportions.

So I am reminded of the difference between "he attacked them because he was evil" and "he attacked them because he was insane". So, while this might make some difference in how you feel about it, but either way you need to lock them up (albeit perhaps in different places).

If they are grievously incompetent at security, or they are intentionally installing backdoors, might make a difference in how we feel about it, but in neither case should we allow their products to be used.

Exactly, every vendor has default passwords. If you are doing things right all default credentials are changed or disabled. Access to any service is firewalled off or better yet only accessible out of band on a dedicated management network.

This is changing. I've seen a number of ISPs no longer have default passwords. Each router or modem has a random password string set to the device, it's printed out and pasted as a sticker on the modem (or some print directly to the plastic). A lot of big name devices do this now too.

Sure it's a password written on the device, but it's random, you need physical access to see it, and people who are security conscious can change it.

This bad practice isn't excusable, especially not by a company as big as Huawai, not if they want to be taken seriously.

It's definitely a good development that ISPs have started to deploy routers and modems with randomized passwords. However, please do keep in mind the deployment of consumer equipment and enterprise hardware is different. Or at least it should be, in theory.

Enterprise equipment is usually not supposed to be just dropped into place, without oversight. It usually needs proper configuration/management, by qualified people.

Whether this also happens in practice can be a different story altogether. Still, the security of enterprise equipment usually involves more policy and procedure than it does with consumer equipment. With the latter, security has to come more or less by default, because the people handling the devices usually have little expert knowledge.

From what I have seen where I live, printed passwords on things like home routers and VDSL/Fiber modems provided by major ISP's are for 802.11 stuff (WiFi passwords) and not for the devices management interface. This may have changed since I last looked into it a few years ago though. There was also the whole Netgear router "backdoor" port thingy (a device shipped by a major ISP) which I actually had to exploit to recover my password after forgetting it once, which was kind of amusing.

Juniper doesn't. There is no password on the device when you power it on.

When you get a new device, in order to save your initial configuration on it, you have to set a password.

Cisco used to ship with zero config on their devices and part of the setup process was setting a password as well.

Cisco never requires a passsword to be set. iOS prompted for a password during the easy configuration but if you dropped in, via console or Tftp, a config over you can configure it without a pw.

Later versions did not allow passwordless ssh but still allowed it via telnet. Cisco’s ACI platform enforces password on the initial account, then with some smarts you could disable it in OpenLDAP

If you consoled into easy mode you defo could set a pw there, or skip it. I still don't get why they don't make you set at least one password, but some of it also stems from the architecture of the OS AFAIK.

So would a "different password for each device programmed at the factory" approach (as Comcast/Xfinity/Att and others currently do, at least in the US) be better? This would make it better in the sense that only Huawei would know about the default password for that piece of hardware [if they were to log it].

Reply on news.ycombinator.com