Hacker News Reader

Comment by bserge | Hacker News Reader

Those routers don't have particularly bad default passwords iirc, 12-14 random chars, which is better than the vast majority of user-set passwords. I don't remember if it uses WPS 1.0 (why is there even a 2.0 of this horrible "feature"?), that would be the easiest way to access any router.

Why would the would-be hacker need access to the router settings? I can't think of anything worth changing there, these routers don't have any extra features.

The usual illicit use is to point an antenna at a router and use it from afar (well, no more than 100-300m, line of sight and preferably no obstructions).

In which case it makes more sense to just get a prepaid SIM card, set up a phone as a VPN in a location far from you and route traffic through it. It's not more complicated than bruteforcing a WPS PIN or WPA2 password. That is, if you can't just get a VPN without using any ID.

View on HN

I remember stories of the default password being a weak hash of the SSID. And when those are "ISPNAME-4DIGITS", it's not too hard to collect them all.

Sometimes, they can be retrieved from the MAC address as well. So it's just the illusion of security for most.

verizon just recently stopped defaulting the wep key to a very simple hash derived from the ssid and mac.[0][1]

[0]: https://www.xkyle.com/verizon-fios-wireless-key-calculator/

[1]: https://aruljohn.com/fios/

Verizon CPE still uses WEP?!!?

I don't know about elsewhere , but Frontier took over FiOS management in some regions and continued to push those same APs for a long while.

> Those routers don't have particularly bad default passwords iirc

I just checked, and the default credentials for the HHG2500 model mentioned in the article were admin / vodafone1234.

It isn't clear to me whether the router's admin interface was default open on the WAN side, or whether it could be remotely enabled through TR069. I wouldn't be at all surprised if it could.

Those reports often have the wpa password printed on the back - I’ve seen more than one person with it on their windowsill, visible from anyone at the door.

> It's not more complicated than bruteforcing a WPS PIN or WPA2 password.

In the UK a prepaid SIM is normally linked to you in some way.

In what way?

Some are not really pre-paid, you have to go online to activate them, or have to order them online, or have few options but to top up by card.

However, I just looked into it some more and it appears you can still buy prepaid cards by cash and buy top-up vouchers with cash.

You can still be on the camera of the shop which sold you the sim card if they recorded the serial number.

Yes, you can get and top them up with cash, at some dinky corner shop with non-functional cameras. Or just buy a bunch of them on Gumtree, also in cash.

You can walk into many shops (including sainsburys te#co and Morrison's) and buy a sim card and top it up there and then with cash.

Have you done it? I thought I recalled needing a bank card to activate a free SIM.

I was actually in sainsburys this afternoon so I bought one with my trolley pound, no ID needed!

I don't think you can get a SIM in the UK without providing ID? I'm not sure if it's a financial liability issue, or a legal requirement.

Seems I was mistaken, or it's changed: https://news.ycombinator.com/item?id=27256827

Reply on news.ycombinator.com