Hacker News Reader

Comment by ambiate | Hacker News Reader

The amount of routers still using 'cisco/cisco' as a default password for full access is astonishing. Years ago, I saw backbones and OC3/12 cores using these passwords.

I know botnets are now considered the DDOS standard, but there are plenty of remotely controlled Cisco routers that can pump out more data than hundreds of thousands of bots.

My favorite is outer nodes that can get user access with "cisco", then, full access to an inner node using "cisco", then, reconnect to the outer node (from inside), and have full access. Vicious circle.

[1] http://packetstormsecurity.com/cisco/ciscos.c

View on HN

Not supprised and happens, almost as good as cut and paste admin flaws that happen. Still the humour of a program in C that looks for insecure routers and uses strcpy is not lost on me :).

True of many equipment using default user/pass combo's, perish the thought they forced a change upon bootup/configuration, but that should of been covered by CISCO admin 101 school. AS/400's, heck anything with default accounts can end up with those accounts left, the sight standard user admin acocunts installed and maintained to password standards with the out of the box ones still there.

Then we worry about home routers with default admin accounts - oh the humour of it all. Some managment will think CISCO - thats expensive so it is more secure and they can get cheap staff in. Well you see what happens then.

The worst part about this is that there is no default password. It's marginally worse than doing nothing - people just voluntarily use cisco/cisco because they don't care about security.

* technically on some of the newer routers and versions cisco/cisco is a default, but after the first login it's no longer valid.

but there are plenty of remotely controlled Cisco routers that can pump out more data than hundreds of thousands of bots

Have any examples? I would think that a router is less than ideal here, as most forms of traffic generation would involve the anemic CPU and control/mgmt plane.

I'm just speaking from experience from a few of the older IRC botnets I analyzed for a few years. Nearly 200,000 of the 750,000 (+-150,000) bots were on dial-up connections in developing countries.

Now, 200,000 packets coming in at 2.8KB/s is nothing to joke about(500MB/s). Yet, 500 packets coming in at 8MB/s, well, on top of the arsenal of random connections.

I sometimes forget I'm a dinosaur now when it comes to this sphere of knowledge! I'm sure these days its less one sided. It used to be dialup and windows 95/98 RPC vulnerabilities spreading in the wild using IRC as a middleman.

With tor, torrents, etc, I imagine the game has drastically changed in the past 6 years. It is too bad there are not many jobs in this field, I would gladly make a lifetime out of it.

I was on a team that created an anti-bot-net which would reinfect, secure, and alert of the already infected machine. We determined that it could prove to be more destructive than the original botnet, because it wastes resources, while we could actually impact the way a machine behaved for the owner. This could also lead to legacy machines failing due to windows updates or firewall rules.

> I was on a team that created an anti-bot-net which would reinfect, secure, and alert of the already infected machin

While I'm sure your intention was benevolent, I'm pretty sure that's illegal under current laws. There's probably a reason that reputable AV vendors don't use that practice; I would hate to have unknown entities helpfully "patch" my machine.

Exactly, which was the reason we retracted the project. It was truly the greatest learning experience of my life.

If I were a bad guy I would enter a single config line static routing some "chunk of the internet" at the victim. That loss of production traffic would likely be rather quickly noticed... but for a little while it could be pretty impressive.

Lets say you have a content provider (as opposed to an eyeball provider) and it hosts nothing in Chinese. So nearly all traffic from APNIC netblocks is botnets and spammers WRT your content so your firewall normally would dump it all. However an attacker could static route several /8 APNIC blocks to someone or something and all you'd notice is your firewall discarding less. Of course the poor guy its all static routed to (perhaps one of your own systems?) would see some weird stuff incoming.

Someone who knows what they're doing could have a lot of "fun" with a BGP speaking router depending on how intelligently its peers are configured.

Reply on news.ycombinator.com