Nobody likes security that gets in their way. A friend of mine found a 3com wireless router that didn’t have WEP enabled, which is common enough, but also had the default admin password. So he was able to get in and (if he had wanted to) reconfigure his neighbours router.
You can change the admin password when setting it up, but clearly people sometimes don’t, because it’s getting in the way of their goal which is to get online. And nobody wants another password to remember.
If I was designing a wireless router, I’d probably have a button on it that needed to be pressed to let a browser into the admin interface. Then I’d let you optionally set up email-address/password combos afterwards for the (few?) who wanted to reconfigure it remotely.
January 12, 2006 at 2:39 pm |
Interesting idea, with the button. But to somewhat take away your point (sorry), all routers I’ve setup’ed required a plugged in connection by default to do configuration. So you cannot re-configure your neighbours router unless you break in and put the network cable in
January 9, 2008 at 5:30 pm |
> But to somewhat take away your point (sorry), all routers I’ve setup’ed required a plugged in connection by default to do configuration.
I’ve seen enough WLAN routers that do allow web-browser-based administration both on the wired LAN ports and when using the WLAN.
There are also some routers in use that can be configured over the internet. And there are users that put these things online without having any kind of clue, so they don’t change the default password. And default passwords are damn easy to find out. Some years ago, I set up a WLAN router for a friend, which had this stupid default config (administration over port 80, reachable over the internet, default password was just “admin” or something alike, also the default password was enclosed in the HTTP basic authentication request (“Enter admin password, ‘admin’ if you didn’t change it.”)).
It was even possible to dump the complete configuration to a simple text file, which contains all passwords in clear text (administration password, WEP keys, and the credentials for the DSL line the router was hooked up to)!!! To make matters worse, these same credentials can be used to log into the portal of the DSL provider, where you can use the feature “Rechnung online” (online invoice). This online invoice does (if you book this option) contain a “Einzelverbindungsnachweis” (log of every call done, with timestamp, the number of the callee, how long the call lasted, etc.). So if someone “hacks” one of these boxes over the internet (by simply pointing any browser to the IP address), he or she can basically reconfigure the bow, use the credentials to surf the net, and find out if you called any sex hotlines late at night (which is perfectly legal in germany, but still, most probably don’t want some random hacker to know all this …).
I was completely flabbergasted how many security mistakes have been made all at once, this is simply beyond me. I won’t tell any names, but the company is a huge german internet and telephone provider and uses the color magenta much.
Of course, we set up everything as secure as possible (for example, the administration can be set to wired LAN only), but I don’t want to know how many of these completely unsecured devises are still in use around the globe, happily waiting for bored script kiddies with port scanners …