Slashdot Log In
Convicted VoIP Hacker Robert Moore Speaks
Posted by
ScuttleMonkey
on Wed Sep 26, 2007 05:35 PM
from the kind-of-thing-an-idiot-would-have-on-his-luggage dept.
from the kind-of-thing-an-idiot-would-have-on-his-luggage dept.
An anonymous reader writes "Convicted hacker Robert Moore, who will report to federal prison this week, gives his version of 'How I Did It' to InformationWeek. Breaking into 15 telecom companies and hundreds of corporations was so easy because most routers are configured with default passwords. "It's so easy a caveman can do it," Moore said. He scanned more than 6 million computers just between June and October of 2005, running 6 million scans on AT&T's network alone. 'You would not believe the number of routers that had "admin" or "Cisco0" as passwords on them,' Moore said. 'We could get full access to a Cisco box with enabled access so you can do whatever you want to the box. We also targeted Mera, a Web-based switch. It turns any computer basically into a switch so you could do the calls through it. We found the default password for it. We would take that and I'd write a scanner for Mera boxes and we'd run the password against it to try to log in, and basically we could get in almost every time. Then we'd have all sorts of information, basically the whole database, right at our fingertips.'"
Related Stories
Submission: Convicted VoIP Hacker Robert Moore Speaks by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Geico commercial filming (Score:4, Funny)
So, not only do cavemen work in video production, they do network admin?
Re: (Score:2)
Re: (Score:3, Funny)
Re:Geico commercial filming (Score:5, Funny)
No, read more closely. He wasn't talking about cavemen in general. He was talking about one particular caveman. [wikipedia.org]
Parent
Obligatory... (Score:5, Funny)
Re:Obligatory... (Score:4, Funny)
Parent
Well (Score:5, Insightful)
Re:Well (Score:4, Informative)
Parent
Re:Here's one I do (Score:5, Interesting)
I think I had 5 routers in my neighborhood on channel 6, with default passwords.
I logged on into each and switched them to different channels.
Parent
Re: (Score:3, Insightful)
I should hope if they are knowledgeable enough to want their router configured that way they would also know to change the password from the default.
Re:Well (Score:5, Insightful)
Easy solution - disable the product until the password is changed and intercept http connections so you can give people a helpful page saying "The default password is 'password'. This must be changed before this router/switch can be used. Click [here] to do so."
I fail to see any flaws with this solution. Also read 'The Design of Everyday Things'.
Parent
Re: (Score:2)
I suppose that you probably don't. So let me help you out. The first problem you are going to encounter is that something like 15-20% of the customers are goijng to take an utterly irrational "It's MY router. How about you clowns let ME determine how to configure it?" attitude The second is that quite possibly a small percentage of them will actually need to run with default passwords. You can't imagine why.
Re:Well (Score:4, Insightful)
Considering that you get folks like SAC who set the PAL codes for all their nukes to 00000, yeah there will always be people that bypass it. But at least won't be because nobody touched it at all -- someone had to run the setup. And when users get cranky and bypass it, then it's now 100% their problem. Especially when the SOX auditors come knocking.
Parent
Re: (Score:2)
Presumably these devices don't route packets, handle VoIP calls, etc. until you've at least put in basic network settings anyway. Seems like all you really need to do is make the device ask you to set an initial password as the very first step in the setup process.... It isn't rocket science. It's like when you get a UNIX account on some university box. They set an initial password based on your student ID/name/whatever. and the very first thing is a prompt that requires you to set a real password....
Re: (Score:3, Insightful)
Users must be protected from themselves for the good of the whole. We don't allow people to drive 100MPH on the highway. We don't allow people to shout 'fire' in a crowded theater. What are people going to do, not use their computers? We're way past that point. The PC has become as important
Re: (Score:2)
Re: (Score:3, Interesting)
Are you sure it's the user?
So, let me ask you this - why is the default password on routers all the same? Why isn't it different for each unit, and imprinted on the box or something? Such a trivial thing to do, yet it would do so, so much for improving security, and would have a trivial effect on usability.
Routers are security devices. Other security devices (such as bike locks) have the default being rather secure, why can't route
he should study more (or moore) (Score:5, Funny)
Apparently Moore's law isn't quite up to snuff.
Random passwords (Score:4, Interesting)
- They must run a test suite before shipping them so it should be easy to make that tool generate a random password and assign it to the router
- You would have to print it on the router, or on a slip of paper
- If it is printed on the router itself then you could make the router's reset button go back to that password, instead of Cisco0.
Even if you don't implement that last bullet, it still seems like it would help a lot.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
No, they mustn't. Frequently, if your production QA is good you don't do 100% testing before shipping. Random sampling is usually good enough and significantly cheaper. I can't speak to any specific router manufacturer, but this is SOP in manufacturing.
Re: (Score:3, Interesting)
Every device with an Ethernet interface has a 48-bit unique identifier built in. All such devices, in my experience, also have a sticker that displays their Ethernet address. Would it be so difficult to include, at manufacturing time, a small ROM that contained an initial password, unique to each device, and also displayed on a sticker? The additional cost of such a feature needs to be weighed against the additional security provided, but I think in some markets it would be a definite win.
The manufactu
Re: (Score:2)
Either way, this is going about it the long way. The simple solution is to make it so you have to change the default password the first time you config the device. Feel free to leave it "admin" from the factory, as long as it can't be "admin" after it gets configured.
Re: (Score:2, Interesting)
Re:Random passwords (Score:5, Funny)
That's actually not so bad. In order to get on the wireless network to use the admin password in the first place, they would need to guess your SSID and WEP key. And everyone knows that's impossible, right?
-:sigma.SB
Parent
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Defaults (Score:2)
Ridiculous! (Score:3, Funny)
That's ridiculous. Everyone knows the most commonly used passwords are "love," "secret," and "sex." Oh and don't forget "God." It's that whole male ego thing.
Re: (Score:2, Funny)
Re: (Score:2)
Mess with the best, die like the rest!
"Pool on the roof. Sprung a leak."
"And yes, Mom, I'm still a virgin!"
"Crash 'N Burn"
eof.
Damn... (Score:4, Funny)
Yay for VPNs (Score:2)
-b.
Re: (Score:2)
So easy a caveman could do it (Score:4, Insightful)
So easy a caveman could do it.
But apparently not so easy a caveman could avoid getting caught?
What ever happened to the supercool hacking-thang called "not getting caught"?
- Jesper
Re:So easy a caveman could do it (Score:5, Funny)
It could even be happening right now...
Parent
Re: (Score:2)
1.) Hack stuff using script-kiddie techniques
2.) Keep at it until you are caught
3.) Tell everyone the story about you being an idiot who got caught
4.) Do a month of jailtime
5.) $$$!
Is that the kind of people who programmed my personal firewall and my anti virus app.?
(Pleeeease, say "no", pleeeease, pretty-please)
- Jesper
And which heads will roll? (Score:3, Informative)
The REAL problem I see with IT is a combination of inept administrators and an abundance of managers who don't understand the significance of things like this. A mistake like this not only represents a failure of an IT worker, but poor oversight by their manager. I've seen an administrator hired who had no technical competence but was able to talk to the managers about cricket. He was then replaced with a person who was even worse when the first dumb admin did the IT thing and left after making a huge mess. And yeah, a year after I'd left, the second administrator, after purchasing a new Cisco router with zero scoping calls me up and asks, "How do I install a Cisco router".
There are books out there like "The practice of system and network administration", they help new administrators immeasurably, but so many just don't give a damn. There needs to be more incentive to have serious consequences for sloppy work. If we're ever going to be taken seriously, we need to find and flog administrators who set up a production router/firewall with a default password.
Re:And which heads will roll? (Score:4, Insightful)
Now imagine that you want to change the passwords. You can't bring the network down or impact any current work. Networks of this size are constantly being modified. New devices added, routes being updated/refreshed. Redundancy deployed or a failure causing it to be exercised.
AND you are a business - the people making decisions don't know anything about security - the only question is "what will all this work do to make more money?" Nothing? Then don't do it.
Tracking 80,000 passwords isn't easy. During emergencies - your phone won't ring - your mother with a pace maker needs 911, not having access to the password in a switch that needs to be reconfigured manually isn't a good excuse.
Ok, 1 of those hundreds of people leave the company. Do you change all the passwords
I've never seen a switch or router guy that wasn't overworked. Just like security folks.
Anyway, just a few thoughts. It is never as simple as it seems.
BTW, I worked at the big telecom company that wasn't hacked. I've since moved to a different telecom that is constantly being hacked and in the news for it. Until a few months ago, they had laughable security standards that seemed left over from 1990 to me and a flat network. Simply stupid, but being secure is a huge undertaking that isn't just network security, as you know. Only security failures get Executive attention, sadly.
Parent
The problem lies with vendors? No! (Score:2)
I don't think so Alan. The means is there for an able bodied person to setup appropriate credentials within a few minutes. Most of these stupid logins are web based anyway. You click "Admin" and then "Change Password" and things are a lot better than they were a couple minutes ago. The biggest problem is unskilled technical people in po
And what is the 1st thing you do (Score:4, Informative)
Nice to know telecom companies don't have a clue.
Re:At least that "Hacker" actually used some skill (Score:3, Funny)
Re:Solution: Eliminate Product-wide Default Passwo (Score:2)
Re: (Score:2)
That's pretty hard considering the host name isn't assigned until the OS is installed.
Re:Solution: Eliminate Product-wide Default Passwo (Score:2)
That way the bad guy would need physical access to the particular box to read that label to get what he needs to construct the default password. (Since it's a default password the "view the label" hole could be instantly plugged just by changing it.)
(Not from the MAC address, of course, nor the serial number if that's available i
Re: (Score:3, Funny)
Not if he exploited it and kept it hushed up. (Score:5, Insightful)
If he told the owner about the insecurity and didn't exploit it himself, yes.
imagine what havoc he could have made if he had been malicious, or had sold the passwords to Osama....
Or if he kept it quiet and exploited it himself - stealing services and running up bills for the victimized system owners, building a business on it and pocketing money for himself and his co-conspirators.
Wait... That's what he did, isn't it?
No, he should not be congratulated. He should be convicted and punished as the thief he is.
Wait... That's what happened, isn't it?
Isn't it nice
Parent