Dutch ISP Discovers 140,000 Customers With Default Password 99
bs0d3 writes "In Holland, a major ISP (KPN) has found a major security flaw for their customers. It seems that all customers have had the same default password of 'welkom01'. Up to 140,000 customers had retained their default passwords. Once inside attackers could have found bank account and credit card numbers. KPN has since changed all the passwords of the 140,000 customers with weak passwords. They also do not believe anyone has actually been burglarized since discovering this weak spot in security."
Verizon online (Score:5, Interesting)
had to ban the password abc123 on thier ADSL network years ago..
Once upon a time... (Score:5, Interesting)
When I was a sysadmin at a certain Bible college known for its weak security, I collected the password hashes of the students & faculty and ran them through a cracker (John the Ripper if I remember correctly), then sent out a mass email with the decrypted passwords, sorted by the amount of time it took to crack them.
Yeah, the majority of them were cracked within five seconds. Of course, I omitted the information on just whose passwords they were.
Dunno if it resulted in anyone actually doing something about their passwords though.
Re:It's the ISP's fault (Score:5, Interesting)
Further, why was the credit/bank information displayed in full? Isn't that stuff usually masked out? I think all services that I subscribe too usually just show the last 3-4 numbers of the account information, for this reason (in case login credentials are stolen).
Re:Verizon online (Score:2, Interesting)
KPN has since changed all the passwords of the 140,000 customers with weak passwords. They also do not believe anyone has actually been burglarized since discovering this weak spot in security.
It's a shame KPN changed their passwords for them. They were about to learn a valuable lesson!
The reasonably intelligent people only had to hear about one instance of fraud, one example of ID theft in the news, to understand that they need a decent password. Idiots don't learn the easy way like this. Idiots only ever learn the hard way. I don't agree with that but I respect their right to learn any way they want to. It's called freedom.
Re:It's the ISP's fault (Score:5, Interesting)
OTOH, I wonder if all 140,000 customers who used the default passowrd actually USED the account? It sounds like it was a customer service portal thing - not something they normally login with. For those people, they probalby managed their account by phone rather than thinking to log into the customer service potral and do all their changes there?
Re:It's the ISP's fault (Score:2, Interesting)
they don't use security by obscurity when it comes to bank account numbers, it's like an address. Most payments above a hand full of euros are done by bank transfer
Now what is that called, security-through-the-honor-system?
Come on, try to think about it. Do you rely on keeping your house address a secret as a protection against burglary? Can anyone who knows where your house is take your stuff? Answer: no, there's a lock, with retina scan, a heavily armed robot, a shark pond (frickin lasers included).
Why should knowing your bank account number be enough to be able to take your money out of the bank? To take money out of your account two things are needed: to know your bank account number and to BE you.