Forgot your password?
typodupeerror
Security China Networking Hardware

353,436 Exposed ZTE Devices Found In Net Census 29

Posted by timothy
from the login-and-password-are-the-login-and-password dept.
mask.of.sanity writes "Hundreds of thousands of internet-accessible devices manufactured Chinese telco ZTE have been found with default or hardcoded usernames and passwords. The devices were discovered in analysis of the huge dataset from the Internet Census run this year. ZTE topped the charts, accounting for 28 percent of all affected devices worldwide. Only one manufacturer has responded to the researcher's bid to supply the data in efforts to stop production of insecure devices."
This discussion has been archived. No new comments can be posted.

353,436 Exposed ZTE Devices Found In Net Census

Comments Filter:
  • I seem to recall a story or two about concerns regarding vulnerable Chinese telecom devices before. Didn't many people think it was nonsense?

    • by SQLGuru (980662)

      The concerns of the earlier articles were about back-doors. Default credentials is basically every device is enabled with admin/1234 and the users aren't educated (or forced) to change them. It's like how briefcases are initially set to all zeros and it's up to you to change the combination. The manufacturers either need to make the default credentials differ for each device or provide a LOT of education.

      • The story is about default and hard coded passwords. A secret hard coded password is a backdoor. Are all the hard coded accounts / passwords known?

      • by gweihir (88907)

        Indeed. This is just plain stupidity, not maliciousness. Of course, that will not prevent the NSA and others from using them.

  • by gsslay (807818)

    manufactured by Chinese telco ZTE.

    The original article was badly written and proof read, so naturally slashdot contains the exact same obvious error.

    • Re:By (Score:4, Funny)

      by EvilSS (557649) on Tuesday September 03, 2013 @09:10AM (#44745625)
      So the devices didn't manufacture a Chinese telco named ZTE? That makes this a much more boring story. Guess I have to put my "Rise of the Machines" supplies back in the closet now.
    • by Anonymous Coward

      The original article was badly written and proof read, so naturally slashdot contains the exact same obvious error.

      And the same error will likely not be fixed when they repost it again tomorrow.

  • Given how many internet devices are manufactured in China, wasn't it pretty foreseeable that the majority of devices with X were going to be found to have been manufactured in China?
  • by shentino (1139071)

    Who wants to bet that chinese intelligence was involved in this?

    • Re:heh (Score:5, Insightful)

      by Anonymous Coward on Tuesday September 03, 2013 @09:14AM (#44745651)

      Who wants to bet that chinese intelligence was involved in this?

      And we're supposed to trust US products don't have settings demanded by the NSA?

      Sorry America, but you're just as un-trustworthy these days, and your corporations are just an arm of your government for spying -- and your government is just an arm of your corporations for foreign policy

      A nice little incestuous feedback loop.

    • Re:heh (Score:4, Insightful)

      by Idimmu Xul (204345) on Tuesday September 03, 2013 @09:20AM (#44745687) Homepage Journal

      The default root password for every DRAC (Dell Remote Access Card) in existance is

      *Drumroll*

      calvin

      fucking american spies

  • by Anonymous Coward

    Is there any chance I could lease this phone botnet and get some one to write an algorithm that could help discover new ways to help viagra medication become even more effective? imagine 1 million CPUs working together helping the progress of boner pill technology.
    Its pretty clear this was the true intention of why China has so many backdoor phones out there, sheesh.

  • by Anonymous Coward on Tuesday September 03, 2013 @09:26AM (#44745729)

    Gaoke MC600x WiFi routers are used all over South America and probably elsewhere.

    They are installed by the telecom company and they do change the admin password. However, you don't even need a password, just go to the internet IP address of a device, the default is the web interface is visible from the Internet, and rather than logging in change the last part of the URL to wifilan.htm and it will think you are logged in as guest. The guest user can change all the WiFi settings.

    They may be insecure but at least they are cheap!

  • Blocking 23 (Score:4, Informative)

    by Gary Perkins (1518751) on Tuesday September 03, 2013 @10:11AM (#44746039) Homepage Journal
    His recommendation at the bottom is for ISP's to start blocking port 23. I certainly hope that doesn't become a "solution". Many people like to host their own servers, and these default port blocks just make life horrible. The BBS hobby scene uses 23 quite a bit and would take a hit. Blocking ports is not an answer, and in fact I'd like to see the practice banned.
    • by The-Ixian (168184)

      Agreed...somewhat. Port 23 though? really? Why would you not be using telent and not SSH to connect to any server from the outside?

  • by The-Ixian (168184) on Tuesday September 03, 2013 @10:28AM (#44746221)

    "A lot of devices and services we have seen during our research should never be connected to the public Internet at all. As a rule of thumb, if you believe that "nobody would connect that to the Internet, really nobody", there are at least 1000 people who did. Whenever you think "that shouldn't be on the Internet but will probably be found a few times" it's there a few hundred thousand times. Like half a million printers, or a Million Webcams, or devices that have root as a root password."

    It amazes me, still, how these things can happen. It really shouldn't, I am a contractor after all and have seen hundreds of different networks, large and small. Most with amazing security....deficiencies, usually done in the name of convenience.

  • The Chinese exploited a brain-dead obvious attack vector. Nobody checked. Nobody looked. Nobody cared. The empire rots from within.

  • by porjo (964384)
    From TA:

    "Shukla (the report author) was given exclusive access by the anonymous author to the sensitive data collected in the project (using an illegal botnet to scan the target devices)."

    Sounds just a little too convenient to me

Administration: An ingenious abstraction in politics, designed to receive the kicks and cuffs due to the premier or president. -- Ambrose Bierce

Working...