Re:Car Wash Hack Can Strike Vehicle, Trap Passengers, Douse ...
by lithos on Saturday August 26, 2017 @09:54AM
(#15105442)
Even simple things like default passwords being the first few numbers of the products serial number wouldn't be that bad.
[ Parent
| on HN ]
Re:Car Wash Hack Can Strike Vehicle, Trap Passengers, Douse ...
by jimktrains2 on Saturday August 26, 2017 @12:17PM
(#15106074)
Only if the serial numbers were random and not, well, serial.
Re:Car Wash Hack Can Strike Vehicle, Trap Passengers, Douse ...
by sethhochberg on Saturday August 26, 2017 @01:11PM
(#15106309)
Given that the state of the situation now is often "learn one password, pwn the entire class of devices", a default that was vulnerable to literally any other vector of attack seems like a marked improvement. Its easier to protect against a brute force or dictionary attack on any individual device than it is to protect against a single magic default admin credential being discovered - rate limit password submissions, lock outs after subsequent failures, etc.
Sure, if someone can look at the sticker on the bottom of my router and see the serial number and learn the default password that way without having to attack it iteratively, thats still a problem. But a random default password would have to be communicated to the end user somewhere, too... and as with most things, by the time an attacker has physical device access you've already lost.
Re:Car Wash Hack Can Strike Vehicle, Trap Passengers, Douse ...
by jimktrains2 on Saturday August 26, 2017 @01:28PM
(#15106405)
But serial serial numbers would turn one password into a small handful, not that much better of an improvement.
A lot of routers come with random, long passwords printed on them as the default. No reason this shouldn't be standard.