News for hackers. Stuff that matters.

A comment on Nissan code leaked after bitbucket repo set-up with defaults admin/admin.

Re:Nissan code leaked after bitbucket repo set-up with defau... by orev on Thursday January 07, 2021 @10:36AM (#25672170)
It’s absolutely inexcusable that in 2021 we still have apps that come with default credentials like admin/admin. You can yell at users all you want, but history has shown that is not good enough. The blame here at least partially falls on bitbucket for making it so easy to set things up in an insecure way.

To all developers reading this: it is YOUR responsibility to do everything you can to prevent your users from shooting themselves in the foot like this.

[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by bberenberg on Thursday January 07, 2021 @11:49AM (#25673423)
There are no default credentials in Bitbucket[0]. An admin manually set these at some point.

[0] https://confluence.atlassian.com/bitbucketserver/install-a-b...

[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by Mg6yDfjp5U on Thursday January 07, 2021 @10:53AM (#25672391)
Do you know of any resources describing this as a developer responsibility/best practice? I agree with you, but I'm looking for some independent resource that I can show to Business to convey to them the importance of this.

(Most resources I'm finding are only describing the importance of remembering to change the default password, rather than designing a system without a default password to begin with.)

[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by bob1029 on Thursday January 07, 2021 @11:00AM (#25672491)
Look at some practical implementations. E.g. Jenkins CI. When you first install it (the latest versions), it does not use default admin/admin credentials. What it does is produce a random password string that you have to go find on disk to perform the initial setup. At no point could someone without direct access to the machine get in before you are able to lock the door.
[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by isbvhodnvemrwvn on Thursday January 07, 2021 @11:17AM (#25672815)
While this practice is OK, I am not sure if Jenkins with its billions of trivial vulnerabilities in every other plugin is a poster child for security.

https://www.jenkins.io/security/advisories/

[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by JosephRedfern on Thursday January 07, 2021 @11:38AM (#25673219)
Which is totally irrelevant in the context of this discussion (which is on default passwords).
[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by tlarkworthy on Thursday January 07, 2021 @11:45AM (#25673345)
https://hdivsecurity.com/owasp-broken-authentication

"Do not ship or deploy with any default credentials, particularly for admin users."

Though I wish OWASP published this guideline too. (they do state this is a top 10 venerability, and the HDIV scanner looks for this to fix)

[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by tiborsaas on Thursday January 07, 2021 @11:53AM (#25673488)
You can try as hard as you want, but users will always find a way to bypass your precautions and shoot themselves in the foot.

There's also a danger that if you try to do this, then your product turns into a UX nightmare.

[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by orev on Thursday January 07, 2021 @12:38PM (#25674293)
Defaults matter. There’s a huge difference between starting an account with a complex password and then the user intentionally weakens it, vs starting with a weak password with a note saying “pretty please change it”. It’s obvious that some set of users will not change it, so it’s better to start in a default secure state than an insecure one.

And yes, sometimes security and UX conflict, and users just need to deal with it.

[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by tracker1 on Thursday January 07, 2021 @02:08PM (#25675696)
I tend to make a default passphrase of "Please change me." and require a password change on first login.
[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by gabereiser on Thursday January 07, 2021 @01:50PM (#25675400)
Yes but in this case there was no auth and the user setup admin/admin. This was a human.
[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by ericcholis on Thursday January 07, 2021 @11:02AM (#25672518)
Even routers these days have a random password assigned to them.
[ Parent | on HN ]