Did a weak WiFi password lead police to our door?

Re:Did a weak WiFi password lead police to our door? by bserge on Sunday May 23, 2021 @05:02AM (#27253468)

Those routers don't have particularly bad default passwords iirc, 12-14 random chars, which is better than the vast majority of user-set passwords. I don't remember if it uses WPS 1.0 (why is there even a 2.0 of this horrible "feature"?), that would be the easiest way to access any router.

Why would the would-be hacker need access to the router settings? I can't think of anything worth changing there, these routers don't have any extra features.

The usual illicit use is to point an antenna at a router and use it from afar (well, no more than 100-300m, line of sight and preferably no obstructions).

In which case it makes more sense to just get a prepaid SIM card, set up a phone as a VPN in a location far from you and route traffic through it. It's not more complicated than bruteforcing a WPS PIN or WPA2 password. That is, if you can't just get a VPN without using any ID.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by Orphis on Sunday May 23, 2021 @05:22AM (#27253581)

I remember stories of the default password being a weak hash of the SSID. And when those are "ISPNAME-4DIGITS", it's not too hard to collect them all.

Sometimes, they can be retrieved from the MAC address as well. So it's just the illusion of security for most.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by serf on Sunday May 23, 2021 @05:27AM (#27253606)

verizon just recently stopped defaulting the wep key to a very simple hash derived from the ssid and mac.[0][1]

[0]: https://www.xkyle.com/verizon-fios-wireless-key-calculator/

[1]: https://aruljohn.com/fios/

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by yrro on Sunday May 23, 2021 @08:57AM (#27254692)

Verizon CPE still uses WEP?!!?

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by serf on Monday May 24, 2021 @12:49AM (#27261157)

I don't know about elsewhere , but Frontier took over FiOS management in some regions and continued to push those same APs for a long while.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by gnfargbl on Sunday May 23, 2021 @06:23AM (#27253922)

> Those routers don't have particularly bad default passwords iirc

I just checked, and the default credentials for the HHG2500 model mentioned in the article were admin / vodafone1234.

It isn't clear to me whether the router's admin interface was default open on the WAN side, or whether it could be remotely enabled through TR069. I wouldn't be at all surprised if it could.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by midasuni on Sunday May 23, 2021 @06:15AM (#27253865)

Those reports often have the wpa password printed on the back - I’ve seen more than one person with it on their windowsill, visible from anyone at the door.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by dpwm on Sunday May 23, 2021 @05:23AM (#27253583)

> It's not more complicated than bruteforcing a WPS PIN or WPA2 password.

In the UK a prepaid SIM is normally linked to you in some way.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by maccard on Sunday May 23, 2021 @06:33AM (#27253967)

You can walk into many shops (including sainsburys te#co and Morrison's) and buy a sim card and top it up there and then with cash.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by pbhjpbhj on Sunday May 23, 2021 @11:00AM (#27255426)

Have you done it? I thought I recalled needing a bank card to activate a free SIM.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by maccard on Sunday May 23, 2021 @01:32PM (#27256827)

I was actually in sainsburys this afternoon so I bought one with my trolley pound, no ID needed!

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by bserge on Sunday May 23, 2021 @05:59AM (#27253772)

In what way?

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by dpwm on Sunday May 23, 2021 @06:22AM (#27253913)

Some are not really pre-paid, you have to go online to activate them, or have to order them online, or have few options but to top up by card.

However, I just looked into it some more and it appears you can still buy prepaid cards by cash and buy top-up vouchers with cash.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by bserge on Sunday May 23, 2021 @06:35AM (#27253978)

Yes, you can get and top them up with cash, at some dinky corner shop with non-functional cameras. Or just buy a bunch of them on Gumtree, also in cash.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by hfkfmtkrkf on Sunday May 23, 2021 @06:33AM (#27253966)

You can still be on the camera of the shop which sold you the sim card if they recorded the serial number.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by pbhjpbhj on Sunday May 23, 2021 @10:57AM (#27255405)

I don't think you can get a SIM in the UK without providing ID? I'm not sure if it's a financial liability issue, or a legal requirement.

[ Parent | on HN ]

Re:Did a weak WiFi password lead police to our door? by pbhjpbhj on Sunday May 23, 2021 @02:21PM (#27257252)

Seems I was mistaken, or it's changed: https://news.ycombinator.com/item?id=27256827

[ Parent | on HN ]