Indian broadband users at risk

Wow this was something I did not expect. But this surely did hit me hard the first time I got through it. It seems like I could access most Airtel Broadband users routers using simple telnet. Once I was connected, all that was required was username and password. Boy and I am in. I have access to the router now and I sure can do a lot of crazy stuff with it.

Wait a minute, did I say you need username and password. How would I get the username and password. Well actually not very difficult. Is it. No one ever changes the username and password of their router. Actually no one expects anyone to be able to access the router without their knowledge. But the sad fact is, anyone on the internet can access their router. Most people do not even realize that their internet connection can be easily compromised. How? Well simple steps to follow

1. Press Window Key + R  to open the Run Command Dialog

2. Press cmd (Enter)

3. Enter 'telnet xxx.xxx.xxx.xxx'

Where 'xxx.xxx.xxx.xxx' is the IP Address of someone from Airtel Broadband. Trust me, its not difficult to get the IP of any/random airtel user.

4. Now you would have to enter Username. Thankfully its 'admin' to just enter it and now the tough part, the password. But whats the password. Well password is 'password'. Well literally.

5. One you are through with it. You can enter 'sh' at the prompt. Now to have a simple Linux shell available to you. Now you can do a hell lot of things, which I leave to your imagination.

I blame no one but Airtel for this fiasco. Its their responsibility that when they install a connection for a subscriber, they should change the password. But first of all, a WAN side access to telnet should never be allowed in the first place. I am very sure that most people have no idea about it. Time awareness spread.

Well Airtel may not be the only one, infact I believe all broadband users are equally at risk. Though I could not get through Tata Indicom or BSNL connections, I am sure they too are equally susceptible.

I am going to the Security Camp happening in Bangalore this Saturday 12 July, 2008. Hopefully I will meet some people who will carry this message forward and generate enough awareness to make people secure.

 

PS: Please write about it in your blog too. If you dont have a blog, the least you can do is Digg it.

Comments

Arun said…
The max you can do is just restart the router.
August 12, 2008 8:28 PM
100rabh™ said…
:-)
as I said you need to use a lot creative skills. I dont want to let unsuspecting users get into trouble, nor want to teach hacking. But if someone is smart, he would know what to do :-)
August 12, 2008 10:44 PM
Arun said…
OK, I agree with you on this and also I want to add that I have noticed the same issue in some badly configured BSNL devices too.
August 13, 2008 8:53 PM
Post a Comment

Popular posts from this blog

[24th November 2024] Interesting Things I Learnt This Week

Image
1. AI Makes Tech Debt More Expensive - The core argument is that generative AI significantly widens the gap between codebases with low and high tech debt. Companies with clean code can leverage generative AI to write code much faster, while companies with messy legacy codebases struggle to adopt these new tools. This widens the gap between the two codebases, making tech debt even more expensive for companies with outdated systems. My Take : Legacy systems inevitably accumulate technical debt. A common analogy for this is the state of urinals over time: missed targets lead to increasing mess, keeps pushing people away from urinals and leading to more mess in turn. AI-powered coding tools could potentially accelerate the accumulation of tech debt. However, skilled engineers can leverage AI to reduce and even eliminate it. Ultimately, AI is just a tool, and human judgment remains crucial for making informed decisions. I hope AI will be used responsibly to drive positive outcomes. 2. Make...
Read more

[17th November 2024] Interesting Things I Learnt This Week

Image
 1. Booleans are a trap : Booleans, while seemingly simple, can introduce complexity and limitations into domain modeling. When used to represent complex states, booleans can lead to unclear code and potential errors. To avoid these pitfalls, consider using enums or enum sets. These approaches provide a more expressive and maintainable way to model complex states in your applications. My Take : I wish I had learned this earlier in life. When working with Google Docs, I realized the limitations of booleans. Expanding boolean-based behaviors often led to adding more fields, making the system complex. Enums would have provided a simpler solution. The problem wasn't just the booleans themselves, but also the need to pass them through multiple layers of the stack, often requiring additional parameters. Another important aspect of enums is the inclusion of an " enum not specified " state. This state explicitly indicates that an enum value hasn't been set, which can be usef...
Read more

[1st December 2024] Interesting Things I Learnt This Week

Image
1. C++ Pitfalls - this article, explains some of the pitfalls you can fall into when programming in C++ and shares their experience with them. This includes Operator precedence, Arithmetic conversion rules, Right bit-shift, Implicit conversions and Order of evaluation.  My Take : We've all read about JavaScript's quirks, leading to unexpected outputs. But let's remember that such behaviors aren't unique to JavaScript. Even languages like C and C++ have their share of ambiguities and compiler-specific behaviors. While it's tempting to dive deep into these intricacies, I've found that focusing on clear, consistent, and unambiguous code is often more practical. However, understanding these nuances is essential for any experienced programmer. It helps us avoid pitfalls and write robust, reliable code. Remember, mastering a language isn't just about writing "Hello World." It involves delving into its intricacies, including its counterintuitive and ambi...
Read more