Indian broadband users at risk

Wow this was something I did not expect. But this surely did hit me hard the first time I got through it. It seems like I could access most Airtel Broadband users routers using simple telnet. Once I was connected, all that was required was username and password. Boy and I am in. I have access to the router now and I sure can do a lot of crazy stuff with it.

Wait a minute, did I say you need username and password. How would I get the username and password. Well actually not very difficult. Is it. No one ever changes the username and password of their router. Actually no one expects anyone to be able to access the router without their knowledge. But the sad fact is, anyone on the internet can access their router. Most people do not even realize that their internet connection can be easily compromised. How? Well simple steps to follow

1. Press Window Key + R  to open the Run Command Dialog

2. Press cmd (Enter)

3. Enter 'telnet xxx.xxx.xxx.xxx'

Where 'xxx.xxx.xxx.xxx' is the IP Address of someone from Airtel Broadband. Trust me, its not difficult to get the IP of any/random airtel user.

4. Now you would have to enter Username. Thankfully its 'admin' to just enter it and now the tough part, the password. But whats the password. Well password is 'password'. Well literally.

5. One you are through with it. You can enter 'sh' at the prompt. Now to have a simple Linux shell available to you. Now you can do a hell lot of things, which I leave to your imagination.

I blame no one but Airtel for this fiasco. Its their responsibility that when they install a connection for a subscriber, they should change the password. But first of all, a WAN side access to telnet should never be allowed in the first place. I am very sure that most people have no idea about it. Time awareness spread.

Well Airtel may not be the only one, infact I believe all broadband users are equally at risk. Though I could not get through Tata Indicom or BSNL connections, I am sure they too are equally susceptible.

I am going to the Security Camp happening in Bangalore this Saturday 12 July, 2008. Hopefully I will meet some people who will carry this message forward and generate enough awareness to make people secure.

 

PS: Please write about it in your blog too. If you dont have a blog, the least you can do is Digg it.

Comments

Arun said…
The max you can do is just restart the router.
August 12, 2008 8:28 PM
100rabh™ said…
:-)
as I said you need to use a lot creative skills. I dont want to let unsuspecting users get into trouble, nor want to teach hacking. But if someone is smart, he would know what to do :-)
August 12, 2008 10:44 PM
Arun said…
OK, I agree with you on this and also I want to add that I have noticed the same issue in some badly configured BSNL devices too.
August 13, 2008 8:53 PM
Post a Comment

Popular posts from this blog

[3rd November 2024] Interesting Things I Learnt This Week

Image
1. Transforming CSV Files into Graphs with LLMs -  This is a step by step guide including code to transform csv files into graphs. There are prompts, python code and samples provided in it.  My Take : This is an excellent approach to streamlining data cleaning, a task that often consumes a significant portion of a data engineer's time. By leveraging the power of LLMs, we can potentially reduce this effort significantly. However, it's important to note that not all LLMs are equally effective for this purpose. Fine-tuning LLMs specifically for data cleaning tasks could further enhance their capabilities. I'm eager to learn more about this promising technique and its potential applications. Do let me know if have something interesting to share.   2. SOFA Start Often F*** Achievements - The SOFA principle advocates for starting numerous projects and finishing few. This approach prioritizes gaining diverse experiences and skills over completion. By frequently initiating new en
Read more

My Best Cell Phone

I was just wondering at so many cell phones available out in the market. Though I still use Nokia 1100, but that does not stop me imagining the best cell phone for me. After a lot of thoughts on it I have come up with my own specification. So here it goes. Good external speakers. Crystal clear sound. And the sound should be loud enough that removes the need for extra addon speakers at any time. The mic should be such that it can cut off all the noise in the background(High tech but I think its possible) A good camera, around 4Mega pixel one. Also capable of recording movies in DVD Quality. Storage capacity of 100GB. Use any means possible. I hardly care. Should be small in size...Not any bigger than my Nokia 1100 right now. Screen resolution of some 16million colours at least. Should have a screen that is big enough almost as big as the whole phone and. Better if its extensible by opening the panel outwards. Keypad with keys like a normal keyboard unlike usual phones. Ability to intro
Read more

Top reasons why Tata Elxsi should be blacklisted

Well that a provoking first line, but then thats exactly what I have to say about this company. Tata Elxsi should be blacklisted, but wait a minute by whom? Well the software developers fraternity. Its a blood sucking corporation which is right documented in the documentary The Corporation . Ok why am I telling this after almost one year of leaving it. Well when the fact is that I have nothing to do with it. I have already let out my personal experience here , here and here . Well it was not just me as its obvious from the comments but then it was general feeling of my friends there. Well all I can talk about is friends because I dont know how each and every employee of Tata Elxsi felt. Anyways heres one more story about the kind of harassment and employee of Tata Elxsi might have to suffer . Though I had read it earlier but am blogging now about solely because I wanted to confirm the news being true. And sadly it is true. An employee was indeed made to resign. And indeed its legally
Read more