Indian broadband users at risk

Wow this was something I did not expect. But this surely did hit me hard the first time I got through it. It seems like I could access most Airtel Broadband users routers using simple telnet. Once I was connected, all that was required was username and password. Boy and I am in. I have access to the router now and I sure can do a lot of crazy stuff with it.

Wait a minute, did I say you need username and password. How would I get the username and password. Well actually not very difficult. Is it. No one ever changes the username and password of their router. Actually no one expects anyone to be able to access the router without their knowledge. But the sad fact is, anyone on the internet can access their router. Most people do not even realize that their internet connection can be easily compromised. How? Well simple steps to follow

1. Press Window Key + R  to open the Run Command Dialog

2. Press cmd (Enter)

3. Enter 'telnet xxx.xxx.xxx.xxx'

Where 'xxx.xxx.xxx.xxx' is the IP Address of someone from Airtel Broadband. Trust me, its not difficult to get the IP of any/random airtel user.

4. Now you would have to enter Username. Thankfully its 'admin' to just enter it and now the tough part, the password. But whats the password. Well password is 'password'. Well literally.

5. One you are through with it. You can enter 'sh' at the prompt. Now to have a simple Linux shell available to you. Now you can do a hell lot of things, which I leave to your imagination.

I blame no one but Airtel for this fiasco. Its their responsibility that when they install a connection for a subscriber, they should change the password. But first of all, a WAN side access to telnet should never be allowed in the first place. I am very sure that most people have no idea about it. Time awareness spread.

Well Airtel may not be the only one, infact I believe all broadband users are equally at risk. Though I could not get through Tata Indicom or BSNL connections, I am sure they too are equally susceptible.

I am going to the Security Camp happening in Bangalore this Saturday 12 July, 2008. Hopefully I will meet some people who will carry this message forward and generate enough awareness to make people secure.

 

PS: Please write about it in your blog too. If you dont have a blog, the least you can do is Digg it.

Comments

Arun said…
The max you can do is just restart the router.
August 12, 2008 8:28 PM
100rabh™ said…
:-)
as I said you need to use a lot creative skills. I dont want to let unsuspecting users get into trouble, nor want to teach hacking. But if someone is smart, he would know what to do :-)
August 12, 2008 10:44 PM
Arun said…
OK, I agree with you on this and also I want to add that I have noticed the same issue in some badly configured BSNL devices too.
August 13, 2008 8:53 PM
Post a Comment

Popular posts from this blog

[3rd November 2024] Interesting Things I Learnt This Week

Image
1. Transforming CSV Files into Graphs with LLMs -  This is a step by step guide including code to transform csv files into graphs. There are prompts, python code and samples provided in it.  My Take : This is an excellent approach to streamlining data cleaning, a task that often consumes a significant portion of a data engineer's time. By leveraging the power of LLMs, we can potentially reduce this effort significantly. However, it's important to note that not all LLMs are equally effective for this purpose. Fine-tuning LLMs specifically for data cleaning tasks could further enhance their capabilities. I'm eager to learn more about this promising technique and its potential applications. Do let me know if have something interesting to share.   2. SOFA Start Often F*** Achievements - The SOFA principle advocates for starting numerous projects and finishing few. This approach prioritizes gaining diverse experiences and skills over completion. By frequently initiating new ...
Read more

[17th November 2024] Interesting Things I Learnt This Week

Image
 1. Booleans are a trap : Booleans, while seemingly simple, can introduce complexity and limitations into domain modeling. When used to represent complex states, booleans can lead to unclear code and potential errors. To avoid these pitfalls, consider using enums or enum sets. These approaches provide a more expressive and maintainable way to model complex states in your applications. My Take : I wish I had learned this earlier in life. When working with Google Docs, I realized the limitations of booleans. Expanding boolean-based behaviors often led to adding more fields, making the system complex. Enums would have provided a simpler solution. The problem wasn't just the booleans themselves, but also the need to pass them through multiple layers of the stack, often requiring additional parameters. Another important aspect of enums is the inclusion of an " enum not specified " state. This state explicitly indicates that an enum value hasn't been set, which can be usef...
Read more

[10th November 2024] Interesting Things I Learnt This Week

Image
1. One Company A/B Tested Hybrid Work. Here’s What They Found. - Recent research has revealed that a hybrid work model, where employees work from home three days a week, can significantly boost employee satisfaction and reduce turnover rates. This not only improves employee morale but also saves companies millions of dollars in recruitment and training costs. To successfully implement a hybrid model, businesses should prioritize rigorous performance management systems, coordinate team and company-wide schedules, and secure leadership support. Moreover, executives should experiment with different management practices to optimize their approach and maximize the benefits of hybrid work. My Take : There have been too many debates about remote work versus office work. I would have loved to see data comparing the effectiveness of remote, hybrid, and office-based work. I've worked at companies that mandated office work, like Tata Elxsi, where we didn't have laptops and had to rely on...
Read more