Tag Archive for ZTE

Bad Passwords Crippled the Web

Bad Passwords Crippled the WebFollowers of the Bach Seat know that passwords suck and now default passwords really suck. In fact, default passwords seem to be a key part of the massive DDOS attack that disabled large parts of the Internet on October 21, 2016. The cyberattack targeted Internet traffic company DYN. DYN provides DNS services for many high-profile sites. Some of the sites affected by the attack on Dyn included; Amazon (AMZN), Business Insider, New York Times, Reddit, and Twitter (TWTR).

Security researcher Brian Krebs, whose site, krebsonsecurity.com, was one of the first sites hit by a massive 620 GB/s DDoS attack, has reported the Mirai botnet was at the center of the attack on his site. CIO.com reports  ‘Mirai’ can break into a wide range of Internet of Things (IoT) devices from CCTV cameras to DVRs to home networking equipment turning them into ‘bots. CIO reports a single Chinese vendor, Hangzhou Xiongmai Technology made many of the devices used in the Mirai attacks.

Level 3 Communications says there are nearly half a million Mirai-powered bots worldwide. To amass an IoT botnet, a Mirai bot herder scans a broad range of IP addresses, trying to login to devices using a list of default usernames and passwords that are baked into Mirai code, according to US-CERT. The Mirai zombie devices are largely security cameras, DVRs, and home routers. Mr. Krebs identified some of the specific devices.

Mirai Passwords

UsernamePasswordFunction
admin123456
root123456ACTi IP camera
adminpassword
admin1password
rootpassword
admin12345
root12345
guest12345
admin1234
root1234
administrator1234
888888888888
666666666666Dahua IP camera
admin(none)
admin1111Xerox printers, etc.
admin1111111Samsung IP camera
admin54321
admin7ujMko0adminDahua IP camera
adminadmin
adminadmin1234
adminmeinsmMobotix network camera
adminpass
adminsmcadminSMC router
Administratoradmin
guestguest
motherfucker
root(none)Viviotek IP camera
root00000000Panasonic printers
root1111
root54321Packet8 VoIP phone
root666666Dahua DVR
root7ujMko0adminDahua IP camera
root7ujMko0vizxvDahua IP camera
root888888Dahua DVR
rootadminIPX-DDK network camera
rootankoAnko Products DVR
rootdefault
rootdreamboxDreambox TV receiver
roothi3518HiSilicon IP Camera
rootikwbToshiba network camera
rootjuantechGuangzhou Juan Optical
rootjvbzdHiSilicon IP Camera
rootklv123HiSilicon IP Camera
rootklv1234HiSilicon IP Camera
rootpass
rootrealtekRealtek router
rootroot
rootsystemIQinVision camera, etc.
rootuser
rootvizxvDahua camera
rootxc3511H.264 - Chinese DVR
rootxmhdipcSenzhen Anran security camera
rootzlxx.EV ZLX two way speaker
rootZte521ZTE router
serviceservice
supervisorsupervisorVideoIQ
supportsupport
techtech
ubntubntUbiquiti AirOS Router
useruser

US-CERT says the purported author of Mirai claims to have 380,000 IoT devices are under its control. Some estimate the botnet has generated greater than 1Tbps DDoS attacks.

DDOS attackWhen Mirai botnets are called upon to carry out DDoS attacks, they can draw on a range of tools including ACK, DNS, GRE, SYN, UDP and Simple Text Oriented Message Protocol (STOMP) floods, says Josh Shaul, vice president of web security for Akamai.

rb-

Followers of Bach Seat already know that many of the default passwords used by Mirai are among the worst and should have been changed already. They include:

  • Password
  • 123456
  • 12345
  • 1234

While reports say, Chinese vendor, XiongMai Technologies equipment was widely exploited, other notable tech firms are included. The Mirai zombie army includes equipment from Xerox (XRX), Toshiba (TOSBF), Samsung (005930), Panasonic (6752), and ZTE (763).

I wrote about security cameras being compromised as part of botnets back in July here.

 

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Mobile Patent Troll Sues Everyone

Mobile Patent Troll Sues EveryoneSurprise, surprise there’s another mobile-related patent lawsuit. at GigaOM says this time the plaintiff is an obscure Delaware-registered limited liability non-practicing entity called Steelhead. The patent in question covers ‘mobile radio handover initiation determination’ – in other words, choosing which cellular base station has the best signal as the handset moves from one place to another.

Cell phonesThe defendants are a who’s who of the mobile world: Apple (AAPL), AT&T (T), Google (GOOG), HTCKyocera (KYO), LG (LGLD), MetroPCS (PCS), Motorola Mobility, NEC Corporation (6701), Pantech, Research In Motion (RIMM), Sony (SNE), Sprint (S), T-Mobile, Verizon (VZ) and ZTE (763). The article says these firms committed the mortal sin of allowing their mobile phones to act like mobile phones. But the interesting thing about this particular suit is the origin of the suit – or, more precisely, the reporting around that origin.

Mr. Meyer reports that U.S. Patent No. 5,491,834 comes from BT (BT). It was filed in 1993 and granted in 1996. The patent is still listed by the USPTO as belonging to BT. In its court filings provided by the author, (the Motorola/Google example is here), Steelhead notes that it “owns all rights of recovery under the ‘834 Patent, including the exclusive right to recover for past infringement.

aggressively monetizingThe author suggests that this case may not be BT “aggressively monetizing” its patent portfolio. BT told Mr. Meyer, “BT sold all of its rights to the patents last year. We have no involvement in Steelhead Licensing LLC’s litigation activity.

BT claims the troll is not a shell front for the firm. A spokesperson for the telecom giant told GigaOM,  “BT doesn’t share in Steelhead’s licensing income”.

rb-

I have covered the mobile patent wars many times here. I don’t know why I find patent trolling so interesting to follow. Maybe it is the same reason I watch NASCAR highlights, for the crashes, or the buy a few Powerball tickets, just in case.

Maybe someday all the money spent on lawyers will actually go back to making things and creating jobs.

Kids squabblingShame on BT if this is a legit patent and they were not smart enough to enforce their claim when they had it. I’m no lawyer, it seems to me that mobiles that can’t find a cell tower to connect to don’t work.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Bach Seat Under Attack from China

Sean Buckley at FireceTelecom reports that China Telecom is setting its sites on the U.S. market. He is reporting that China Telecom announced plans to expand its global business unit. The move will drive $1.6 billion (CNY 10 billion) of sales in 2013.

Wang Xiaochu, China Telecom’s chairman, said in a China Daily report that the service provider saw the potential for its international business, after developing its China Telecom Global division. They plan to target including Asia-Pacific, Europe, and the Americas.  The article states that the service provider said it will aggressively purchase international assets to expand its presence in the U.S. “It is for sure that China Telecom will conduct M&As globally, and we are training talent to be more well-prepared,” said Wang.

China Telecom Americas

China Telecom Americas (CHA) is the largest international subsidiary of State-run China Telecom. CHA has launched its self-branded retail mobile service in Chicago. Donald Tan, president of CHA said the service will expand to Los Angeles and New York soon. In addition, the Chinese service provider has opened an office in Chicago.

However, one analyst says that given the recent government opposition to Chinese-based companies Huawei and ZTE (783), China Telecom could face similar challenges in serving the U.S. market in a significant way.

Given the failure of Huawei Technologies Co. Ltd. and ZTE Corp. in their attempts to gain a foothold in the U.S. market, I am not optimistic that China Telecom, a truly State-owned Chinese company, will do any better,” said Xiang Ligang, a Beijing-based telecommunications expert who also runs the industry information website cctime.com.

China Telecom, the State-owned Chinese service provider owns and operates CHINANET (China’s largest Internet network). This may be why U.S. regulators will try to squash CHA’s growth. My personal experience says that China Telecom does not control its networks very well.

For the last several months, this blog has seen a huge uptick in attacks. The attacks were primarily from China Telecom-controlled IP subnets. So far they have been defended off by the smart use of good software. For the past 10 weeks, there has been a peak of 87 attack attempts and an average of 27 attacks per day from China Telcom-controlled subnets. The attacks originated from the Anhui, Jiangsu, and Shanghai provinces. Over this time the most attacks came from China Telecom’s CHINANET locations ib:

 

Attacking IP addresses

Akami (AKAM) claims that China is the source of most cyber-attacks in its latest State of the Internet report. The Content Distribution Network (CDN) reports that about 33% of attack traffic originated in China between July and September 2012. Akamai also reports China has been the top source of attack activity since the end of 2011.

CHINANET claims to be the world’s largest Internet network

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.