{"id":81902,"date":"2016-11-10T20:15:15","date_gmt":"2016-11-11T01:15:15","guid":{"rendered":"http:\/\/rbach.net\/blog\/index.php\/"},"modified":"2021-07-16T17:02:05","modified_gmt":"2021-07-16T21:02:05","slug":"bad-passwords-crippled-the-web","status":"publish","type":"post","link":"https:\/\/rbach.net\/index.php\/bad-passwords-crippled-the-web\/","title":{"rendered":"Bad Passwords Crippled the Web"},"content":{"rendered":"

\"Bad<\/a>Followers of the Bach Seat<\/a><\/em> know that passwords<\/a> suck<\/a> a<\/a>nd now default passwords really suck<\/strong>. In fact, default passwords seem to be a key part of the massive DDOS attack<\/strong><\/a> that\u00a0disabled<\/strong> large parts of the Internet on October 21, 2016. The cyberattack targeted Internet traffic<\/a> company DYN. DYN<\/a> provides DNS services<\/a><\/strong> for many high-profile sites. Some of the sites affected by the attack on Dyn<\/strong> included; Amazon<\/a><\/strong> (AMZN<\/a>), Business Insider<\/a><\/strong>, New York Times<\/a><\/strong>, Reddit<\/a>,<\/strong> and Twitter<\/a><\/strong> (TWTR<\/a>).<\/p>\n

\"\"<\/a>Security researcher Brian Krebs<\/a><\/strong>, whose site, krebsonsecurity.com, was one of the first sites hit by a massive 620 GB\/s DDoS attack<\/a><\/strong>, has reported the Mirai botnet<\/strong> was at the center of the attack on his site. CIO.com<\/em><\/a> reports<\/a>\u00a0 \u2018Mirai\u2019 can break into a wide range of Internet of Things<\/a><\/strong> (IoT) devices from CCTV cameras<\/strong> to DVRs<\/strong> to home networking equipment<\/strong> turning them into \u2018bots<\/b>. CIO<\/em> reports a single Chinese vendor<\/strong>, Hangzhou Xiongmai Technology <\/a>made many of the devices used in the Mirai attacks.<\/p>\n

Level 3 Communications<\/a> says there are nearly half a million Mirai-powered bots worldwide. To amass an IoT botnet, a Mirai bot herder scans a broad range of IP addresses, trying to login to devices using a list of default usernames and passwords<\/strong> that are baked into Mirai code, according to US-CERT<\/a><\/strong>. The Mirai zombie devices are largely security cameras, DVRs, and home routers. Mr. Krebs identified<\/a> some of the specific devices.<\/p>\n

Mirai Passwords<\/h2>\n\n\n\n\n\t\n\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t
Username<\/th>Password<\/th>Function<\/th>\n<\/tr>\n<\/thead>\n
admin<\/td>123456<\/td><\/td>\n<\/tr>\n
root<\/td>123456<\/td>ACTi IP camera<\/td>\n<\/tr>\n
admin<\/td>password<\/td><\/td>\n<\/tr>\n
admin1<\/td>password<\/td><\/td>\n<\/tr>\n
root<\/td>password<\/td><\/td>\n<\/tr>\n
admin<\/td>12345<\/td><\/td>\n<\/tr>\n
root<\/td>12345<\/td><\/td>\n<\/tr>\n
guest<\/td>12345<\/td><\/td>\n<\/tr>\n
admin<\/td>1234<\/td><\/td>\n<\/tr>\n
root<\/td>1234<\/td><\/td>\n<\/tr>\n
administrator<\/td>1234<\/td><\/td>\n<\/tr>\n
888888<\/td>888888<\/td><\/td>\n<\/tr>\n
666666<\/td>666666<\/td>Dahua IP camera<\/td>\n<\/tr>\n
admin<\/td>(none)<\/td><\/td>\n<\/tr>\n
admin<\/td>1111<\/td>Xerox printers, etc.<\/td>\n<\/tr>\n
admin<\/td>1111111<\/td>Samsung IP camera<\/td>\n<\/tr>\n
admin<\/td>54321<\/td><\/td>\n<\/tr>\n
admin<\/td>7ujMko0admin<\/td>Dahua IP camera<\/td>\n<\/tr>\n
admin<\/td>admin<\/td><\/td>\n<\/tr>\n
admin<\/td>admin1234<\/td><\/td>\n<\/tr>\n
admin<\/td>meinsm<\/td>Mobotix network camera<\/td>\n<\/tr>\n
admin<\/td>pass<\/td><\/td>\n<\/tr>\n
admin<\/td>smcadmin<\/td>SMC router<\/td>\n<\/tr>\n
Administrator<\/td>admin<\/td><\/td>\n<\/tr>\n
guest<\/td>guest<\/td><\/td>\n<\/tr>\n
mother<\/td>fucker<\/td><\/td>\n<\/tr>\n
root<\/td>(none)<\/td>Viviotek IP camera<\/td>\n<\/tr>\n
root<\/td>00000000<\/td>Panasonic printers<\/td>\n<\/tr>\n
root<\/td>1111<\/td><\/td>\n<\/tr>\n
root<\/td>54321<\/td>Packet8 VoIP phone<\/td>\n<\/tr>\n
root<\/td>666666<\/td>Dahua DVR<\/td>\n<\/tr>\n
root<\/td>7ujMko0admin<\/td>Dahua IP camera<\/td>\n<\/tr>\n
root<\/td>7ujMko0vizxv<\/td>Dahua IP camera<\/td>\n<\/tr>\n
root<\/td>888888<\/td>Dahua DVR<\/td>\n<\/tr>\n
root<\/td>admin<\/td>IPX-DDK network camera<\/td>\n<\/tr>\n
root<\/td>anko<\/td>Anko Products DVR<\/td>\n<\/tr>\n
root<\/td>default<\/td><\/td>\n<\/tr>\n
root<\/td>dreambox<\/td>Dreambox TV receiver<\/td>\n<\/tr>\n
root<\/td>hi3518<\/td>HiSilicon IP Camera<\/td>\n<\/tr>\n
root<\/td>ikwb<\/td>Toshiba network camera<\/td>\n<\/tr>\n
root<\/td>juantech<\/td>Guangzhou Juan Optical<\/td>\n<\/tr>\n
root<\/td>jvbzd<\/td>HiSilicon IP Camera<\/td>\n<\/tr>\n
root<\/td>klv123<\/td>HiSilicon IP Camera<\/td>\n<\/tr>\n
root<\/td>klv1234<\/td>HiSilicon IP Camera<\/td>\n<\/tr>\n
root<\/td>pass<\/td><\/td>\n<\/tr>\n
root<\/td>realtek<\/td>Realtek router<\/td>\n<\/tr>\n
root<\/td>root<\/td><\/td>\n<\/tr>\n
root<\/td>system<\/td>IQinVision camera, etc.<\/td>\n<\/tr>\n
root<\/td>user<\/td><\/td>\n<\/tr>\n
root<\/td>vizxv<\/td>Dahua camera<\/td>\n<\/tr>\n
root<\/td>xc3511<\/td>H.264 - Chinese DVR<\/td>\n<\/tr>\n
root<\/td>xmhdipc<\/td>Senzhen Anran security camera<\/td>\n<\/tr>\n
root<\/td>zlxx.<\/td>EV ZLX two way speaker<\/td>\n<\/tr>\n
root<\/td>Zte521<\/td>ZTE router<\/td>\n<\/tr>\n
service<\/td>service<\/td><\/td>\n<\/tr>\n
supervisor<\/td>supervisor<\/td>VideoIQ<\/td>\n<\/tr>\n
support<\/td>support<\/td><\/td>\n<\/tr>\n
tech<\/td>tech<\/td><\/td>\n<\/tr>\n
ubnt<\/td>ubnt<\/td>Ubiquiti AirOS Router<\/td>\n<\/tr>\n
user<\/td>user<\/td><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n

US-CERT says the purported author of Mirai claims to have 380,000 IoT devices are under its control. Some estimate the botnet<\/strong> has generated greater than 1Tbps DDoS attacks<\/strong>.<\/p>\n

\"DDOS<\/a>When Mirai botnets are called upon to carry out DDoS attacks, they can draw on a range of tools including ACK, DNS<\/a>, GRE<\/a>, SYN<\/a>, UDP<\/a> and Simple Text Oriented Message Protocol (STOMP) floods, says<\/a> Josh Shaul, vice president of web security for Akamai.<\/p>\n

rb-<\/em><\/strong><\/p>\n

Followers of Bach Seat<\/a> already know that many of the default passwords used by Mirai are among the worst<\/a> and should have been changed already. They include:<\/em><\/p>\n