 |
 |
|
November 24, 2004Why Default Passwords Are a Bad IdeaI have never been a supporter of default passwords in a 'manufactured shipping state' piece of hardware. Why? Because most people are either to lazy to change it, or don't even know you need to. The result? People collect the information and post a single list of default security passwords holding MANY of your favorite vendor products in one place so script kiddies can walk right in. What could you do about it as a developer? Don't use default passwords. But you need them when shipping for first time login. Ok, ok. Well at least force it to a one time password unique to the machine. In the past I have used a unique seed against the hardware serial of the device, which means a SLIGHT alteration may be needed to the build process of the device. At the manufacturer, you would need to have the serial info which is normally added at the end, become PART of the software flashing process. I will leave how you would plan that up to you; it is possible though. Thanks to Foz for pointing out the list. One of these days I will have to post my list of default BIOS passwords. Posted by SilverStr at November 24, 2004 07:10 AM | TrackBackComments
As long as it's done in such a way that, if the password becomes unknown for whatever reason, that it can be reset without having to contact the manufacturer, then great. As you mentioned, MAC addresses are great for this. It really sucks to be doing an emergency equipment swap/install at some awful hour, and not to be able to configure the device even though you have physical access and the online documentation for it. An alternative to a unique factory default password might be a simple as having the device shut itself down within 10 minutes of boot, unless the password has been changed. Or, disable some other piece of functionality in such a way that it FORCES the administrator to update the password. Security needs to be intuitive and stay out of the way. Posted by: Wim at November 24, 2004 07:44 PM |
 
My 5 Favorite Books
Writing Secure Code
Secure Programming Cookbook Security Engineering Secure Coding Principles & Practice Inside the Security Mind
My 5 Favorite Papers
Smashing the Stack
Penetration Studies Covert Channel Analysis of Trusted Systems DoD Trusted Computer System Evaluation Criteria NSA Security Recommendation Guides
Archives
December 2005
November 2005 October 2005 September 2005 August 2005 July 2005 June 2005 May 2005 April 2005 March 2005 February 2005 January 2005 December 2004 November 2004 October 2004 September 2004 August 2004 July 2004 June 2004 May 2004 April 2004 March 2004 February 2004 January 2004 December 2003 November 2003 October 2003 September 2003 August 2003 July 2003 June 2003 May 2003 April 2003 March 2003 February 2003 January 2003 December 2002 November 2002 October 2002 September 2002 August 2002 July 2002 |
|
