Because these routers went out to everybody. Tech heads and idiots alike. It is far easier for ISPs to simply remote in than rely on the consumer who may be an idiot.
So if we’re not talking about ISPs sending this out, then the reason that remote access gets turned on by default is incase the company sysadmin couldn’t physically get to the device, and they assumed the company had a firewall.
Companies almost always prioritise OOTB setup and operationality over security when it comes to defaults.
Yup. I used to think it was malicious by the ISPs but really it’s just all the end technology is kinda A mess for them to have control of the network for you. Which I’m gonna be honest 99.9% of customers NEED. lol
agreed my local area isp switched to calix for most of our customers and it’s really nice just to have a management interface to all of our customers and be able to fix it without having to roll a truck
20+ years ago I managed the installation of a high performance compute cluster purchased from IBM. Their techs did all the initial installation and setup, right down to using their well known default password of “PASSW0RD” (with a zero for the ‘o’) for all root/admin accounts…. It took less than 20 minutes for it to be compromised by an IP address in China.
At least other vendors like HP use random root/admin passwords printed on cards physically attached to new equipment…
When I used to rack and stack servers, many moons ago, we would always connect them to a switch with LAN only so we could use SSH/SCP to harden them before they got exposed. This was for .gov stuff that would get attacked instantly.
Worked at a sloppy startup MSP. A few years after I left a former coworker told me they discovered (after they finally got an EDR) that all the pre-deploy boxes on the sandboxed LAN waiting to be moved to the datacenter were being compromised after the kickstarts finished. The deployment box had been owned since they didn’t deploy it in the sandbox, which didn’t exist at the time. Whoever did it kept from being detected for years. Then I guess they got bored and used the whole DC to DOS someone. He thinks they noticed the EDR and the gig was up. Good times.
Why is the default setting to enable remote administration?
It wasn’t. Remote administration was enabled manually on these devices, and the admin passwords left default.
Because these routers went out to everybody. Tech heads and idiots alike. It is far easier for ISPs to simply remote in than rely on the consumer who may be an idiot.
I can’t think of a single ISP that was using old Ubiquiti EdgeOS routers as consumer routers.
So if we’re not talking about ISPs sending this out, then the reason that remote access gets turned on by default is incase the company sysadmin couldn’t physically get to the device, and they assumed the company had a firewall.
Companies almost always prioritise OOTB setup and operationality over security when it comes to defaults.
This is why I run my own router. I’m sure my cable modem has a way in but then you’d have to get past my router.
Ditto. I went one step further and put OpenWRT on mine.
Messed up thing is, some ISPs make it an absolute bitch to make this work.
Yup. I used to think it was malicious by the ISPs but really it’s just all the end technology is kinda A mess for them to have control of the network for you. Which I’m gonna be honest 99.9% of customers NEED. lol
agreed my local area isp switched to calix for most of our customers and it’s really nice just to have a management interface to all of our customers and be able to fix it without having to roll a truck
Because without it, the DOJ would have no control over you, duh
20+ years ago I managed the installation of a high performance compute cluster purchased from IBM. Their techs did all the initial installation and setup, right down to using their well known default password of “PASSW0RD” (with a zero for the ‘o’) for all root/admin accounts…. It took less than 20 minutes for it to be compromised by an IP address in China.
At least other vendors like HP use random root/admin passwords printed on cards physically attached to new equipment…
When I used to rack and stack servers, many moons ago, we would always connect them to a switch with LAN only so we could use SSH/SCP to harden them before they got exposed. This was for .gov stuff that would get attacked instantly.
Worked at a sloppy startup MSP. A few years after I left a former coworker told me they discovered (after they finally got an EDR) that all the pre-deploy boxes on the sandboxed LAN waiting to be moved to the datacenter were being compromised after the kickstarts finished. The deployment box had been owned since they didn’t deploy it in the sandbox, which didn’t exist at the time. Whoever did it kept from being detected for years. Then I guess they got bored and used the whole DC to DOS someone. He thinks they noticed the EDR and the gig was up. Good times.