6

Today I went to go & reset my router, but forgot the account password for the ISP. On the (extremely) off-chance of the password being present in the 'Password' field, I went to the appropriate page of the router's configuration settings (which is not secured using HTTPS) & found that the password had been blanked with dummy-characters (••••).

However, on viewing the page source the password is fully viewable, of which it's essentially this:

enter image description here

<input type="password" name="Password" value="SDrtdF">

obviously that's not my password, and I've also changed a couple of aspects of the HTML element to minimize exploitation

The input value of the password field is provided by the router, and not by the browser (I don't use autofill or tools to remember passwords). For this example, the real password is SDrtdF, which is the value of the password field.

This essentially means that anyone who has access to the router* can easily retrieve the password for the account that connects to the ISP, and use it elsewhere for illegal means. Knowing how some ISPs can be (mostly denying there is a problem, taking a week to realise what the problem is, etc), the first the victim may know about it is when the ISP cuts them off and/or the Police come knocking on their door.

*if a computer on the network is infected with malware & if said malware sends back a copy of the source of every page visited, no 'physical' access to the router would be required.


It's a common practice on websites to use 'dummy' input in password/sensitive fields. Browser autofill doesn't even put the passwords in 'plain sight' like this.

It's obvious that the ISP password is supposed to be hidden (else, why denote it as a password field in the first place if the password is supposed to be visible?).

Should such a vulnerability be taken seriously? Is it worth making the router manufacturer aware (I'd say yes, since their other routers may also carry the same vulnerability?

N.B: I've already made the manufacturer of the router aware of this, and I'm not going to disclose the manufacturer or the model of the router until/if this is fixed, for safety of the vulnerable routers.

4

Router admin authentication is required to expose the password plaintext.

This is a bad design for certain. It means the router is storing the ISP password in a reversible form. However, it has to reverse it to authenticate to the ISP. The real problem is that is unnecessary to expose.

This problem also exists on enterprise-level network gear. On Cisco firewalls it is possible to expose IPsec shared secrets and other similar symmetric/password credentials by running commands that show the configuration details from a CLI. This is done in part to support easily restorable backups of the config.

Exposing it in the user interface is unneccessary. This is an example of a Sensitive Data Exposure vulnerability (OWASP Top 10 2013-A6). It's considered to be hard to exploit (you need to be an admin on the router already), but high impact. In this case the value of the ISP client network authentication credentials is unlikely to be particularly significant. The ISP can have compensating controls in place and multiple authentications from separate locations would be an obvious violation that the ISP would notice.

I don't consider this to be a serious vulnerability. It should be addressed, but I don't consider it a show stopper requiring a different router to be deployed.

  • 1
    In fact some ISPs use generic user/password pairs and rely purely on other methods to control access (e.g. if they own the fixed line). – Chris H Jan 1 '16 at 18:06
  • @ChrisH I saw that in practice a few years ago with the local DSL ISP basing the passwords trivially on the phone number. It still had to be an active account and only worked for that phone line, but was effectively no better than physical only security. No genuine defense in depth, just a tick box to say a password was used to authorize connections. – Alain O'Dea Jan 1 '16 at 18:09
  • here they're all the same essentially dummy values . With an occasional flip between two values that's only noticeable if you don't use their router. – Chris H Jan 1 '16 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.