1

Considering the Dyn DDOS attack which was possible because the IoT devices have poor default passwords, will it be a solution if the company who produces the devices might generate random default passwords for them?

These random passwords can be printed in a letter inside the box of the device.

  • i like physical protections on top, like only being able to update the firmware during the first 60 seconds from a cold power-on. individual passwords are a distro pain, but would help. – dandavis Nov 1 '16 at 18:59
5

Getting rid of default passwords would be a start. But default passwords are not the only problem with these devices. Apart from this obvious problem we have undocumented accounts users cannot even change, backdoors which might be deliberately placed or just accidently left in for debugging, vulnerabilities against CSRF, XSS, DNS hijacking and much more.

A major reason for this mess are vendors which don't know much about security and don't really care and users which don't know and don't care either and also like to have the cheapest device possible. And as long as nobody causing this problem will be held accountable for this mess and will feel the harm they do to others it will not get better.

Making vendors feel the problem can actually be very effective. For example the influential german computer magazine c't did a lot of tests of routers in the last years and probably also thanks to their successful public shaming of vendors with insecure settings now probably most routers sold in Germany enforce changing of the access credentials on first use or don't use default passwords at all and also take care of various other security problems.

  • 1
    having actually worked at one of these companies before, the other flawed theory is that "these devices will only be on an internal network so they dont need to be locked down as hard" ... problem is if another computer on the internal network gets infected all of these IoT devices can fall like dominoes – CaffeineAddiction Nov 1 '16 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.