Please log in with router's password

https://www.google.com/search?q=%22Please+log+in+with+router%27s+password%22

by fny • 5 years ago

583 254 5 years ago

eganist3• 5 years ago

To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets.

https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated.

---

It's also a super basic intro to proper google-fu (which you can google to find others' takes on how to become somewhat effective at, erm, googling). Back when I used to blog on Microsoft-related topics, it was common to construct extremely narrow queries to find exposed confidential documents in Skydrive accounts which we could then sift through to find bloggable material.

e.g site:[skydrive domain] filetype:.pptx "Microsoft Confidential" etc.

Or one which still works:

https://www.google.com/search?q="Microsoft+Confidential"+sit...

lmao I'm going to have some fun tonight.

br2• 5 years ago

Are Skydrive documents somewhat public or are people just sharing them by mistake? I don't use it nor am I that familiar with it.

eganist3• 5 years ago

Are Skydrive documents somewhat public or are people just sharing them by mistake? I don't use it nor am I that familiar with it.

Almost all of this would be by mistake, no different than misconfiguring an S3 bucket.

bellyfullofbac• 5 years ago

You can create a long complicated link to share with other people, even people without Skydrive/OneDrive/Dropbox/Google Drive accounts. But sometimes people publish these links somewhere where a search engine's crawler sees it and follow it.

I remember spotting someone's URL to a Google Doc on their screen which their camera caught in their YouTube video. I manually typed it into my browser's URL bar and voila, I could read that document. Nothing juicy though.

kryogen1c• 5 years ago

i think my first exposure to shodan was from viss

https://youtu.be/-T-3buBwMEQ

this video is 9 years old now, but id wager the prevalence of pulbic scada and webcams et al is still pretty high.

belter• 5 years ago

"115 batshit stupid things you can put on the internet in as fast as I can go"

https://youtu.be/hMtu7vV_HmY

jfrunyon7• 5 years ago

Sadly, Shodan does not appear to index these, seemingly because it attempts an HTTP connection, while the router expects an HTTPS connection.

Edit: I take it back. Looks like the hash is good enough. 47,000 results; the first three that responded are the same kind of routers. https://www.shodan.io/search?query=hash%3A-904286784

tg180• 5 years ago

Lately, Shodan’s results are not as good as in the past. I think they are scanning less aggressively.

I always recommend to watch at least both Censys and Shodan.

https://censys.io/

walrus01• 5 years ago

Some fun things here, as a google search:

site:.gov "for official use only" filetype:pptx

site:.gov "for official use only" filetype:pdf

oriki• 5 years ago

fyi, "for official use only" or "fouo" is a slightly more than meaningless designation to shield stuff against FOIA inquiries. most of the stuff you'll find is pretty boring. a little more: https://en.wikipedia.org/wiki/For_Official_Use_Only#United_S...

atum47• 5 years ago

Shodan, great tool. I remember spending time looking at some misconfigured IP cams

mr_toad• 5 years ago

People seem to slap legal notices on documents like they’re some sort of magical spell that they don’t actually understand.

boston_clone• 5 years ago

In my experience, the labeling such as "{company_name} Confidential" is for internal data classification purposes.

These items being accessible externally via google dorking is just poor site administration.

grawprog2• 5 years ago

All I'm going to say about Shodan is...

Too many people leave the default password on internet connected devices.

Seriously, anything is better than the default password.

pugworthy• 5 years ago

Or there is no password at all, like say a lot of HP printers.

achillean6• 5 years ago

Note that Shodan doesn't try to login using default credentials. If you see banners advertising their defaults it just means that the device is telling you what its defaults are - it doesn't mean that the device is still using them.

That being said, a ton of devices still use default credentials but we don't have any numbers on how many exactly.

girvo• 5 years ago

These used to be known in the script-kiddie scene as "google dorks", IIRC

achillean6• 5 years ago

The Wikipedia article is unfortunately woefully out of date in describing what Shodan does. For example, Shodan collects data on thousands of ports:

https://www.shodan.io/search/facet?query=net%3A0%2F0&facet=p...

And we don't concentrate on a single type of device/ service (the article mentions SCADA). We identify everything from industrial control systems (1) to Minecraft servers (2). The news coverage makes it sound like we're skewed towards ICS, webcams or vulnerabilities but our focus is on providing a comprehensive view of what's connected to the Internet.

If you want to quickly check if your IP is exposing anything unexpected to the Internet simply visit:

https://me.shodan.io

If you see a 404 then nothing public was found. Note that this looks up information in the existing Shodan database - it doesn't launch a scan.

(1) Industrial control systems: https://www.shodan.io/search/report?query=tag%3Aics

(2) Minecraft servers: https://www.shodan.io/search?query=minecraft

fragmede• 5 years ago

The Wikipedia article is unfortunately woefully out of date

so... did you fix it?

eganist3• 5 years ago

Entirely unrelated fun fact: my love for your service started a good number of years ago when you worked with me directly on a specific challenge (subject: "Any way to pay for shodan without Paypal?"). Glad to see the service is continuing to thrive! And that you're engaged in conversation/feedback on HN.

nuker3• 5 years ago

https://me.shodan.io … this looks up information in the existing Shodan database - it doesn't launch a scan.

But do you discard the IP or save it for future scans? :p

mattl• 5 years ago

Not sure “google-fu” translates to the average user

syntaxfree• 5 years ago

Oh man. I miss Fravia.

qwertox• 5 years ago

Not that I didn't know about its existence, but I just entered the IP of my VPS and noticed that Portainer was bound to 0.0.0.0... I thought I had it bound to the docker bridge so now I've got to put in some time to see if all is ok.

Thank you!

Narrator: All was ok.

frjalex• 5 years ago

There's also a Chinese-made equivalent of Shodan: https://www.zoomeye.org/

core-e2• 5 years ago

I don't understand. What point is being made here?

fungiblecog• 5 years ago

People are exposing their routers to the internet. This is not a good idea.

csomar• 5 years ago

Probably people not aware of exposing their routers to the Internet.

core-e2• 5 years ago

Thanks. How do I make sure I'm not on this list?

Alupis12• 5 years ago

There are legit reasons to have a router be publicly accessible. How else would one remotely manage a router (top results in Google are businesses and universities, for example).

Since the default configuration of these routers is not to expose the router on the WAN interface, manually overriding this configuration usually demonstrates a sufficient enough understanding that the default credentials have likely also been changed.

The only real issue would be using a default password, which none of the top results shown on Google seem to have (thankfully). So, little-to-no issue here.

angott• 5 years ago

There are thousands of TP-LINK routers whose WAN port 80/443 is exposed to the Internet, allowing access to their administration interface if you know the password (or a vulnerability is present).

toxicFork2• 5 years ago

And I'd bet a nice amount that most of them have the default passwords.

Some years ago I wrote a little tool to iterate all of an ISP's ip addresses and around 90% were using default passwords. Mostly homes, but some businesses.

iamcreasy3• 5 years ago

I was planning to host a simple website on my RasberryPi using Dynamic DNS - which I think requires me to expose port 80 to the internet. Is that safe?

syncsynchalt• 5 years ago

It's a demonstration of google dorking. Construct a google search term that returns attackable hosts.

Skip past the first few results, then you'll see a list of likely easily-hackable home routers. If you were to try user/pass combos like "admin"/"admin" on these results I bet you'd have successful logins on several of them.

Don't actually do this (seriously, the penalties aren't light), the demonstration of the search results is enough to make the point.

Johnny5556• 5 years ago

I think this is more the fault of manufacturers than end users.

Routers should be secure by default, and it should be hard to do something that will make it insecure. The router manufacturers are the supposed experts when it comes to networking, expecting every consumer to even know the risks of exposing their router admin interface to the world is not a reasonable assumption.

sathackr• 5 years ago

So it's the car companies fault if I crash my car?

They should limit vehicle speed to 5mph so I don't hurt myself or others.

I have used many of these routers. Admin access on the wan port is blocked by default and must be enabled by the user.

solarkraft• 5 years ago

Lackluster comparison (a modern consumer router should be more like a self steering car), but modern cars indeed have safety features to prevent you from crashing.

Of course, both with the car and the router there are good arguments that you should be able to do the dumb thing if you know you need it. If it has to be explicitly enabled after intense warnings, the protective duty (as someone knowing better) can possibly be considered fulfilled - or you can still argue that it should be especially hard to do to block out people who don’t listen to warnings.

Johnny5556• 5 years ago

Do you want to require that router users pass a government proficiency test and carry insurance to cover their liability for unsafe network use? Otherwise the analogy with driving a car is not quite complete.

sophacles• 5 years ago

You are making a very good point: the order of gear shifting was tightly regulated after a lot of accidents caused by NDLR order (instead of the now-standard PRNDL). In fact most automotive interfaces have regulations to standardize them after enough accidents were caused by people getting new cars that had different interfaces.

kube-system4• 5 years ago

My car will literally hit the brakes for me if I am about to crash into something. A router marketed to a non-professional should do the same.

Alupis12• 5 years ago

I haven't bought a consumer router in well over a decade that isn't secure by default. Universally they all prohibit accessing the router via the WAN interface, and have reasonable firewall defaults. Many these days even include a randomized unique password for every router, stuck to the side of the device with a sticker.

These routers were put on the internet on purpose, by people that seem to know what they are doing (universities and businesses), and none seem to have default credentials. Seems reasonable to me.

paxys2• 5 years ago

Is there any mainstream router brand that exposes admin pages to the internet by default?

Pxtl• 5 years ago

These routers are secure by default. This is only visible because users have chosen to have their routers expose their admin pages to the public internet.

I have never seen a router that had its admin page visible to the WAN by default.

whoopdedo• 5 years ago

I have never seen a router that had its admin page visible to the WAN by default.

I'd wager there's a non-zero percentage of routers which have the modem (or ISP router) plugged into a LAN port.

paxys2• 5 years ago

Funny enough just 45 minutes later this very HN thread is the top result on Google.

nicce2• 5 years ago

We live in the endless loop folks! It took me a while to realize if it was actually the purpose of this post.

Edit: Yes, it was not.

slim• 5 years ago

It is not. The purpose is to show misconfigured access points accessible through the internet

soheil8• 5 years ago

I don't think that was the purpose of this post.

cduzz• 5 years ago

This reminds me of when Sergey Brin explained recursion to Terry Gross in this interview (14:45 seconds into the interview)

https://freshairarchive.org/segments/google-founders-larry-p...

NikolaNovak• 5 years ago

Yeah; I don't actually get what this is about; I guess I'll keep reading the comments...

Alupis12• 5 years ago

Folks - these routers are secure. There is nothing to see here, move along.

Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results:

https://static.tp-link.com/2019/201912/20191231/7106508598_A...

Step 2 of first time setup forces a default password change. There is no way around this step.

The defaults for the router also do not allow router access from the WAN port.

This means:

1) These routers all have secured passwords that are non-default.

2) These routers were deliberately placed on the internet by people that knew enough about them to do so.

Just because it's not how you would configure your router doesn't make it wrong. There are legit reasons to place a router on the internet, so long as it's secured properly... how else would you remotely manage a router at a different physical location, for instance.

__Lastly__ click "Next Page" on the OP search results. The estimated 7,000+ results becomes 21. Many of which are HN aggregators reporting on this thread here.

So... out of the possible millions of routers TP-Link has sold in this model line, less than 21 are on the public internet - many of which no longer load via IP address (indicating they are no longer publicly accessible), and the rest have professional CNAME's attached, indicating professional management.

Nothing here...

mullingitover• 5 years ago

I would love to know how these are secured. I doubt there's MFA or even rate limiting.

2) These routers were deliberately placed on the internet by people that knew enough about them to do so.

That's making some very generous assumptions.

Alupis12• 5 years ago

These are not high end enterprise grade kit, folks. Expecting things like MFA, secondary VPN endpoints, etc is just absurd for the target audience of this device.

Again, just because you wouldn't configure it this way doesn't make it wrong. It's as secure as it can be, short of throwing a bunch of other kit in front of it, and then why would you be using a $100 consumer router anyway?

The only vulnerability here is the possibility of a 0-Day. Everything else is either misguided or screaming for the sake of it.

csydas• 5 years ago

That's making some very generous assumptions.

Disagree. In my current country of living, I'm not even sure how I'd properly expose the router I use to the public internet since I sit behind the ISP's NAT-ing, and even when I lived in the US, I am not confident I could tell you how to publicly expose the modem provided by Comcast for non-local access, much less how someone without any tech experience might do this.

If this was a prevalent problem because of default settings, I'd expect far more than 7800 results; I am not willing to concede every instance is intentional, but 7800 out of the billions of routing devices in the world showing up on this search enforces my understanding that these 7800 entries are special in some way.

I doubt there's MFA or even rate limiting.

MFA is not common at all on consumer routers, which at least quite a few on the first page result are, same with rate limiting.

Even for Enterprise grade gear, the threat isn't the user-defined password, it's the manufacturer backdoors, which we've seen many of in the last few years. Rate limiting doesn't do much if you have a fair chance that you've got a back door.

What likely __does__ help is that as far as I know, "Enable Web Access from WAN" is by default *disabled* on most consumer routers (and enterprise? that I'm not sure of), so I think that this leads credence to the devices on the Google results being exposed intentionally to some degree. (The owners' knowledge level not withstanding, this is a fairly out of the way setting, at least on my Asus router)

gsich• 5 years ago

That would also be an assumption.

nickstinemates• 5 years ago

SD-WAN / VPN / Many many many other solutions.

lmilcin5• 5 years ago

Folks - these routers are secure. There is nothing to see here, move along.

If experience is any guide, they are not.

Consumer routers have horrible track of embarrassing, easily exploitable vulnerabilities. That are not patched for a long time or ever.

And exposing your router to public like that suggests the owner knows very little about security. This typically goes in hand with other neglect. Tell me, how many home users that are not security conscious keep their routers regularly patched and will replace the router when the manufacturer stops supporting them?

nuker3• 5 years ago

This typically goes in hand with other neglect.

UPnP is on by default, yeah

YPPH• 5 years ago

What router does HN recommend for consumers?

I personally run Ubiquiti Unifi gear, but they're not exactly consumer friendly (more geared to power users).

szidev• 5 years ago

not every tp-link model (or revision, or locale, or firmware version) that shares a web interface with the c7 requires you to manually set a password. even if that were the case, there are bound to be users who aren't security savvy and chose a very weak password (e.g. "password", "admin").

many tp-link routers also have configurable vpn servers built in, which can open up the whole network to malicious actors.

amanzi• 5 years ago

You're making some massive assumptions here.

Exposing your router's admin page to the internet is not good security practice. These routers are protected by nothing but a password, and I couldn't see anything in the manual that enforces password length/complexity. So while the password might be non-default, it could still be incredibly insecure.

Also, to expose these routers to the internet, all it takes is a single checkbox to enable "Remote management". So your assumption that these have all been deliberately placed on the internet also doesn't hold up because I can definitely see a curious home user playing with these settings without realising the impact of this. There have been tons of similar reports in the past where home users have exposed things to the internet without realising the impact.

system2• 5 years ago

Why would the search engines index these though? That's the question, not their default security.

ericyan3• 5 years ago

These routers all have secured passwords that are non-default.

Secure passwords is just a tiny subset of non-default passwords. Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low.

These routers were deliberately placed on the internet by people that knew enough about them to do so.

This means these people knows how to expose the management interface to the internet. It does not mean these people have enough knowledge on securing their devices -- based on their actions, it is more likely that the opposite is true.

ascar3• 5 years ago

Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low.

https://xkcd.com/936/

So you think the chance of human beings to come up with 4 random words is pretty low?

You can't brute force millions of guesses per second through a web interface. 40 bits of entropy is already plenty for internet usage especially when the password is properly hashed with something like bcrypt.

Secure passwords is just a tiny subset of non-default passwords

Actually the exact opposite is true. Since only low entropy and publicly known (which are mostly low entropy) passwords are insecure there are much more secure than non secure passwords.

For the sake of argument, let's say all passwords with less than 40 bits of entropy are insecure. Even if we restrict the set of possible passwords to only 10 characters of lowercase a-z we have about 47 bits of entropy. So the set of insecure passwords would only be about 1/128 or less than 1% of all allowed passwords.

jrochkind1• 5 years ago

What you say is sensible, except for:

The estimated 7,000+ results becomes 21. Many of which are HN aggregators reporting on this thread here.

Nope, Google is just collapsing them because they are all identical copies of the same "page", being the same login screen. Most of them look like routers, you can ask Google to "include" them all and see for yourself. https://www.google.com/search?q=%22Please+log+in+with+router...

jfrunyon7• 5 years ago

So... out of the possible millions of routers TP-Link has sold in this model line, less than 21 are on the public internet

Make that 47,000 of them on Shodan: https://www.shodan.io/search?query=hash%3A-904286784

1) These routers all have secured passwords that are non-default.

You have a very interesting definition of "secured" if you think they are all actually secured.

2) These routers were deliberately placed on the internet by people that knew enough about them to do so.

Just because they knew enough to click a checkbox doesn't mean they knew enough to do so. If they knew enough, they wouldn't have done so.

You seem to be under the mistaken impression that embedded devices (like consumer routers) don't usually have glaring security holes. But they do.

fny2• 5 years ago

OP. I'm posting this because I discovered a box at the hostel I'm at on Google after fat fingering the IP by mistake. (It's disconnected already.) The password was easily guessable.

Aside from the anecdata, a counter argument is that the router manufacturer has taken no steps to obscure the routers from search engines. Sure someone could simply IP scan, but you have to admit this is a little absurd.

alerighi• 5 years ago

1) These routers all have secured passwords that are non-default.

Who said secure password? Yes, they are not the default, but people are terrible at choosing password, most will choose weak password that are easy to exploit with a dictionary attack.

2) These routers were deliberately placed on the internet by people that knew enough about them to do so.

A people that know what it's doing would never expose a router web interface on the internet. Most people doesn't know how to configure his router, and let the ISP technician configure it, and they probably expose the router interface so they can access it remotely for maintenance, but it's not a great idea...

There are legit reasons to place a router on the internet, so long as it's secured properly...

There aren't. Also you can choose a secure password, but these router interfaces are full of bugs, and highly exploitable. Add to this the fact that the manufacturer rarely updates the firmware of these devices...

how else would you remotely manage a router at a different physical location, for instance.

With a VPN? By creating an SSH tunnel to one machine inside the local network? By connecting remotely (via RDP, VNC, TeamViewr, whatever) to one PC inside the local network? There are a ton of better solutions.

Also if you don't have a static public IP address, as it's in most situations nowadays, how do you access it remotely anyway? With dynamic DNS but it's not reliable. The best solution to me is using a VPN (I can connect to my home network from anywhere in the world and access all the hosts, including router and other networking equipment of course).

cafxx2• 5 years ago

these routers are secure.

Owner of a C7 v4 here. There has not been a firmware update from TP-Link since December 2019 (note that v4 is the second-most recent HW revision). No way these are not affected by at least some CVE somewhere in their stack. Calling them secure is a leap of faith that TP-Link does not deserve.

I recently flashed openwrt exactly to be able to be on a more recent stack.

I would never dream exposing that UI to the Internet as-is. They don't even have any form of brute forcing protection. If they really needed access to the router remotely, it would be much saner to expose an SSH server with pubkey-only access or VPN, both with brute forcing protection, and allow tunnelling to the router UI only from the LAN side.

Either who set those up really has nothing to lose if they get owned, or they do not know what they are doing. In both cases, it does not qualify as being a secure setup. (Sure, they may also be honeypots - in which case your argument was incorrect anyway, as they are secure, but they are not routers)

kralos2• 5 years ago

If they really needed access to the router remotely, it would be much saner to expose an SSH server with pubkey-only access or VPN, both with brute forcing protection, and allow tunnelling to the router UI only from the LAN side.

any chance you can explain that to my mum?

input_sh• 5 years ago

Same model, but the interface showed build 20180316 as "up to date", and when I've tried manually downloading the 2019 build it showed "invalid type". Swapped it with DD-wrt not long ago (DD-wrt support was why I've decided on this model, but I was too lazy to do that before).

nashashmi2• 5 years ago

There is a lot here. Some of these are university routers. Tells me that the sysadmin wanted to open up the router so s/he can manage from home. Nifty. But not secure. And they are no way taking the extra effort to make their system secure.

jasonladuke0311• 5 years ago

The UI is using jQuery 1.10.0, released in May 2013. I would be surprised if there have been many bugfixes or security updates on these.

ytch• 5 years ago

Web server itself could be an attack vector too.

Although not specified to TP-Link, There are many exploits on other brands that can bypass the Authentication. For example this one:

https://medium.com/tenable-techblog/bypassing-authentication...

Even allowing access the web server from internet could be dangerous.

ineedasername3• 5 years ago

2) These routers were deliberately placed on the internet by people that knew enough about them to do so.

If "placing it on the internet" was proof of excellent security knowledge & practices, then nothing on the internet would be insecure.

Just because they knew enough to know how to place it on the internet doesn't mean they understood the implications of that decision.

throwaway984393• 5 years ago

Nice try, NSA.

spockz• 5 years ago

The sensible way to secure it would be to have a device behind the router, in an isolated network which is the only network/device allowed to access the management interface. Then you tunnel/vpn/wire guard into that device.

xondono2• 5 years ago

If their router login page has been indexed, then the user most likely don’t know what they are doing.

It’s fine to expose router configuration (although it’s not ideal), but if you know that you are doing, you’ll at least place it behind a VPN.

dinkdinkdink2• 5 years ago

I know what I'm doing. I would be fine with this in some circumstances. There are legitimate reasons adding a VPN to a backdoor like this can make it worse. The trick to "knowing what you are doing" in this case is defense in depth and knowing what's actually accessible from a world-open interface, and how much of that would be really annoying to get to while simultaneously fixing your homebrew VPN that fell over six months ago and that you never got around to fixing.

Most routers are perfectly fine with a limited set of knobs accessible to the public Internet behind reasonably secure access ports. Bastion it behind SSH and/or SOCKS if you're paranoid, but seriously, as long as we're not talking a $50 Target 'router', it's probably fine. My Ubiquiti gear is indexed. It also reliably e-mails me when it successfully authenticates a user and can distinguish between inside and outside access to ACL what it can do.

Just saying, easy with the "if you know what you're doing" thing, because opinions differ (particularly with beyondcorp in an IT setting). Gluing a VPN back together through an SSH tunnel so you can get at the "fail over to my DSL connection" button inside your network is a really crappy deal at 3 a.m. with a few beers in you and 200ms in between.

ansn• 5 years ago

There are significantly more than 21 results listed on Google. Google automatically hides what it considers "duplicate results". There's an option to "repeat the search with the omitted results included" on page 2, which reveals all of the 7,000+ results, of which the vast majority are different routers.

tester756• 5 years ago

https://en.wikipedia.org/wiki/Google_hacking

coldacid• 5 years ago

Funny enough, this very page was the top result for me on Google.

soheil8• 5 years ago

I suggest anyone wanting to see the pages in the search result to click on the google cache version instead of clicking on the link itself exposing your IP address.

AshamedCaptain• 5 years ago

I am quite sure there are enough preload/prefetch links in the Google results pages to make this irrelevant (and crash the poor routers' owners' downstream links).

soheil8• 5 years ago

Here is another example of what Google wasn't designed to do: https://www.google.com/search?q=intitle%3A%22index+of%22+mp3

TchoBeer4• 5 years ago

What is this showing?

forgotpwd16• 5 years ago

Open directories with direct links to mp3 files. You can try replacing mp3 with movies, shows, etc.

quickthrower23• 5 years ago

Man. Hypothetically this is freaking awesome! Interesting with an mp4 search too.

beezischillin• 5 years ago

Some of these routers can be crazy insecure. Just some fun from my own experience: before I got mine switched into bridge mode by my ISP I managed to disable the wifi on it despite the ISP blocking that functionality. How? By removing the disabled attribute from the select element via the devtools. I also know a friend who found his password in plaintext in a script tag in his router’s login page. I understand that nothing is absolutely secure but this is just tempting fate.

Alupis12• 5 years ago

Click "Next Page" folks - estimated 7,000+ results turns into 21 results - many of which are dead, many others are HN aggregators, leaving the total amount of these model routers on the public internet to be a small handful - all of which appear to be professionally managed with CNAMEs, etc.

All the outrage in this thread over nothing...

ElijahLynn2• 5 years ago

True claim: When I click on "next page" I get "Page 2 of about 7,520 results" BUT when I click on "next page" again I do get "Page 3 of about 21 results".

nicce2• 5 years ago

Does this mean that our beloved search engine is narcissist. Overqualifying its capabilities. Or thinks that it found everything useful already.

mr_sturd• 5 years ago

many of which are dead

They could all be receiving hugs of death from the HN traffic.

calibas• 5 years ago

Ahem:

In order to show you the most relevant results, we have omitted some entries very similar to the 22 already displayed. If you like, you can repeat the search with the omitted results included.

gennarro• 5 years ago

This is a list of the routers with the best SEO

mrkramer• 5 years ago

Google dorking at its finest.

FridayoLeary• 5 years ago

It's a slightly recursive submission.

yakubin• 5 years ago

https://www.google.com/search?hl=en&q=recursion

jonplackett• 5 years ago

This has gone meta now and the search link just links back to this HN article.

prasanthabr• 5 years ago

Woah! Never thought this would be crawled by the google bot. Thanks for sharing

z80x86• 5 years ago

When you include omitted results, you’ll get the entire set of ~7000. The each result is nearly identical, so Google will initially filter them out.

aetherspawn2• 5 years ago

Hi folks, not much to see here.

These routers are very well designed, receive regular firmware updates and are overall very solid. The only router that I haven't had to reboot since I've owned it (for nearly 18 months now). Had no random configuration resets, interface bugs, WiFi drop-outs, QoS issues ... just, solid.

So seeing that people have exposed it to the internet - sure, that's not recommended. But I don't think that it is something to be overly concerned about. It doesn't feel like your normal internet of crap router.

And as others have said, this is not the default setting, and you're actually warned when you try and enable external access. But for some, this is useful. Since this router supports a VPN server, external access could be the only way to troubleshoot it if you're not on-site.

jfrunyon7• 5 years ago

Oh, great! It's stable! That means it couldn't possibly have any 0days or weak passwords.

aetherspawn2• 5 years ago

A security problem is a bug. If their track record is quality (i.e. no bugs), you can extrapolate that their process is pretty good at dealing with security problems as well. Until proven otherwise.

Of course, nothing is unhackable. If a state actor wants to get inside your router, you'll lose no matter what. And you don't need to have https:// exposed on WAN to get hacked in that way. The 0-day could just as easily be on the transceiver or on the WAN layer itself.

The only way to protect yourself from a 0-day is to live in a tin foil bubble and simply never use a mobile phone or the internet.

dole• 5 years ago

"Regular firmware updates"

Archer C7 v4's last firmware update, Dec 2019. Archer C7 v5's last firmware update, Jan 2021.

Might be solid, but I guess "regular" is relative.

fnord772• 5 years ago

I'm getting "invalid cert" on all of these

fnord772• 5 years ago

also, how did google find these? scanning all possible IPs? or from shodan?

TchoBeer4• 5 years ago

Let's say I social engineer a password out of one of these people. What can I do with that?

fermentation• 5 years ago

You can restart their router enough times until they get annoyed and buy a new one.

soheil8• 5 years ago

You can install openWRT on their router and gain full access to their network.

TchoBeer4• 5 years ago

Once I get access to their network, what can I do? What does that do for me?

SturgeonsLaw2• 5 years ago

You can set up a VPN and connect directly to their network. You can put one of their computers into the DMZ and expose all its open ports to the internet. You could engage in denial of service by blocking their devices or messing with the WAN configuration. You could set their network to use a malicious DNS server and direct them to hosts that you control.

vanpelt• 5 years ago

Pretty cool this post is already the first result in Google’s index. How does that work?

nashashmi2• 5 years ago

How did these routers end up in google results. In the past you could check with link: I am not sure if there is any way you can check now.

soheil8• 5 years ago

One way I suppose is this: there are indexed sites on Google that just basically list all known IP addresses (eg. ip to location services) in hope of SEO juice. If those IPs are linked to by said websites then the Google spider will follow and index them.

soheil8• 5 years ago

Note to self - if ever work at a router company include a robots.txt with:

  disallow all

remram• 5 years ago

That is such an easy fix. I can't believe this is not the default on all devices with an HTTP server. Of course this wouldn't stop attacks or even entire-internet scans (does Shodan respect that?) but would make discovery way harder.

Brb going through all software I ever wrote looking whether they could benefit from this too.

kralos2• 5 years ago

Hey Mum! I can see my router from here!

tjxp• 5 years ago

I just checked if my router's admin was open to public access by connecting with my public IP. It connected! Oh no! That's embarrassing, I thought. Turns out it was just NAT hairpinning. I can't connect from my mobile network.

kivlad• 5 years ago

I've done something similar once to find Dell iDRAC [0] and Exchange Outlook Web App [1] instances open to the internet. Just goes to show how forgetting a simple robots.txt (if it's even an option) can expose something you don't want, even if it's password protected.

[0] https://www.google.com/search?q=%22Type+in+Username+and+Pass...

[1] https://www.google.com/search?q=intitle%3A%22Outlook+web+app...

ThePowerOfFuet• 5 years ago

Non-Google link:

https://duckduckgo.com/?q=%22Please+log+in+with+router%27s+p...

hamidchowdhury• 5 years ago

Welcome to your Password Manager. Manage your saved passwords in Android or Chrome. They're securely stored in your Google Account and available across all website .

quickthrower23• 5 years ago

How do they get the requisite backlink or submission to search console to appear in Google I wonder

bhaavan• 5 years ago

On a side not, it's super annoying when you want to log in into your router, and google chrome auto completes / suggests it with 192.168.l.l, or ends up doing a google search for 192.168.0.1.

James-Livesey• 5 years ago

iirc, there's a certain query that's similar to this one which you could type into Google and control various security cameras around the world which are all on the WAN. Not only can you view the picture being recorded by the cameras, but you could rotate the cameras right from the web interface too.

I (un)fortunately can't remember the certain query needed, but it's not too hard to find it — I'm sure it's been mentioned on various news articles or YouTube videos. If I remember, it relied on the cameras all sharing the same filename for the PHP page to access the interface.

Please log in with router's password

Related Stories