Laughable IoT security

[ducktales4gameboy]

I had several of that router. They were $5 new-in-box at a local wholesaler, so I figured I'd pick a couple up for DD-WRT fileservers since they were cheaper than RPIs.

Amusingly the ftpd issue wasn't the worst issue. I'll just quote one of the pages about DDWRT compatibility on them:

If you did not reflash the device with any other firmware, you can get shell by going to 192.168.1.254/obama.asp. You can fire up telnetd with telnetd -l /bin/sh and get instant root access.

It was literally just a HTML form that executed commands as root via http get requests.

 

[ToroidalBoat]

Ring camera hacker harasses Mississippi 8-year-old in her bedroom - The Washington Post

The faceless voice shouted the n-word at the girl and tried to get her to repeat it, and later told her that he was Santa Claus.

Remember a time when kids didn't "need" constant surveillance?

 

[He Who Points And Laughs]

Years ago there were some routers that could act as a NAS if USB HDDs were plugged in to them, pretty decent idea at the time, making the NAS an open internet-facing FTP server by default wasn't as great. For the oblivious owners, very fun for other people though.

I use syncthing for that purpose, it's shared between my computers only.

It's like dropbox without the use of 'The Cloud'.*



*other people's hard drives.

 

[⠠⠠⠅⠑⠋⠋⠁⠇⠎ ⠠⠠⠊⠎ ⠠⠠⠁ ⠠⠠⠋⠁⠛]

Here's an interesting writeup on a method that can be used to disable Ring and other government-spycams-by-proxy. Even if they record video while offline it should give plenty of time to get in there and physically disable them.
https://mjg59.dreamwidth.org/53968.html

 

[REGENDarySumanai]

A hammer is the best tool to disable IoT devices.

 

[DNA_JACKED]

Years ago there were some routers that could act as a NAS if USB HDDs were plugged in to them, pretty decent idea at the time, making the NAS an open internet-facing FTP server by default wasn't as great. For the oblivious owners, very fun for other people though.

Most routers today still do that, they just have the common sense option of locking the drive out from the external internet.