“This is a rather large security issue that has been (until
lately) largely ignored and swept under the carpet. Many vendors
have a dirty little secret: they ship software and hardware with
default usernames and passwords, some of which they do not tell
customers about. Once an attacker knows these default settings they
can typically access the software remotely and gain administrative
control. This can be extremely dangerous. Consider an attacker
gaining access over your switch and routing infrastructure and
forwarding traffic from the R&D department to another server.
Alternatively, imagine the attacker taking over your remote access
devices, such as ISDN routers, and then sniffing passwords as users
access the corporate LAN.”
“This is a huge problem because companies buy lots and lots of
hardware and software that they need to deploy quickly. This often
results in minimal configuration effort being made, and the default
passwords are usually left in, due to carelessness, or for the
simple fact that the people installing it don’t know….”
“The reason this issue exists is that vendors want to make
products easy to deploy, increase ease of use and decrease support
costs. When shipping a software or hardware product that has
passwords, the cheapest solution is to simply leave them blank or
set them with a default password. Ideally, vendors would ship each
piece of hardware with a different, hard to guess default password
such as “2i3h2323ddf” and tell the customer what it is. Some
vendors do this, but it is relatively rare. Ideally with hardware,
the vendor should log in to the hardware, generate a random
password and then assign it, and print out the password and ship it
with the product. For software vendors this is a bit more
difficult, as mass producing CD-ROMs is not feasible if every
CD-ROM must be different. In a perfect world, software products
would generate secure random passwords during install and notify
the user. Unfortunately this would also increase support costs and
user aggravation, so as with most security issues, ease of use
beats out security.”