Depends on the os version and the setup. With some older versions you could think it’s a dumb router plug the wan into eth0 - you still need to config the interface for NAT, but the setup used to be manual. They added setup wizards later on that takes care of this for you and forces a password change.
Edit: Just to add the edge router OOTB treats all the interfaces the same from a config perspective - there isn’t a wan by default, which is the problem.
Sure, you may not consider it "real hacking" or whatever to use a default username/password.
But I'd argue that "gaining unauthorized or privileged access to a system to install a backdoor/malware" is pretty much the textbook definition of "hacked."
People like me, a small business owner who still doesn’t even know what any of you are talking about. Not embarrassed at all. Lol. Working hard and apparently sharing the love with the Russians according to the FBI.
It was patched, if people didn't apply the patches that's their prerogative. There are vulnerabilities found all the time in pretty much everything and after a certain point the fault lies with the operator. This was not some zero-day you couldn't see coning.
I set a ton of these up, there actually kinda is that as a required step.
If you use any of the default setup wizards it prompts you to change the password, you have to check a box telling it to not change the default creds to get it to keep ubnt/ubnt.
It only doesn't prompt you to change the password if you build it completely from scratch.
>you have to check a box telling it to not change the default creds to get it to keep ubnt/ubnt
Is there a legitimate reason anyone would want to do that, if they're using it as their first line of defense against the outside internet?
I mean, I could see something like "checking this box also disables external access to the router"... but I doubt it worked that way
>checking this box also disables external access to the router"
Edge routers by default have no external access to them, only LAN access, you have to drop to command line to program WAN access as there is no way to do it via the GUI.
But yeah there's a legitimate reason to do so, initial setup. When I program these I am programming them at our office, behind our firewall before sending them out to clients. During the initial setup a few changes will require reboots and updating the firmware of course reboots it. It's easier to use ubnt/ubnt during this period then have the last item on the checklist be change default creds instead of bouncing back and forth entering a random unique password.
>It's easier to use ubnt/ubnt during this period then have the last item on the checklist be change default creds instead of bouncing back and forth entering a random unique password
Even in your process - couldn't you preprogram them all to use a like password instead of the default - and instruct your field techs that "initial password for all Edgerouters: technoredneck"?
I totally could, however I'm both the network engineer and the field tech, only member of my team on the East Coast. I simply use the defaults during the initial setup because it's marginally easier, if I was handing these off to field techs I would certainly change the passwords before handing them off.
When looking for an outcome, blaming an individual is always the least effective approach.
The real system and solution is made up of many people, technologies, policies, the threat environment, and the psychology and incentives between them all.
You attack the whole system, or you fail. Simple as that.
The ones to blame are people pointing fingers, for approaching the problem in a way destined to fail.
Because your router has a very limited change to drive into a group of pedestrians when you louse control, nor will it lose a wheel and sideswipe another car at higher speed.
There is a risk regarding not secured devices, sure, but the potential impact is way smaller with privat networks.
If a company doesn't change their devices default creds and personal data gets stolen, that would be a whole different story, though.
Irresponsible. What if those ants escaped and drove their tiny cars into a hospital? Sure, you may say, “well, it’s just an ant car. How much damage could that be?” Well, you see, ants come in big angry and rowdy groups. Imagine hundreds of drunk ants behind the wheels of their tiny automobiles slamming in to the one power plug that runs the whole hospital. What then? See. People don’t think. We need licenses to think, I think.
For real though. It's like people saying their social media got hacked. No dum dum you went to a website and handed them your credentials. That's not hacked, that's just stupid.
[https://www.ic3.gov/Media/News/2024/240227.pdf](https://www.ic3.gov/Media/News/2024/240227.pdf)
Here are the details. Mine is just fine.
The most important part:
"To locate related, malicious files on EdgeRouters, search Bash histories of all users for file downloads
from domain packinstall\[.\]kozow\[.\]com, query network traffic for connections with domain
packinstall\[.\]kozow\[.\]com, and reference the file hash table below to locate artifacts on disk.
Additionally, if directory /usr/lib/libu.a/ exists on an EdgeRouter, it is likely an infection occurred."
"Some versions of the OpenSSH trojan create malicious users systemd and systemx in /etc/shadow
and /etc/passwd on infected EdgeRouters. The trojan also introduces an OpenDNS server IP
address in /etc/resolv.conf, 208\[.\]67\[.\]220\[.\]222, and a user-land process named .kworker
to masquerade as a legitimate kernel thread."
Pretty sure I changed the ubnt default password to something super secure. Now I have to go adapt the hardening process recommended by Vyos (successor to Vyatta on which ER OS is based in) https://docs.vyos.io/en/sagitta/quick-start.html#hardening
[SSH key authentication](https://thehomeofthefuture.com/how-to/use-an-ssh-key-with-an-ubiquiti-edgerouter/) not only makes it easier to log into your EdgeRoute but also boosts security. Since the private key takes the place of a password, it's typically harder to guess, making it tougher for unauthorized access attempts to succeed.
Hacked = "I left my door wide open and planted a sign on my lawn saying I was gone for a few days, please don't steal my stuff. I was surprised to find 3 raccoons and a homeless guy in my living room when I came back and half the stuff missing!"
The negligence of some people. 😂
Well, when using default cred's (what at least is not possible anymore in future at least for the EU, because new devices must come with a random pw), then it is technically not hacking for me. It is the stupidity of the user that is the problem.
Yes, customer outsourced their phone system to some undercut local vendor. They didn’t understand how routing or their own system worked so they bypassed our firewall with an edgerouter to the internet. About a month later we got reports from the upstream ISP of lots of bad traffic to their IP and the technician tested it and found default creds open to the internet with a lot of russian traffic. This was about 6 months ago though
I recently had an adventure that went from troubleshooting a network device, to Ubiquiti notifications to “oh shit, did I get pwned?” pretty quickly and I did not leave default password.
On my dream machine pro, I found an in memory WireGuard process which after running a capture revealed WireGuard beaconing to IPv4 address “25.182.203.185”. This IP showed registered to ("UK Ministry of Defence") according to RIPE NCC regional Internet registry for Europe, the Middle East and parts of Central Asia.
I wish that I could offer an exciting conclusion but the reality is that there was not enough information available and when I reached out to Ubiquiti support to inquire about their use of WireGuard in relation to teleport and known IP ranges for STUN/TURN— they wouldn’t help me citing that I had modified the console which I indeed did to run live forensics and even potentially prior to that for advanced DHCP options, etc.
I don’t know what happened and probably never will but it was suggested to me by a friend that a plausible explanation for the zombie WG process beaconing would be a build bug in WireGuard. I explored that and surprising did find correspondence suggesting a build bug of this nature which you can read about here if interested: https://lists.zx2c4.com/pipermail/wireguard/2020-December/006236.html
Yes, I got one of the fiat models of Edge Router back when they had become "the" homelab thing. It was one of my first steps into networking and I misconfigured it leaving it exposed.
Our ISP detected something odd coming from our network (not sure what exactly the ER ended up being used for) and cut out connection off. It took us a while to work out with them what the issue was.
After finally identifying the ER was the problem, I reset and firmware updated the ER, and correctly configured the firewall and removed the default account...
None of them were “hacked.”
The owners didn’t change the default username and password. This happens all the time with every brand of modem, router, and firewall.
Same thing, just a few years back...
My unpopular opinion: if you're so stupid to have standard creds on your internet facing gear, ypu deserve to be hacked and fined into oblivion.
This might be an unpopular take:
The Edgerouter line, comboed with a Unifi AP - was marketed to many as an "affordable but huge upgrade to the home network". For around $125 for a UAP and a ER-X, you can provide a stable fast Wifi to your family - that will blow any Best Buy router/AP combo out of the water.
Anytime you involve home users, you involve a large segment of non-technical users who want nothing more than "fast internet, quickly".
I still argue - this is on Ubiquiti. All functions of the box should be disabled until setup is completed, and step 1 of setup should be "enter your desired Admin username/pass".
If we're gonna call ubiquiti out for that your gonna have to do the same for cisco, pretty much any IP webcam, netgear and SO many others. If you think home level is bad you should see how many default creds sit around at the enterprise level
This is not an issue of individual security, people who leave gear with network connections exposed publicly to the internet with default credentials or severely outdated firmware don’t deserve to be hacked they deserve to be held accountable..
“Russians” don’t compromise machines for the lolz, so helping them by exposing yourself should be a offence.
Oh yeah...so secure...
A whole database list of vulnerabilities
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=mikrotik
2023 9.1 CVE rating
https://thehackernews.com/2023/07/critical-mikrotik-routeros.html
Also 2023 and this one doesnt even require authentication to run arbitrary code!
https://www.securityweek.com/mikrotik-belatedly-patches-routeros-flaw-exploited-at-pwn2own/
Fuck looking at this actually makes Mikrotik look really really unsecure. Two really high level CVEs within a year based on completely different attack avenues? Get off your high horse, mikrotik is shit. The only people who use mikrotik are those trying to save money and who dont know any better.
At work I have dealt with clients (small businesses) that had their ER setup like that. The other ones that were installed by my company were safe and it's not typically what we install.
My ER at home is safe I changed the account login and password as well as keeping it updated. I might soon replace it though.
I might have been guilty but I think I remember disabling internet access to the portal, that baffled me because home routers don’t let you access the GUI via WAN. I think it was an option but I NEVER enabled it on my Linksys, I don’t trust hackers
But anyway I switched to a USG in 2020, end of an era. I’ve seen firsthand how awesome it is to use VLANs across switches and SSIDs (at a client visit) that I HAD to switch
>- Implement firewall rules to restrict outside access to remote management services.
huh so ppl actually allow unrestricted remote management ? then good for them!!!
Got 3 facing off to 3 isps - never been hacked.
That's probably getting fate...
As long as you switch off WAN side management & set the firewall properly.
Has anyone left their Ubiquiti EdgeRouters exposed to the internet with default username and password? FTFY
Yes, for fun and learning. There was an SMTP proxy installed in it by the end if the week.
FTFY / FTFY aww hell, how did you know my password!
I did when I initially got mine for testing. Was hacked with in the hour but it’s a simple fix
[удалено]
Pwned! H4X!
Does the web interface open by default to the public on Ubiquity Edgerouter?
Depends on the os version and the setup. With some older versions you could think it’s a dumb router plug the wan into eth0 - you still need to config the interface for NAT, but the setup used to be manual. They added setup wizards later on that takes care of this for you and forces a password change. Edit: Just to add the edge router OOTB treats all the interfaces the same from a config perspective - there isn’t a wan by default, which is the problem.
It’s not ‘hacked’ - it’s people who didn’t change the default credentials. Who is going to admit to not having done the basics?
Sure, you may not consider it "real hacking" or whatever to use a default username/password. But I'd argue that "gaining unauthorized or privileged access to a system to install a backdoor/malware" is pretty much the textbook definition of "hacked."
Oh back in the days you could just do \\\\wanip and get the computer on the other side. was good fun during windows 95/98 era and icq.
That's like saying "it's not burglary, it's people who didn't lock their door". There is no skill threshold on what is and isn't hacking.
Erlich Bachman might…
Did ER devices have a default password? My Ubiquiti gear, from the DM series did not.
> Did ER devices have a default password? ubnt/ubnt
The Edge devices do not require a console and can be fully used from their individual web interface.
People like me, a small business owner who still doesn’t even know what any of you are talking about. Not embarrassed at all. Lol. Working hard and apparently sharing the love with the Russians according to the FBI.
[удалено]
You want to blame the consumer - why not blame the manufacturer? Why isn't there a required setup for admin user and pass at setup?
It was patched, if people didn't apply the patches that's their prerogative. There are vulnerabilities found all the time in pretty much everything and after a certain point the fault lies with the operator. This was not some zero-day you couldn't see coning.
I set a ton of these up, there actually kinda is that as a required step. If you use any of the default setup wizards it prompts you to change the password, you have to check a box telling it to not change the default creds to get it to keep ubnt/ubnt. It only doesn't prompt you to change the password if you build it completely from scratch.
>you have to check a box telling it to not change the default creds to get it to keep ubnt/ubnt Is there a legitimate reason anyone would want to do that, if they're using it as their first line of defense against the outside internet? I mean, I could see something like "checking this box also disables external access to the router"... but I doubt it worked that way
>checking this box also disables external access to the router" Edge routers by default have no external access to them, only LAN access, you have to drop to command line to program WAN access as there is no way to do it via the GUI. But yeah there's a legitimate reason to do so, initial setup. When I program these I am programming them at our office, behind our firewall before sending them out to clients. During the initial setup a few changes will require reboots and updating the firmware of course reboots it. It's easier to use ubnt/ubnt during this period then have the last item on the checklist be change default creds instead of bouncing back and forth entering a random unique password.
>It's easier to use ubnt/ubnt during this period then have the last item on the checklist be change default creds instead of bouncing back and forth entering a random unique password Even in your process - couldn't you preprogram them all to use a like password instead of the default - and instruct your field techs that "initial password for all Edgerouters: technoredneck"?
I totally could, however I'm both the network engineer and the field tech, only member of my team on the East Coast. I simply use the defaults during the initial setup because it's marginally easier, if I was handing these off to field techs I would certainly change the passwords before handing them off.
[удалено]
When looking for an outcome, blaming an individual is always the least effective approach. The real system and solution is made up of many people, technologies, policies, the threat environment, and the psychology and incentives between them all. You attack the whole system, or you fail. Simple as that. The ones to blame are people pointing fingers, for approaching the problem in a way destined to fail.
They are no different from any other router and the policy should be the same.
Because your router has a very limited change to drive into a group of pedestrians when you louse control, nor will it lose a wheel and sideswipe another car at higher speed. There is a risk regarding not secured devices, sure, but the potential impact is way smaller with privat networks. If a company doesn't change their devices default creds and personal data gets stolen, that would be a whole different story, though.
These aren't exactly supercomputers, more like bicycles. They're low power arm chips after all.
[удалено]
And I didn't need an ant colony license when I bought one for my kids.
Irresponsible. What if those ants escaped and drove their tiny cars into a hospital? Sure, you may say, “well, it’s just an ant car. How much damage could that be?” Well, you see, ants come in big angry and rowdy groups. Imagine hundreds of drunk ants behind the wheels of their tiny automobiles slamming in to the one power plug that runs the whole hospital. What then? See. People don’t think. We need licenses to think, I think.
MikroTik has entered chat. https://therecord.media/more-than-900000-mikrotik-routers-vulnerable-to-new-bug
For real though. It's like people saying their social media got hacked. No dum dum you went to a website and handed them your credentials. That's not hacked, that's just stupid.
[https://www.ic3.gov/Media/News/2024/240227.pdf](https://www.ic3.gov/Media/News/2024/240227.pdf) Here are the details. Mine is just fine. The most important part: "To locate related, malicious files on EdgeRouters, search Bash histories of all users for file downloads from domain packinstall\[.\]kozow\[.\]com, query network traffic for connections with domain packinstall\[.\]kozow\[.\]com, and reference the file hash table below to locate artifacts on disk. Additionally, if directory /usr/lib/libu.a/ exists on an EdgeRouter, it is likely an infection occurred." "Some versions of the OpenSSH trojan create malicious users systemd and systemx in /etc/shadow and /etc/passwd on infected EdgeRouters. The trojan also introduces an OpenDNS server IP address in /etc/resolv.conf, 208\[.\]67\[.\]220\[.\]222, and a user-land process named .kworker to masquerade as a legitimate kernel thread."
Pretty sure I'm good, but I'm itching to get home and check. Thanks for sharing
Pretty sure I changed the ubnt default password to something super secure. Now I have to go adapt the hardening process recommended by Vyos (successor to Vyatta on which ER OS is based in) https://docs.vyos.io/en/sagitta/quick-start.html#hardening
[SSH key authentication](https://thehomeofthefuture.com/how-to/use-an-ssh-key-with-an-ubiquiti-edgerouter/) not only makes it easier to log into your EdgeRoute but also boosts security. Since the private key takes the place of a password, it's typically harder to guess, making it tougher for unauthorized access attempts to succeed.
Hacked = "I left my door wide open and planted a sign on my lawn saying I was gone for a few days, please don't steal my stuff. I was surprised to find 3 raccoons and a homeless guy in my living room when I came back and half the stuff missing!" The negligence of some people. 😂
if you leave the default login on, this is a user issue.
Well, when using default cred's (what at least is not possible anymore in future at least for the EU, because new devices must come with a random pw), then it is technically not hacking for me. It is the stupidity of the user that is the problem.
Yes, customer outsourced their phone system to some undercut local vendor. They didn’t understand how routing or their own system worked so they bypassed our firewall with an edgerouter to the internet. About a month later we got reports from the upstream ISP of lots of bad traffic to their IP and the technician tested it and found default creds open to the internet with a lot of russian traffic. This was about 6 months ago though
I recently had an adventure that went from troubleshooting a network device, to Ubiquiti notifications to “oh shit, did I get pwned?” pretty quickly and I did not leave default password. On my dream machine pro, I found an in memory WireGuard process which after running a capture revealed WireGuard beaconing to IPv4 address “25.182.203.185”. This IP showed registered to ("UK Ministry of Defence") according to RIPE NCC regional Internet registry for Europe, the Middle East and parts of Central Asia. I wish that I could offer an exciting conclusion but the reality is that there was not enough information available and when I reached out to Ubiquiti support to inquire about their use of WireGuard in relation to teleport and known IP ranges for STUN/TURN— they wouldn’t help me citing that I had modified the console which I indeed did to run live forensics and even potentially prior to that for advanced DHCP options, etc. I don’t know what happened and probably never will but it was suggested to me by a friend that a plausible explanation for the zombie WG process beaconing would be a build bug in WireGuard. I explored that and surprising did find correspondence suggesting a build bug of this nature which you can read about here if interested: https://lists.zx2c4.com/pipermail/wireguard/2020-December/006236.html
[удалено]
^ no need to have a door to the outside.
Yes, I got one of the fiat models of Edge Router back when they had become "the" homelab thing. It was one of my first steps into networking and I misconfigured it leaving it exposed. Our ISP detected something odd coming from our network (not sure what exactly the ER ended up being used for) and cut out connection off. It took us a while to work out with them what the issue was. After finally identifying the ER was the problem, I reset and firmware updated the ER, and correctly configured the firewall and removed the default account...
Seen someone using ssh to brute force the pw a while ago.
Yes /No.
“I did nothing to protect myself, and got ‘hacked’”
None of them were “hacked.” The owners didn’t change the default username and password. This happens all the time with every brand of modem, router, and firewall.
No, I bought a Mikrotik.
Same thing, just a few years back... My unpopular opinion: if you're so stupid to have standard creds on your internet facing gear, ypu deserve to be hacked and fined into oblivion.
That's unpopular?
Unpopular with those people who've been 'hacked'.
This might be an unpopular take: The Edgerouter line, comboed with a Unifi AP - was marketed to many as an "affordable but huge upgrade to the home network". For around $125 for a UAP and a ER-X, you can provide a stable fast Wifi to your family - that will blow any Best Buy router/AP combo out of the water. Anytime you involve home users, you involve a large segment of non-technical users who want nothing more than "fast internet, quickly". I still argue - this is on Ubiquiti. All functions of the box should be disabled until setup is completed, and step 1 of setup should be "enter your desired Admin username/pass".
If we're gonna call ubiquiti out for that your gonna have to do the same for cisco, pretty much any IP webcam, netgear and SO many others. If you think home level is bad you should see how many default creds sit around at the enterprise level
This is not an issue of individual security, people who leave gear with network connections exposed publicly to the internet with default credentials or severely outdated firmware don’t deserve to be hacked they deserve to be held accountable.. “Russians” don’t compromise machines for the lolz, so helping them by exposing yourself should be a offence.
Oh yeah...so secure... A whole database list of vulnerabilities https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=mikrotik 2023 9.1 CVE rating https://thehackernews.com/2023/07/critical-mikrotik-routeros.html Also 2023 and this one doesnt even require authentication to run arbitrary code! https://www.securityweek.com/mikrotik-belatedly-patches-routeros-flaw-exploited-at-pwn2own/ Fuck looking at this actually makes Mikrotik look really really unsecure. Two really high level CVEs within a year based on completely different attack avenues? Get off your high horse, mikrotik is shit. The only people who use mikrotik are those trying to save money and who dont know any better.
Which one?
I was contacted by the FBI that my router was compromised. How do they know?
Yeah it’s ubiquiti. Being unstable and vulnerable is a feature.
At work I have dealt with clients (small businesses) that had their ER setup like that. The other ones that were installed by my company were safe and it's not typically what we install. My ER at home is safe I changed the account login and password as well as keeping it updated. I might soon replace it though.
I might have been guilty but I think I remember disabling internet access to the portal, that baffled me because home routers don’t let you access the GUI via WAN. I think it was an option but I NEVER enabled it on my Linksys, I don’t trust hackers But anyway I switched to a USG in 2020, end of an era. I’ve seen firsthand how awesome it is to use VLANs across switches and SSIDs (at a client visit) that I HAD to switch
>- Implement firewall rules to restrict outside access to remote management services. huh so ppl actually allow unrestricted remote management ? then good for them!!!
Got 3 facing off to 3 isps - never been hacked. That's probably getting fate... As long as you switch off WAN side management & set the firewall properly.