Vendor-Supplied Defaults Are a Serious Threat

Quick Answer: Why Are Default Passwords a Major Security Risk

‍
Default vendor passwords are risky because attackers can find them with a simple search, giving instant access to any device where defaults weren't changed.

• Default settings are identical across every unit of the same device model, making them predictable targets.
• A SecurityMetrics forensic investigation found an IT vendor had configured 50 merchants with the same default configuration and passwords.
• Once an attacker cracks one shared default credential, it can expose every device sharing that configuration.
• Change default usernames and passwords on every device before connecting it to your network.

‍

Hackers are merely a Google search away from hacking your network.

Devices, like routers, come straight from the vendor with factory settings like default usernames and passwords. Defaults make device installation and support easier, but also mean every model originates with the same username and password. When those defaults aren’t changed, you give hackers Wonka’s Golden Ticket into your system.

Watch the video to learn more about vendor supplied defaults.

During a recent SecurityMetrics forensic investigation, we discovered the IT company that configured the compromised merchant also set up 50 additional merchants with the same configuration and passwords. Yikes.

Once the hacker cracked the username/password, it was all downhill from there.

Don’t believe it? Google your device. Type: “[manufacturer] [model] default password.” It’s really quite simple to find your device’s default settings, along with a slew of hackalicious goodies.