Windows 10: Hacker leaks passwords for 500,000+ servers, routers, and IoT devices

Brink · Jan 23, 2020

A hacker has published this week a massive list of Telnet credentials for more than 515,000 servers, home routers, and IoT (Internet of Things) "smart" devices.The list, which was published on a popular hacking forum, includes each device's IP address, along with a username and password for the Telnet service, a remote access protocol that can be used to control devices over the internet.

According to experts to who ZDNet spoke this week, and a statement from the leaker himself, the list was compiled by scanning the entire internet for devices that were exposing their Telnet port. The hacker than tried using (1) factory-set default usernames and passwords, or (2) custom, but easy-to-guess password combinations.

These types of lists -- called "bot lists" -- are a common component of an IoT botnet operation. Hackers scan the internet to build bot lists, and then use them to connect to the devices and install malware.

These lists are usually kept private, although some have leaked online in the past, such as a list of 33,000 home router Telnet credentials that leaked in August 2017. To our knowledge, this marks the biggest leak of Telnet passwords known to date...
Click to expand...

Read more: Hacker leaks passwords for more than 500,000 servers, routers, and IoT devices | ZDNet

:)

IggSter · Jan 23, 2020

How to factory reset Cisco 1700 Router

Hopefully I can help you here....its a very common thing to happen.

First, I take it you dont know the passwords for console access or telnet/ssh?

I will assume that these devices belong to you.

step 1. Plug a cisco console cable into a serial port on your pc
step 2. Plug other end into Cisco console port
step 3. Using hyperterm or putty or similar connect to the serial port
step 4. boot router, and make sure you clearly can see the output (this confirms you have good serial comms)
step 5. if this fails, adjust the comm port settings (9600, 8,1,n are the default)
step 6. now you have to do the only hard part...send the break command:

Break command list: Break Commands

Go down the list and match your OS and SW and try the sequence suggested.

If this fails several times do what I do: Install putty (free) and then to send a break so you can get into rommom just hit "ctrl-a b".

Dann Ave · Jan 23, 2020

Safely Changing Router Password

HI Sherry,

You should still be able to manage your router's password even with the prompt for the site not being secure. Though if you are unable to completely access your router's gateway, you can use the router's IP.

To get the IP, follow the following steps.

Press Windows key and X.

Select Command Prompt.

Type: ipconfig /all.

On the information that will show, look for DHCP Server, take note of its IP.

You can type the IP to your browser to access your router's gateway.

If you are still having concerns with accessing your router's gateway, best to contact your internet service provider if they are the ones who gave the router, or the router's manufacturer for further assistance.

Regards.

Brink · Jan 23, 2020

FBI warns hacked IoT devices used for malicious cyber activities

Cyber actors actively search for and compromise vulnerable Internet of Things (IoT) devices for use as proxies or intermediaries for Internet requests to route malicious traffic for cyber-attacks and computer network exploitation. IoT devices, sometimes referred to as “smart” devices, are devices that communicate with the Internet to send or receive data. Examples of targeted IoT devices include: routers, wireless radios links, time clocks, audio/video streaming devices, Raspberry Pis, IP cameras, DVRs, satellite antenna equipment, smart garage door openers, and network attached storage devices.

IoT proxy servers are attractive to malicious cyber actors because they provide a layer of anonymity by transmitting all Internet requests through the victim device’s IP address. Devices in developed nations are particularly attractive targets because they allow access to many business websites that block traffic from suspicious or foreign IP addresses. Cyber actors use the compromised device’s IP address to engage in intrusion activities, making it difficult to filter regular traffic from malicious traffic.

Cyber actors are using compromised IoT devices as proxies to:

Send spam e-mails;

Maintain anonymity;

Obfuscate network traffic;

Mask Internet browsing;

Generate click-fraud activities;

Buy, sell, and trade illegal images and goods;

Conduct credential stuffing attacks, which occurs when cyber actors use an automated script to test stolen passwords from other data breach incidents on unrelated web-sites; AND

Sell or lease IoT botnets to other cyber actors for financial gain.

Cyber actors typically compromise devices with weak authentication, unpatched firmware or other software vulnerabilities, or employ brute force attacks on devices with default usernames and passwords.

Compromised devices may be difficult to detect but some potential indicators include:

A major spike in monthly Internet usage;

A larger than usual Internet bill;

Devices become slow or inoperable;

Unusual outgoing Domain Name Service queries and outgoing traffic; or

Home or business Internet connections running slow.

Protection and Defense

Reboot devices regularly, as most malware is stored in memory and removed upon a device reboot. It is important to do this regularly as many actors compete for the same pool of devices and use automated scripts to identify vulnerabilities and infect devices.

Change default usernames and passwords.

Use anti-virus regularly and ensure it is up to date.

Ensure all IoT devices are up to date and security patches are incorporated.

Configure network firewalls to block traffic from unauthorized IP addresses and disable port forwarding.

Isolate IoT devices from other network connections.

Additional Resources

For additional information on cyber threats to IoT devices, please refer to “Common Internet of Things Devices May Expose Consumers to Cyber Exploitation,” available at https://www.ic3.gov/media/2017/171017-1.aspx.

Victim Reporting

If you suspect your IoT device(s) may have been compromised, contact your local FBI office and/or file a complaint with the Internet Crime Complaint Center at www.ic3.gov.
Click to expand...

Source: Internet Crime Complaint Center (IC3) | Cyber Actors Use Internet of Things Devices as Proxies for Anonymity and Pursuit of Malicious Cyber Activities

Windows 10: Hacker leaks passwords for 500,000+ servers, routers, and IoT devices

Hacker leaks passwords for 500,000+ servers, routers, and IoT devices

Hacker leaks passwords for 500,000+ servers, routers, and IoT devices

Hacker leaks passwords for 500,000+ servers, routers, and IoT devices

Hacker leaks passwords for 500,000+ servers, routers, and IoT devices - Similar Threads - Hacker leaks passwords

Was there a Password Leak?

Was there a Password Leak?

Hacker sent me an email of all my passwords and claims to leak video of me.

Hacker sent me an email of all my passwords and claims to leak video of me.

Hacker sent me an email of all my passwords and claims to leak video of me.

Internal Server Error / Code 500

500 server error

Is my password leaked?

Build your IoT devices with Windows for IoT