← ACARA Digital Technologies Years 9–10

Default credentials and insecure settings

The factory username and password a device or app ships with. If they are never changed, anyone who knows or guesses them can log in and take control.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 62, WA Computer Science ATAR Year 11 — Cyber Security — Module 56

Understanding Default credentials and insecure settings in ACARA Digital Technologies Years 9–10

What it does: Changing the default at set-up removes the login that attackers already know or can look up. Disabling unneeded services such as remote admin reduces ways for an attacker to reach the device. Default logins are often listed in manuals and online. Anyone who finds them can log in, so change them during set-up. Many devices of the same model ship with identical factory logins, which makes them easy to find and try. A factory password on a camera reachable from the internet lets strangers log in and watch the feed. Services you do not need give attackers more ways in. Switch them off to reduce the attack surface.

Common mistakes: The code sets the router password back to the factory default 'admin'. It should set the new password the user typed, new_pw, so the default can no longer be used to log in. Setting needed to the whole services list means every service counts as needed, so nothing is ever disabled. It should list only the services that are really needed, needed = ['web'], so unneeded services like telnet get turned off.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Default credentials and insecure settings to a class →

This module's key terms are also in a printable crossword (Modules 810–827) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A new home router arrives with the login admin / admin printed on its label. What is the safest thing to do at set-up?

Leave them as they are because the label is only on your routerChange the default username and password straight away

Matches

router.password = "admin" # keep the factory login

↓

The factory default password was kept, so anyone who knows or guesses it can log in and take over the router.

Applying

Meanings

Term

default credentials

Meaning

The factory username and password a device or app ships with. If they are never changed, anyone who knows or guesses them can log in and take control.

Practice

default_passwords = ["admin", "password", "1234"]

Testing

Gaps

if password "admin":

Check Answer

Spots

3if r.password == 'admin':

4 r.set_password('admin')

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A new home router arrives with the login admin / admin printed on its label. What is the safest thing to do at set-up?

A. Change the default username and password straight away ✓

B. Leave them as they are because the label is only on your router

Default logins are often listed in manuals and online. Anyone who finds them can log in, so change them during set-up.

2. Which statement about default credentials is true?

A. They are unique to each device, so they are impossible to guess

B. Attackers can look up or guess them because every device of that model shares them ✓

Many devices of the same model ship with identical factory logins, which makes them easy to find and try.

3. Which is an example of an insecure default setting?

A. A smart camera with a new strong password set by its owner

B. A smart camera that is open to the internet with its factory password ✓

A factory password on a camera reachable from the internet lets strangers log in and watch the feed.

4. A router has remote administration switched on, but the owner never uses it. What should they do?

A. Turn it off, because an unneeded service is extra attack surface ✓

B. Leave it on, because extra services make the router more secure

Services you do not need give attackers more ways in. Switch them off to reduce the attack surface.

5. When is the best time to change a device's default password?

A. During set-up, before the device is used on the network ✓

B. Only after something suspicious happens

Changing defaults at set-up closes the door before an attacker has a chance to use it.

Match the Pairs

username: admin, password: admin → A factory default login that many routers ship with and attackers try first

telnet: enabled (not used) → An unneeded service left on, which gives attackers an extra way in

At set-up, replace the factory password with a strong new one before connecting the device → router.set_password("Blue-Kettle-Rain-42")

Turn off a service you do not use so it cannot be attacked → router.remote_admin = False

router.password = "admin" # keep the factory login → The factory default password was kept, so anyone who knows or guesses it can log in and take over the router.

remote_admin = True # not needed, leave it on → A service that is not needed was left switched on, giving attackers an extra way in from the internet.

Key Term

default credentials

The factory username and password a device or app ships with. If they are never changed, anyone who knows or guesses them can log in and take control.

Fill in the Blanks

1. password = "admin" if password == "admin": print("Default still in use!")

Hint: Type the operator that checks whether two values are equal.

2. router = "admin" router = input("New password: ")

Hint: Type the built-in function that asks the user to type in a new value at set-up.

3. services = ["web", "ftp", "telnet"] services.remove("telnet") print(services)

Hint: Type the list method that takes an unneeded service out of the list.

4. defaults = ["admin", "1234", "password"] if pw in defaults: print("Change this password!")

Hint: Type the keyword that checks whether a value is found inside a list.

5. remote = True factory = True if remote and factory: print("Risk")

Hint: Type the logical operator that is only true when both conditions are true.

Spot the Error

Question 1

A r = new_router()

B new_pw = input('New: ')

C if r.password == 'admin':

D r.set_password('admin')

Line D — The code sets the router password back to the factory default 'admin'. It should set the new password the user typed, new_pw, so the default can no longer be used to log in.

Question 2

A services = ['web', 'telnet']

B needed = services

C for s in services:

D if s not in needed:

E disable(s)

Line B — Setting needed to the whole services list means every service counts as needed, so nothing is ever disabled. It should list only the services that are really needed, needed = ['web'], so unneeded services like telnet get turned off.

Question 3

A defaults = ['admin', '1234']

B if password not in defaults:

C print('Change it!')

D else:

E print('OK')

Line B — The condition is back to front. The warning should show when the password IS in the list of defaults, so it should be: if password in defaults:

Question 4

A def setup(dev):

B dev.user = new_user

C dev.password = 'password'

D dev.remote_admin = False

Line C — 'password' is one of the first passwords an attacker would guess. Set-up should use the strong password the owner chose, so the line should be dev.password = new_pw.

Question 5

A devices = [cam, printer]

B for d in devices:

C if d.password == 'admin':

D d.password = 'admin'

Line D — The code finds a device still using the default password, then sets it to the default again. It should assign the new password: d.password = new_pw.

Student with a class code? Join your class →