Default credentials and insecure settings

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A new home router arrives with the login admin / admin printed on its label. What is the safest thing to do at set-up?

A Change the default username and password straight away

B Leave them as they are because the label is only on your router

2. Which statement about default credentials is true?

A They are unique to each device, so they are impossible to guess

B Attackers can look up or guess them because every device of that model shares them

3. Which is an example of an insecure default setting?

A A smart camera with a new strong password set by its owner

B A smart camera that is open to the internet with its factory password

4. A router has remote administration switched on, but the owner never uses it. What should they do?

A Turn it off, because an unneeded service is extra attack surface

B Leave it on, because extra services make the router more secure

5. When is the best time to change a device's default password?

A During set-up, before the device is used on the network

B Only after something suspicious happens

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1username: admin, password: admin		AA service that is not needed was left switched on, giving attackers an extra way in from the internet.
2telnet: enabled (not used)		BA factory default login that many routers ship with and attackers try first
3At set-up, replace the factory password with a strong new one before connecting the device		CThe factory default password was kept, so anyone who knows or guesses it can log in and take over the router.
4Turn off a service you do not use so it cannot be attacked		DAn unneeded service left on, which gives attackers an extra way in
5router.password = "admin" # keep the factory login		Erouter.set_password("Blue-Kettle-Rain-42")
6remote_admin = True # not needed, leave it on		Frouter.remote_admin = False

Definitions

default credentials

Fill in the Blanks

Complete each line of code by filling in the missing parts.

password = "admin" if password __ "admin": print("Default still in use!")

router = "admin" router = _____("New password: ")

services = ["web", "ftp", "telnet"] services.______("telnet") print(services)

defaults = ["admin", "1234", "password"] if pw __ defaults: print("Change this password!")

remote = True factory = True if remote ___ factory: print("Risk")

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A r = new_router()

B new_pw = input('New: ')

C if r.password == 'admin':

D r.set_password('admin')

Question 2

A services = ['web', 'telnet']

B needed = services

C for s in services:

D if s not in needed:

E disable(s)

Question 3

A defaults = ['admin', '1234']

B if password not in defaults:

C print('Change it!')

D else:

E print('OK')

Question 4

A def setup(dev):

B dev.user = new_user

C dev.password = 'password'

D dev.remote_admin = False

Question 5

A devices = [cam, printer]

B for d in devices:

C if d.password == 'admin':

D d.password = 'admin'

Answer Key

Default credentials and insecure settings

Section A: Quick Questions

A — Change the default username and password straight away

B — Attackers can look up or guess them because every device of that model shares them

B — A smart camera that is open to the internet with its factory password

A — Turn it off, because an unneeded service is extra attack surface

A — During set-up, before the device is used on the network

Section B: Match the Pairs

username: admin, password: admin → A factory default login that many routers ship with and attackers try first

telnet: enabled (not used) → An unneeded service left on, which gives attackers an extra way in

At set-up, replace the factory password with a strong new one before connecting the device → router.set_password("Blue-Kettle-Rain-42")

Turn off a service you do not use so it cannot be attacked → router.remote_admin = False

router.password = "admin" # keep the factory login → The factory default password was kept, so anyone who knows or guesses it can log in and take over the router.

remote_admin = True # not needed, leave it on → A service that is not needed was left switched on, giving attackers an extra way in from the internet.

Section C: Definitions

default credentials — The factory username and password a device or app ships with. If they are never changed, anyone who knows or guesses them can log in and take control.

Section D: Fill in the Blanks

password = "admin"
if password == "admin":
    print("Default still in use!")

router = "admin"
router = input("New password: ")

services = ["web", "ftp", "telnet"]
services.remove("telnet")
print(services)

defaults = ["admin", "1234", "password"]
if pw in defaults:
    print("Change this password!")

remote = True
factory = True
if remote and factory: print("Risk")

Section E: Spot the Error

D — The code sets the router password back to the factory default 'admin'. It should set the new password the user typed, new_pw, so the default can no longer be used to log in.

B — Setting needed to the whole services list means every service counts as needed, so nothing is ever disabled. It should list only the services that are really needed, needed = ['web'], so unneeded services like telnet get turned off.

B — The condition is back to front. The warning should show when the password IS in the list of defaults, so it should be: if password in defaults:

C — 'password' is one of the first passwords an attacker would guess. Set-up should use the strong password the owner chose, so the line should be dev.password = new_pw.

D — The code finds a device still using the default password, then sets it to the default again. It should assign the new password: d.password = new_pw.