Forest Global Training Partners

Cyber Risks · Krebs on Security

The Lingering Mess from Default Insecurity

Summary: Ubiquiti shipped Internet routers with remote administration enabled by default and protected by factory passwords such as ubnt/ubnt or none at all, and SEC Consult found more than 600,000 of these devices exposed online, with concentrations in Brazil (480,000), Thailand (170,000) and the United States (77,000). Imperva had earlier found tens of thousands of hijacked Ubiquiti routers used in ransom-based denial-of-service attacks, and Ubiquiti vice president Matt Harding said the company briefly disabled remote access on new devices but reversed the move after ISP pushback.

Key Takeaway: SEC Consult estimates the real count of vulnerable Ubiquiti routers may be closer to 1.1 million, and each exposed device can be abused by multiple extortion groups at once - Protonmail paid a Bitcoin ransom and was then hit by what appeared to be a second extortion group, while VFEmail refused and lost its hosting provider.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related