Today, the U.S. Cybersecurity and Infrastructure Security Agency urged technology manufacturers to stop providing software and devices with default passwords.
Once discovered, threat actors can use such default credentials a backdoor to breach vulnerable devices exposed online.
Default passwords are commonly used to streamline the manufacturing process or help system administrators deploy large numbers of devices within an enterprise environment more easily.
The failure to change these default settings creates a security weakness that attackers can exploit to circumvent authentication measures, potentially compromising the security of their organization's entire network.
The U.S. cybersecurity agency advised manufacturers to provide customers with unique setup passwords tailored to each product instance as an alternative to using a singular default password across all product lines and versions.
They can implement time-limited setup passwords designed to deactivate once the setup phase concludes and prompt admins to activate more secure authentication methods, such as phishing-resistant Multi-Factor Authentication.
Another possibility involves mandating physical access for the initial setup and specifying distinct credentials for each instance.
Ten years ago, CISA issued another advisory notice highlighting the security vulnerabilities associated with default passwords.
The advisory specifically underscored the heightened risk factors to critical infrastructure and embedded systems.
Iranian hackers recently employed this approach, using a '1111' default password for Unitronics programmable logic controllers exposed online to breach U.S,.
Critical infrastructure systems, including a U.S. water facility.
Hackers breach US govt agencies using Adobe ColdFusion exploit.
CISA warns of actively exploited Windows, Sophos, and Oracle bugs.
FBI and CISA warn of opportunistic Rhysida ransomware attacks.
CISA warns of actively exploited Juniper pre-auth RCE exploit chain.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 15 Dec 2023 19:05:07 +0000