From: DeMoNx [demonx@SLACK.NET]
Sent: Saturday, July 31, 1999 4:58 PM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Cisco 675 password nonsense

(First of all please forgive me if you dis-approve of my use of the word
router. I just think it's a bot more appropriate term than 'modem' for the
hardware being discussed.)

Is your DSL router an open book???

When a certain long distance provider/isp in my area began forcefully
switching all non-business/special adsl accounts over to using PPP rather
than bridging mode for 'security reasons', I got a little suspicious. With
bridging mode enabled on a Cisco 675, one used to be able to hook up
seemingly limitless machines (provided you have the hubs), to one dsl
connection using dhcp. Now with PPP, your dhcp server becomes
10.10.10.0...your 675, which in turn uses dhcp or ipcp to handle
traffic between itself and your isp....blah blah blah etc.

My point is, with all this wonderfully confusing hubub, many people I'm
sure are pulling their hair out trying to fathom the first 5 pages of the
'CBOS Users Guide', trying in vain to set up their dsl to avoid paying $90
to the guys that will end up coming to their house and setting it up for
them. The problem is, *most* of these guys don't set passwords on the
675's. It is very simple to compromise an unpassworded 675. simply hit
'enter' at the password prompt after telnetting in, if you get a cbos>
promt you are half way there, NOT GOOD. If there is no exec mode password
set, then there most likely won't be an enable(superuser) mode password
either. So, at this prompt you simply type 'enable' and hit enter twice.
If you are in enable mode, your prompt will change to the # symbol, and
you have full access to all the router's settings. ISP's are letting this
happen, people are buying this technology without any knowlege that they
may be at this kind of risk. Below is a log of one such Cisco 675. The
ip's and hostnames have been changed to protect the irresponsible *and*
the uninformed.

---


$telnet adslppp93.lame.isp.net Trying 296.161.127.93...
Connected to adslppp93.lame.isp.net.
Escape character is '^]'.

User Access Verification
Password:                  (Just hit enter, whoa! No password!)

cbos>enable                (with just 8 keystrokes full access is given)

Password:

cbos#stats ppp             (Hmm, who's 675 is this?)

VC       VPI/VCI  STATE          MRU    USERNAME  RADIUS   TX       RX
wan0-0   01/01   Opened State    2048   poorsap   disabled 358673   358956

cbos#exit
Connection closed by foreign host.

now, to change these passwords (the easiest way of securing the router)

type 'enable' hit enter to enter administration mode

then type 'set password exec clear NEWPASSWORD exec' to keep em out

and then 'set password enable clear NEWPASSWORD enable' to change the
superuser password.

This is what the person who setup the 675 *SHOULD* have done prior to
leaving the jobsite.

Bill Watts