The Little Things Count

TIM BANDOS, VICE PRESIDENT OF CYBERSECURITY, DIGITAL GUARDIAN, DISCUSSES HOW CONFIGURATION MISTAKES COULD PROVIDE FIELD DAYS FOR HACKERS.

Sometimes it’s the little things. In hindsight, more often than not, getting hacked can stem from a minor misstep or completely preventable mistake. Common security mistakes and overlooked misconfigurations can open the door for malware or attackers, potentially leaving your environment and any exposed data ripe for the picking. Avoid these top five configuration gaffes to reduce the threat exposure to your organisation.

Default credentials

It almost seems too obvious to include here but leaving default usernames and passwords unconfigured for databases, installations, and devices, by far, is one of the most common and easy items for a hacker to exploit. Leaving default credentials on network devices such as firewalls, routers, or even operating systems, allows adversaries to simply use password checking scanners to walk right in. In more skilled setups, hackers can simply stage a series of scripted attacks geared at brute forcing devices by focusing on either default usernames and passwords, or basic passwords like “qwerty” or “12345.”

A few months ago, researchers uncovered a Python-based web scanner, Xwo, that can easily scan the web for exposed web services and default passwords. After collecting default MySQL, MongoDB, Postgre SQL, and Tomcat credentials, the scanner forwards the results back to a command and control server.

Leaving default credentials on any device is akin to leaving your keys in a locked door. Even a 12-year-old with some internet access at home could majorly breach a corporation just by using one of these freely available tools on the internet to check for default credentials.

Password reuse