You bought a new router.
Or a security camera. A printer. A NAS. A smart TV. A Raspberry Pi project somebody handed you. Maybe you picked up a used piece of network gear from eBay, inherited equipment from another employee, or found a perfectly good device sitting in the back of a closet.
You plug it in.
It asks for a username and password.
You type:
admin / admin
And it works.
That should not make you happy.
That should make a tiny alarm bell go off in your head.
Because if you know the password, there is a pretty good chance everyone else does too.
Default Passwords Aren’t Secrets
Manufacturers need some way for you to log into a new device the first time. Traditionally, that has meant shipping thousands or millions of devices with the same credentials.
Admin / admin.
Admin / password.
Root / root.
Or some other combination printed in a manual that is conveniently available to anyone with Google.
Those credentials were never intended to protect the device forever. They are there to get you through the front door so you can configure the thing.
Think of a default password as the key taped to the front door by the installer.
Useful during setup.
A terrible long-term security plan.
Attackers Know the Defaults Too
Cybercriminals do not need to sit around guessing passwords one character at a time.
They already have enormous lists of default usernames and passwords for routers, cameras, DVRs, switches, firewalls, industrial equipment, printers, storage devices, and just about anything else that has ever sprouted an Ethernet port.
Automated tools can scan thousands of devices looking for something that responds.
Find device.
Identify manufacturer.
Try known credentials.
Log in.
Next victim.
There may not even be a human involved until long after the device has been compromised.
That bargain-bin security camera you forgot was connected to the network can suddenly become a foothold inside it.
“But It’s Behind My Firewall”
Good.
Keep the firewall.
But don’t use it as an excuse to leave weak credentials behind it.
Devices become exposed in all sorts of ways.
Someone enables remote administration.
A port gets forwarded.
UPnP opens something you weren’t expecting.
A cloud service gets compromised.
Malware lands on another computer inside the network.
A laptop joins your Wi-Fi while infected.
Someone plugs into the network who shouldn’t.
Your defensive strategy should never depend on an attacker being courteous enough to remain outside the castle walls.
Once something hostile gets onto the internal network, devices protected by default passwords can become easy targets.
Used Equipment Deserves Even More Suspicion
If you acquire used equipment, the rules get stricter.
Do not assume the previous owner wiped it correctly.
Do not assume the password they gave you is the only account on the device.
Do not assume the configuration is safe.
Do not assume anything.
Factory reset it.
Update the firmware.
Change the administrative credentials.
Review the user accounts.
Review remote-access settings.
Then configure it for your environment.
Used network equipment should be treated a little like a mysterious USB drive found in a parking lot.
Interesting?
Certainly.
Trusted?
Not yet.
It’s Not Just Routers
When people hear “default password,” they usually think about Wi-Fi routers.
The problem is much larger.
Take inventory of anything with an administrative interface, including:
- Routers and firewalls
- Wireless access points
- Network switches
- Security cameras and NVRs
- Printers
- NAS and file servers
- Smart-home hubs
- Home automation equipment
- Raspberry Pis and other small computers
- Hypervisors
- UPS management cards
- Remote-management interfaces
- IoT devices
- Media servers
- 3D printers and controllers
- Lab equipment
- Appliances with network connectivity
If you can open a browser and type an IP address to administer it, somebody else may eventually try the same thing.
Change the Username Too, When You Can
Changing the password is the priority.
Changing the default administrative username can provide another useful layer when the device supports it.
If every attacker already knows the administrator account is named admin, you’ve handed them half of the login combination.
A different username does not magically make the device secure, but security works best when we stop giving away free information.
And Please Don’t Change It to “Password1”
The goal is not merely to change the password.
The goal is to replace it with a strong, unique password.
Unique matters.
Your router password should not also be your NAS password, email password, Amazon password, and the password protecting the account containing seventeen years of family photographs.
One compromised system should not provide the keys to the rest of your digital kingdom.
Use a password manager.
Generate long, random passwords.
Store them there.
You do not need to memorize a forty-character router password. Your router isn’t going to quiz you at Thanksgiving dinner.
Where multifactor authentication is available for administrative access, enable that too.
Don’t Forget the Other Accounts
Some devices contain more than one account.
After changing the primary administrator password, look around.
Are there guest accounts?
Service accounts?
Old employee accounts?
Installer accounts?
Cloud-management accounts?
Accounts belonging to whoever owned the device before you?
Disable or remove anything you don’t need.
An abandoned administrator account with an old password is still an unlocked hatch, even if you replaced the lock on the main door.
Make Password Changes Part of Setup
The easiest way to solve this problem is to turn it into habit.
Whenever a new device joins your network, your basic setup process should include:
- Factory reset the device if its history is unknown.
- Install current firmware.
- Change all default administrative passwords.
- Use unique credentials.
- Enable MFA where available.
- Remove or disable unnecessary accounts.
- Disable remote administration unless you actually need it.
- Record the device and its credentials in the appropriate secure password manager or documentation.
Do it before you become distracted by everything else the shiny new gadget can do.
Because “I’ll change that later” has an unfortunate habit of becoming “Why is this camera sending traffic to another continent?”
The Bottom Line
Default passwords exist for installation convenience.
They are not security.
Leaving one in place is effectively betting that nobody will ever discover the device, recognize it, know its factory credentials, compromise something else on your network, or find another path to its management interface.
That’s a lot of faith to put into admin / admin.
So when you buy, inherit, rescue, repurpose, or otherwise acquire a device:
Plug it in.
Update it.
Change the password.
Then go play with your new toy.
A few minutes spent changing credentials today can prevent a considerably uglier adventure later.
And there are far better ways to spend an evening than discovering some stranger on the Internet has been captain of your router for the last six months.
Fair winds, strong passwords, and keep your digital powder dry.
Griz
