Returned RMA routers that do not have a cleared NVRAM thoughts

[WQ6N]

I was thinking of a past exploit where the hard drives internal to printers and copiers where harvested for the information. What initiated this thought was the fact that I was getting ready to return a router to be replaced. Seeing literally hundreds or more of boundary devices being turned in with VPN and Wifi credentials still in the NVRAM the presents low hanging fruit for harvesting. Extending the imagination to government (city, county, state, or federal) personnel, businesses, health industry and just about anyone in one of the nations 18 DHS critical sectors.

We know that humans rarely change Wifi or VPN pass phrases. Even fewer use two factor authentication. Anyone of these Wifi routers presents a foothold if one is turned in without removing those credentials. I know that I am personally sensitive to this as a victim of a data breach.

So "they" may have harvested Admin, Wifi and VPN credentials. How many people use those same credentials on their other platforms. "Keys to the Kingdom". I am not sure how secure the hash is, but I have used the Rainbow Tables in the past and they are pretty darn good.

This could be the story for any device in the Internet of Things (IoT).

Was wondering if anyone else had similar concerns....

 

[JoBo]

I recently sold two Asus wireless routers and I reset factory defaults on both so yes I have concerns.

 

[KevTech]

I really doubt this is any issue as manufactures would probably just reset a device to defaults if they were going to check if it is defective so as to make sure any changes the user made are not the cause of the device being messed up.

 

[WQ6N]

If the service is via a Manufacture then possibly. Most likely the work is performed by a sub-vendor. Cyber hygiene is not a bad thing to practice especially if one has a business to protect. I really like the practice of multi-factor authentication myself. Anyway, it is a good discussion. Everything here gets reset to a default state and old hard drives have a date with my 5lb hammer before being tossed.