12.2 Default Passwords and Firmware Updates
Where Default Credentials Come From
Default logins are not forgotten placeholders; they are deliberate build artifacts. Support technicians need in-the-field access, so firmware images embed accounts like admin/admin, root with a stock shadow hash, or secret maintenance users known only to the vendor -- some of which cannot be deleted from the UI at all. Because flashing one image builds a whole product line, the same pairs repeat across every unit and often across a vendor's models for years. Extracting the flash chip over UART, SPI, or JTAG, then dumping strings and the shadow file with binwalk-style tooling, recovers them in minutes.
How the Internet Finds Them
With credentials public, exposure is all that remains. Built-in telnetd and HTTP panels stay enabled by default, and UPnP IGD AddPortMapping calls -- or a silent DMZ setting -- can publish the device's own admin port to the WAN. Internet-wide crawlers then sweep those banners daily and try the known pairs; Mirai's creator literally mined leaked BusyBox source for candidate credentials. Audit accordingly: scan your own LAN for port 23/2323 and WAN-visible 80/8080, change every default, and disable remote administration and UPnP port mapping on the router.
The Secure Firmware Update Path
A healthy OTA chain works like this: the device polls the vendor over TLS, downloads an image plus a manifest, verifies the manifest against a public key burned into read-only memory or eMMC during manufacture, writes the image to a spare A/B partition, and only flips the boot slot after a successful boot -- otherwise it rolls back. Signature verification defeats a compromised update server; A/B swap defeats a half-written flash.
Failure Modes to Check Before You Buy
Devices that check only an MD5 of the download, accept plaintext HTTP updates, allow downgrades to vulnerable versions, or verify signatures in a bootloader that any serial command can unlock reintroduce every risk at the most privileged layer. Check whether the vendor still ships patches for your model before purchase.
Architecture Diagram
Key Takeaways
- Default and hidden maintenance accounts are compiled into firmware, shared across whole product lines, and recovered by dumping flash.
- Change every credential you can, and assume the ones you cannot change will eventually be public knowledge.
- Telnet by default plus UPnP port mapping is the exact combination crawlers and Mirai successors probe.
- A safe update verifies a signature against a burned-in key and installs to a second partition with rollback.
- MD5-only checks, plain HTTP downloads, and downgrade acceptance let an attacker patch the device for themselves.