FYI: Embedded Devices Leak Authentication Data Via SNMP Community String

SNMP aka S ecurity Not My Problem? :021:



@ SNMP Public Community String Zero Day in Routers Disclosed | Threatpost | The first stop for security news

Quote:

Researchers have discovered previously unreported problems in SNMP on embedded devices where devices such as secondary market home routers and a popular enterprise-grade load balancer are leaking authentication details in plain text. The data could be extracted by gaining access to the read-only public SNMP community string, which enables outside access to device information. While only vulnerabilities in three brands were disclosed today, a Shodan search turns up potentially hundreds of thousands of devices that are exposing SNMP to the Internet that could be equally vulnerable. .... Heiland said similar vulnerabilities in other devices have been disclosed to the vendors in question, and should be made public relatively soon.

Currently there are about >8000 SNMP "revealing-hopefully-mostly-harmless" devices in Singapore @ SHODAN - Computer Search Engine (need register to see it)





& a simple self-test @ odmon.com - SNMP test (set Community: public )

.

via Hardware Forums http://ift.tt/1n3sOpL