UK becomes first country to outlaw easily guessable default passwords on connected devices

[midian182]

Why it matters: No matter how many hacks we see that are perpetrated via unchanged, weak default passwords on devices, manufacturers continue to use the likes of "password" and "admin" for login credentials. That's no longer going to be the case in the UK, which has become the first country in the world to ban makers from using easily guessable default credentials on connected devices.

An update to the UK's Product Security and Telecommunications Infrastructure Act (PSTI) states that every device with online connectivity must either ship with a randomized password or generate a password upon initialization.

According to the requirements, pre-installed passwords cannot be incremental (password1, password2) and cannot be related in an obvious way to public information such as MAC addresses or Wi-Fi SSIDs.

When companies use "admin" and "admin"

There are also rules to ensure devices are protected against brute-force attacks, including a limitation on the number of authentication attempts within a certain time. Changing passwords, meanwhile should be performed using a "simple mechanism."

Software that hasn't been updated is another common way hackers compromise systems and devices. The PSTI states that software components should be securely updateable, check for updates, and update either automatically or in a way that is simple for users to apply. There's also a section on implementing means to manage reports of vulnerabilities, which instructs manufacturers to continually monitor for, identify, and rectify security vulnerabilities within products and services they sell.

These aren't just recommendations that manufacturers can ignore if they wish. Violating the law can result in a fine up to £10 million (around $12.5 million) or 4% of a company's, "qualifying worldwide revenue," depending on which is higher.

The updated rules are designed to mitigate against incidents like the Mirai botnet in 2016 that caused huge outages across the internet, including Twitter, Netflix, and Reddit. The botnet consisted of hundreds of thousands of infected devices that were designed to flood websites with junk traffic. It resulted in one of the largest distributed denial-of-service (DDoS) attacks ever recorded.

In July last year, the Biden administration announced the Cyber Trust Mark program, designed to help Americans identify which connected devices meet government cybersecurity requirements, including having strong default passwords. Unlike in the UK, though, companies' participation is voluntary, and the fine details of the bill are still being debated before it is implemented.

Permalink to story:

UK becomes first country to outlaw easily guessable default passwords on connected devices

 

[Uncle Al]

Clearly headed the wrong direction. They need to come up with stiffer laws that deal with hackers and work with their neighbor countries to enforce it and lastly but most importantly, work toward building a more easily secure-able internet that can identify, lock out, destroy hacker capabilities. After all these decades there is simply no reason that a secure web does not exist. Start by penalizing all the big tech companies for not securing their sites and programs.

 

[yRaz]

Clearly headed the wrong direction. They need to come up with stiffer laws that deal with hackers and work with their neighbor countries to enforce it and lastly but most importantly, work toward building a more easily secure-able internet that can identify, lock out, destroy hacker capabilities. After all these decades there is simply no reason that a secure web does not exist. Start by penalizing all the big tech companies for not securing their sites and programs.

Stiffer laws have never been a deterant but we still need them to remove people from society, ie jail, for set periods of time.

 

[ScottSoapbox]

The default password has to be public knowledge so that one can set up the device (new or after a factory reset). So changing what that default is accomplishes nothing.

 

[The Talking Tech]

In many cases the "easy passwords" are the most secure.

 

[wiyosaya]

The default password has to be public knowledge so that one can set up the device (new or after a factory reset). So changing what that default is accomplishes nothing.

I disagree. Manufacturers can set a unique default password on each device they manufacture and simply put a print-out of the password in the box. It will cost manufacturers more to do so, but problem solved.

Clearly headed the wrong direction. They need to come up with stiffer laws that deal with hackers and work with their neighbor countries to enforce it and lastly but most importantly, work toward building a more easily secure-able internet that can identify, lock out, destroy hacker capabilities. After all these decades there is simply no reason that a secure web does not exist. Start by penalizing all the big tech companies for not securing their sites and programs.

I also disagree that this is the wrong direction. IoT, and other, device manufactures don't give a flying F about device security. They are only interested in how much profit they can make by selling as many devices as they can to as many people as they can.

As I mentioned above, manufacturers can set a unique default password on each device they sell and include it on a printout in the box. Yes, it will cost them more to do so, but it will be much more secure than having a default password for all as they currently do.

Making stronger laws against hackers will do nothing to stem the tide of security breaches. Hackers are far more difficult to track and prosecute; therefore, IMO, the only way to solve this is to place the security burden on the manufacturers of such devices as this is, by far, more enforceable, IMO.

 

[daffy duck]

Sotware should automatically reject stupidly simple passwords. It must be at least 8 characters 12 preferqbly, have numerical, uppercase and special symbols IMO. Yet I have banking website that will not allow strong passwords and is only 6 characters in length. Fcuking madness.

 

[Aaron Jones]

The default password has to be public knowledge so that one can set up the device

No, it doesn't. It could just as well be burned into the system's storage (same as the firmware is) and put on a sticker on the device, exactly the same procedure they already use for serial numbers. Someone setting up the device will be able to look at the sticker and see what the default password is.

 

[ScottSoapbox]

No, it doesn't. It could just as well be burned into the system's storage (same as the firmware is) and put on a sticker on the device, exactly the same procedure they already use for serial numbers. Someone setting up the device will be able to look at the sticker and see what the default password is.

You obviously have never worked tech support if you think the people won't fail to locate the sticker and/or lose it. Then the product is a brick, and the customer is both mad and returning it. Resulting in damaged company reputation, lost sales, and higher support costs.