Re: [Full-disclosure] FiWin SS28S WiFi VoIP SIP/Skype Phone Hardcoded Telnet user/pass and debug access

2006-09-23 Thread pagvac
Sorry, I meant to say the ATM machine *hack* reported on Wired magazine. Damn it, I need to get used to proofreading what I type before posting! :-) On 9/23/06, pagvac [EMAIL PROTECTED] wrote: On 9/22/06, Paul Schmehl [EMAIL PROTECTED] wrote: --On Thursday, September 21, 2006 17:14:40 -0700

Re: [Full-disclosure] FiWin SS28S WiFi VoIP SIP/Skype Phone Hardcoded Telnet user/pass and debug access

2006-09-23 Thread Shawn Merdinger
Hi, Paul Schmehl wrote: The engineers who designed this should be summarily fired. The terminal stupidity of it is mind boggling! Nick FitzGerald [EMAIL PROTECTED] wrote: I think _beyond_ mind-boggling. Your spirited comments are fun to read, but I personally don't find these types of

[Full-disclosure] FiWin SS28S WiFi VoIP SIP/Skype Phone Hardcoded Telnet user/pass and debug access

2006-09-22 Thread Shawn Merdinger
Zachary McGrew has discovered and reported that the FiWin SS28S WiFi VoIP SIP/Skype Phone with firmware version 01_02_07 has VxWorks Telnet open with a hardcoded user/pass of 1/1. Various debug commonds enable viewing SIP credentials, WEP keys, etc. on the phone. More details here:

Re: [Full-disclosure] FiWin SS28S WiFi VoIP SIP/Skype Phone Hardcoded Telnet user/pass and debug access

2006-09-22 Thread Paul Schmehl
--On Thursday, September 21, 2006 17:14:40 -0700 Shawn Merdinger [EMAIL PROTECTED] wrote: Zachary McGrew has discovered and reported that the FiWin SS28S WiFi VoIP SIP/Skype Phone with firmware version 01_02_07 has VxWorks Telnet open with a hardcoded user/pass of 1/1. Various debug commonds

Re: [Full-disclosure] FiWin SS28S WiFi VoIP SIP/Skype Phone Hardcoded Telnet user/pass and debug access

2006-09-22 Thread Nick FitzGerald
Paul Schmehl wrote: The engineers who designed this should be summarily fired. The terminal stupidity of it is mind boggling! I think _beyond_ mind-boggling. It's mind-boggling that no-one else involved in the development/ testing noticed EITHER that this unintended backdoor existed OR

Re: [Full-disclosure] FiWin SS28S WiFi VoIP SIP/Skype Phone Hardcoded Telnet user/pass and debug access

2006-09-22 Thread pagvac
On 9/22/06, Paul Schmehl [EMAIL PROTECTED] wrote: --On Thursday, September 21, 2006 17:14:40 -0700 Shawn Merdinger[EMAIL PROTECTED] wrote: Zachary McGrew has discovered and reported that the FiWin SS28S WiFi VoIP SIP/Skype Phone with firmware version 01_02_07 has VxWorks Telnet open with a