Hilarious Bad system Management

[NARSBARS]

I just found a Google search term, which I will not give out, that shows several BCMs on the web with public IP addresses. Some are using default passwords. and on all of them you can download applications.
I am going to do a traceroute and try to notify the owners but why would anyone do that?

NARSBARS

 

[DigitelD]

That is like walking around with a "Please kick me" sticker on your back.

SHK Certified (School of Hard Knocks)

 

[biv343]

I've often questioned why anyone would put a BCM on the Internet. At the very least configure an ACL on the router that is in front of it and restrict who can talk to it.

 

[nsantin]

Funny, isn't that the whole point of a BCM - "Business Commincations Manager", an office in a box: Phone, network, router, firewall, VPN.

At least that's how they tried to sell it to me. Of course I would never actually try to do that with it

 

[biv343]

Supposed to be. I've always been leary of putting all my eggs in one basket, especially with some past issues with reliability (i.e, base function tray). Makes maintenance kind of a pain in the rear if something needs to be done to the BCM - instead of just being out of phone service, you're out of darn near everything.

We've had customers approach us saying they wanted the VPN keycode in the BCM, wanted to enable the firewall, NAT, etc. Once we mention that a Contivity 1010 will do that stuff for not much more money than the IPSEC keycode, and do it more reliably, it's an easy sale.

Reminds me of a few years back when I bought a cisco router off ebay for lab work. Cracked the password, found the config, telnetted to the external IP that was on the router, and presto - I was talking to their "new" router with the same password that was on the old one that was sold on ebay. Had I felt malicious, I could have whacked the config, reloaded their router and left someone in a world of hurt. Instead I emailed the domain that belonged to the IP and informed them that they need to review their security practices. Never did hear back.

I'll let my phone system be my phone system, and let my firewall be my firewall - just my opinion.

 

[NARSBARS]

Heard back from one person I warned. They were insulted and P.O.ed at me. I had no place telling them how to run their system. This was the user with the default password.
I am glad I did the notification from a blind account as they were sounding like they wanted to sic a lawyer on me.
Well as they say, no good deed goes unpunished.

NARSBARS