Welcome Guest ( Log In | Register )

Bump Topic Topic Closed RSS Feed

Outline · [ Standard ] · Linear+

Unifi WARNING TO ALL UNIFI USERS, Threat warning, read inside

views
     
TSrizvanrp
post Jun 3 2010, 01:55 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(squall0833 @ Jun 3 2010, 01:28 PM)
wah, the star posted this news somemore,

riz, you've done really well biggrin.gif
They said, hacker unlikely can success to hack a user because of don't know the target's IP address,

ok la, Dynamic IP always change IP, but to check a user's current IP isn't hard, even we can do it, but only valid at the time that user still stay connected as the same ip,

How about Unifi for business? static IP address,   once the hacker knows the ip address, business unifi user always risky, as long the remote management still remain opened  hmm.gif
*
Like I said earlier, the Star didn't do their research properly. Dynamic IP.. so what? Just use a port scanner? You're only doing this because you want a free Unifi account/proxy.. doesn't matter who you hit. Dynamic IPs are all allocated in the same IP block for the same service.

This post has been edited by rizvanrp: Jun 3 2010, 01:56 PM
TSrizvanrp
post Jun 3 2010, 03:20 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(rizfield @ Jun 3 2010, 03:13 PM)
just installed unifi today..

how to access the true admin account? can anyone inform me?
already disabled the remote access
*
Guides at http://unifi.athena.my/
TSrizvanrp
post Jun 6 2010, 04:42 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(socratesman @ Jun 6 2010, 03:41 PM)
Not sure what's going on, seems TM put a temporary stop-gap measure in place by blocking connections on port 22(SSH) heading for 110.159.* IPs.

I had someone enable remote SSH on his DIR-615.
Using the default port 22, I wasn't able to connect from my Streamyx to his Unifi. (connection closed at remote end)

Then I asked him to change the SSH port to a random 5-digit number, and voila I managed to login to router using putty.
Like rizvan said, I was able to use his connection as a SOCKS proxy (ssh dynamic forwarding).
*
At least the LYN people who read my posts will be safe by securing their DIR-615 or using their own routers. There's just no way TM can magically give everyone a special unique router password combination now, it has to be done by the user. This is what happens when you don't even set up basic security and try to 'hide' things from the users. I'm pretty certain more stuff is going to happen when Unifi's coverage area expands and people have access to the Fiberhome units.

They should also be blocking port 8080, not just 22 sleep.gif

This post has been edited by rizvanrp: Jun 7 2010, 09:08 AM
TSrizvanrp
post Jun 8 2010, 10:32 AM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(air_mood @ Jun 7 2010, 01:49 PM)
I'm pretty blur with this thing actually. Not pretty blur, very blur as a matter of fact. What's the curse of action that I should do exactly and how so?? I have never ever changed anything since TM installed my Unifi.
*
Check the router security guide @ unifi.athena.my to properly secure your router from outside access

QUOTE(jackbanner @ Jun 7 2010, 01:42 PM)
Thank u rizvan. Very good information.

Can anyone tell me the benefits of adding another modem as stated?
*
Security and better wireless + internet routing performance.
TSrizvanrp
post Jun 12 2010, 12:52 AM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



TM may have started changing the 'admin' and 'operator' account passwords for new installs. Make sure you have both of these passwords.. especially the operator password. The 'admin' account is pretty damn useless.
TSrizvanrp
post Jun 12 2010, 12:10 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(dick1971 @ Jun 12 2010, 12:01 PM)
Guys... i'm still unable to access router  using 192.168.0.1, any other way to do it still noob.........
thanks
*
The DIR-615 by TM uses 192.168.0.1 by default. If it's been changed, run 'ipconfig /all' in the command prompt then check the gateway IP. Load that gateway IP in your web browser.
TSrizvanrp
post Jun 12 2010, 08:18 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



@dick1971

TM may have changed the access port too if the gateway is still 192.168.0.1. Read : http://forum.lowyat.net/index.php?showtopi...post&p=34319716
TSrizvanrp
post Jun 17 2010, 06:08 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



You have to log into the operator account :3

http://unifi.athena.my/index.php?option=co...id=47&Itemid=59
TSrizvanrp
post Jun 17 2010, 06:17 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



go to the login page at 192.168.0.1

username : operator
pass : telekom

or pass : your pppoe pass backwards

or pass : unifi backwards

if these combinations dont work ask your installer for the 'operator' account password
TSrizvanrp
post Jun 17 2010, 06:25 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



Firewall.. I don't know, BT is kinda heavy on home router firewalls. You can enable it if you want but NAT + securing your router should be enough protection.
TSrizvanrp
post Jun 17 2010, 06:30 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(azrinarizz @ Jun 17 2010, 06:28 PM)
Ok then. I will see how my torrent goes and I can change it later. I am wondering, what is NAT?  laugh.gif
*
You have a single public IP (110.159.x.x) which is shared on a private network (192.168.0.0/24). That's wut NAT does.. unless you enable port forwarding, no one will be able to connect to PCs behind your router on the private network directly so in that way it's 'secure' :3
TSrizvanrp
post Jun 27 2010, 05:05 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



@greg

It doesn't even matter if they did do the IP based hardening or set up a 50 character random password.

user posted image

This is a snapshot of the source code of the page which handles the backup/restore configuration section of the routers user interface. The firmware itself is flawed. It pulls the configuration backup file directly from the router without running through PHP (requiring authentication).. so anyone can still break into the router easily just by grabbing the config.bin directly. You don't even have to login with a username or password <_>

Frankly, TM should have not chosen this remote configuration route and been open with it in the first place. Even if I did not guess the password, retrieving it is easy by hooking up a terminal connection directly into the DIR-615's console port and dumping its memory over the network + carving out the user/pass combination. The only way to fix this flaw is to disable the remote management.. and even then, users on your own LAN will still be able to pull of the hack so public Unifi networks (hotspots/hostels) using this DIR-615 G1 router will never be secure.

This post has been edited by rizvanrp: Jun 27 2010, 05:11 PM
TSrizvanrp
post Jul 19 2010, 12:31 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(FastCoder @ Jul 19 2010, 01:12 AM)
I just got my Unifi a few days. My DIR-615 has firmware version 7.05. I have been trying to find the page to disable the Wi-Fi radio because I only use the RJ45 ports.

Do the earlier versions have the disable Wi-Fi option? Or is there such an option in 7.05?
*
user posted image

Untick that to disable the WiFi radio
TSrizvanrp
post Jul 19 2010, 03:42 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(FastCoder @ Jul 19 2010, 03:36 PM)
No SSID means Wi-Fi disabled? That interface is not very intuitive isn't it?

With Bluetooth, you may hide the name, but that doesn't disable the bluetooth radio, and gadgets may still connect to it.

But I guess disabling a name is different from not broadcasting a name, so you may be right. Unless I have one of those keychain Wi-Fi detectors and cover the router with a piece of aluminium foil, there's no easy way to know if the radio is truly off.

Anyway, thanks for the tip.
*
I know right? I couldn't find it myself at first.. another forumer pointed it out to us in the Unifi thread V2 or something. The original firmware for the DIR-615 has on/off radio buttons for 'Wireless Radio', this TM firmware.. well you know lar, lol

You'll notice that when you untick this, the wireless symbol on the DIR-615 which normally glows green turns off completely so I assume its off and not just disabling SSID broadcast or something. For added security, I just turn down the transmit power to its lowest setting + keep the WPA2 key on it.

I don't have a monitor-mode capable wifi card with me so I can't run airodump and ensure that it's not just turning off the SSID but from the looks of it, its totally off after you untick this. Another easier method would be to just telnet/ssh into the router and check the status of the wifi card and everything but I'm too lazy to unbox my DIR-615 at the moment.

Furthermore, this is the default option when you reset the dir-615 and the wifi is completely disabled but with this router.. who knows wink.gif
TSrizvanrp
post Jul 30 2010, 04:37 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(jrkoster @ Jul 30 2010, 04:26 PM)
We received the corporate Unifi package today and were told we had to use their Dlink Wifi router. But we don't want their Wifi or any Wifi in our office. We just want to connect our Smoothwall firewall straight into TM's black Open Bridge (Huawei). Anybody any idea if this can be done?
*
You can wire it directly if your Smoothwall can assign VLAN 500 to the physical WAN port and use that VLAN as the PPPoE WAN interface. Alternatively, you can have a VLAN aware switch in between the smoothwall and huawei to perform the necessary VLAN tagging/untagging or even put the DIR-615 into VLAN bridge mode ( http://unifi.athena.my/index.php?option=co...id=49&Itemid=61 ) to do this for you.

I'm not too sure if the Huawei itself can be setup to bridge a VLAN to the physical LAN port since I don't have that particular unit.

Many Unifibiz users have this issue.. sweat.gif
TSrizvanrp
post Jul 31 2010, 06:31 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(Alpha Wolf @ Jul 31 2010, 06:26 PM)
Hmm... DD-WRT firmware has the options for VLan tagging. According to your webpage, we need to use that DIR-615 router for VLan tagging. But can't we just use a DD-WRT powered router for tagging VLan 500 and VLan 600?
*
I wrote that guide for people who wanted guaranteed IPTV + Internet access. You can use dd-wrt and setup Internet access fine, however getting IPTV to work is a 50/50 thing depending on your router. Not all dd-wrt flashed routers have the same amount of functionality smile.gif
TSrizvanrp
post Oct 2 2010, 06:27 PM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(aftersix @ Oct 2 2010, 06:00 PM)
I've just registered Unifi with TM, the technicians will be coming to setup by later this month, but I'm kinda panic after I ordered Unifi.

I'm a SoHo, having 3 computers, 2 network printers and 2 NAS in my home working environment, there are also a lot of P&C data in my storage, it MUST NOT be accessible by others. I'm quite panic about the Unifi security issue posted everywhere in the internet. I hope someone can give me a helping hand or suggestion on the following issues:

1. Security
Is it safe enough I just disable the the 'Remote Management' and change the password for both 'admin' and 'operator' account? Can this block TM or attackers by 'easily accessing' to my router? If NO, please tell me what else can I do to make myself protected.
2. Custom Router / Switch
i. Currently I'm using a Switch to connect all my office PCs, printers and also NAS, but in Unifi site, I saw the line: "...is only compatible with computers that are wireless enabled...". I then google online and I found The Unifi Handbook - Using Custom Routers, by following the steps provided, we could actually make the TMnet Dlink DIR-615 G1 as a VLAN bridge. If that so, I wonder can I setup my network like this? 'Fiberhome (VDSL) --> Dlink DIR-615 G1 (VLAN bridge) --> My Router --> My Switch --> PCs, network printers, and NAS (with network cables). Is this possible?

ii. Is it encouraged to do a 'custom router' setup? Will this setup slow down the network speed (or slow down when it's using network cable)??
3. IPTV
If the 'Security' and 'Custom Router / Switch' are successfully applied. Will I lost my IPTV service???
*
1. Yea but its better to push your router into vlan bridge mode following the custom router guide as that will completely prevent users from accessing the TM router unless they have physical access to it.

2. The TM router is compatible with both wired and wireless clients. You can use your own router provided it has a RJ45 WAN port. Normally most soho/business clients I know use the TM DIR-615 as a VLAN bridge so they can wire their cisco routers (using the inbuilt PPPoE) directly to Unifi without going through the DIR-615's NAT + firewall which tends to break a lot of things.

ii. It won't slow you down provided the router you use is capable of handling the 5-20mbps speed. Infact, most people do it to increase the performance and stability of their Unifi setup as the TM provided router is pretty bad. If you like this setup, its recommended you buy a VLAN capable switch such as the Mikrotik RB250GS/750/750G or HP Procurve 8 port switch to perform the VLAN tagging for you to replace the DIR-615 (as you're basically 'hacking' it into a VLAN switch when you set it up that way).

3. No, you won't.. as long as you're only doing the VLAN bridging setup (and not reflashing the unit with dd-wrt).


TSrizvanrp
post Oct 3 2010, 11:20 AM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(luminarist @ Oct 3 2010, 11:18 AM)
Please help, the unifi workers jz arrived today and i JUST found out about this issue. They haven't install anything yet but they left their hardware here. I found out that they provided the DIR-615 G2 modem. So, is it still recommendable to proceed with the installation? Or would the new router solve the backdoor problem?
*
Go ahead with your install, there are other ways around this. As for the DIR-615 G2, it seems they've just switched to this new router rev + firmware. I'm trying to get my hands on a unit to play around with.
TSrizvanrp
post Oct 3 2010, 11:28 AM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(luminarist @ Oct 3 2010, 11:26 AM)
Ok thanks a million for ur speedy reply. Anyway, for now i just have to disable the remote access and change the password right?
*
The DIR-615 G2 with firmware 7.05b has some major differences. I've been told there's either no operator account or they've changed the password to something more complex. I'll post an update on the main Unifi thread once I get a unit to test smile.gif
TSrizvanrp
post Oct 23 2010, 12:46 AM

Getting Started
Group Icon
Elite
195 posts

Joined: Sep 2006



QUOTE(iobai @ Oct 23 2010, 12:35 AM)
hi rizvanrp,
thanks for ur strong fruitfull tipss!! got mine yesterday, but speed today is shit!!!
nyway, i'm not sure if i missed out, but i dont know my unifi password. can I retrieve online or by calling tm net? or they hv block it not wanting us to know?

thanks..
*
It's normally written on your install slip. If you want to find out yourself however, just follow this guide : http://unifi.athena.my/index.php?option=co...id=56&Itemid=68

3 Pages < 1 2 3 >Top
Topic ClosedOptions
 

Change to:
| Lo-Fi Version
0.1188sec    0.53    7 queries    GZIP Disabled
Time is now: 3rd December 2025 - 12:13 PM