On March 13, 2017 at 12:27, amirm said...
I explained that. Expanding, after the exploit happened, despite having knowledge of it, they did not notify their US dealers. So all of their installers woke up one day with all the customer machines hijacked and they had to scramble to figure out how to do a hardware password reset.
I get what you're saying, but this is the sort of complaint that makes manufacturers put signs on hair dryers saying "do not use in tub."
Proper response to breaches (of any sort) is almost more important than the security of the device.
This is not money being taken from someone's credit card or bank account. This is installers who KNOW that knowing a username and password opens a device to you, and they KNOW that all of a particular product have a default username and password.
After some idiot kills himself by dropping the hair dryer in the bathtub, is the manufacturer is supposed to go on a campaign saying "don't drop the hairdryer in the tub," or even "when we said don't use the hairdryer in the tub, we meant for sure don't ever drop it in the tub!" ?
BTW the new firmware won't allow you to leave the password as the default so that is sorted out.
This is even better than changing the hair dryer power cord to a two foot long cord, but it's still making the manufacturer share responsibility for the installer not doing what is just plain sensible.
I think it's more important to figure out why an installer would not automatically change the password. Is it that he doesn't want to tie himself to the system, that is, being the only one who might know the password? Is there some other reason that makes sense?
