The default password is generally installed by the manufacturer, most often on hardware devices such as routers and wireless access points, but also by software application developers and even on some operating systems, although this is becoming less and less commonplace. The default password exists to allow an administrator initial access, for setup and configuration, and you are generally forced, or at least you should be, to change the password to something more complicated as the configuration advances. Unfortunately, this is not a step that everyone takes.
Worse again, there have been numerous accounts of software and hardware products that have 'undocumented' administrative accounts installed. So, even if you took the conscientious step of removing or changing what you thought was the default, you may still be exposed. Take Oracle for example. Pete Finnegan, the self-confessed master of all things Oracle, maintains a web page devoted to the Oracle default password. At the last count, there are more than 600 unique accounts in his list. Mr. Finnegan has some interesting views on how many of these accounts come about to be created in the first instance. He says some "are created by Oracle itself when the database is created. For instance the accounts SYS and SYSTEM, DBSNMP and OUTLN are often created by default when a database is created. If the database is created by using the wizard the problem can be much bigger with 10s 0r 20s of accounts being created simply as part of the database creation".
It is also the case that further Oracle default users can be created when third party software is installed for use such as BAAN or SAP. The same issues of default users being added to the database can occur when third party development or maintenance tools are added such as TOAD or PL/SQL Developer. An excellent tool that will scan your Oracle implementation for signs of default accounts can be downloaded here. If your organization uses Oracle, there is a strong chance that you will be susceptible.
It is easy to lay some of the blame on the door of the manufacturer. They could be accused of shipping product with poorly configured security settings. Lets face it; it is not hard for them to force the user to change the initial configuration password. But that alone is not enough. What about the 'undocumented' password, the one that you don't even know about?
Reading our newsletter every Monday will keep you up-to-date with security news.
Receive a daily digest of the latest security news.