Default Creds and Unpatched Firmware

A laptop asks you to create a unique account on day one. A cheap camera often does not. The carton includes a slip: username admin, password admin, or a short printed string reused across a product family. The companion app may skip the “change this now” screen, or the screen is a skippable checkbox. From that moment the device is reachable on your LAN — and, if UPnP or a vendor cloud relay was left on, sometimes from farther away — with a secret that is not a secret. Anyone who can reach that login and who already knows the printed pair can become the administrator. You do not need a novel exploit to name that risk. You need to treat the gadget as a computer and retire the printed pair on hardware you own.

Write the legal sentence before you write any device name: original Cyberlium teaching mapped to the CEH v13 IoT and OT hacking domain — not official EC-Council training, not a cert, not exam dumps. A cert acronym in a blog title is not a warrant to test a stranger’s webcam. Default-credential tables published as “IoT hacking kits” are out of this course as spray lists. Naming the failure — unchanged factory login — is literacy. Pointing that failure at a host you do not own is unauthorized access, even if the password was “admin,” even if the camera sat on a guest SSID at a hotel, even if you call it homework. Skill does not create consent. A public IP with a camera banner is still someone else’s computer.

cat >> "$NOTES" << 'EOF'
gadget_is_a_computer: it has a login
sticker: first owner secret — change it on gear I administer
refuse: hydra 192.168.0.1, neighbor cameras
EOF

Three honest reasons owners never change the pair, still without a how-to for attacking them. (1) Convenience — the app already signed in; the QR on the base did the pairing; nobody wants to re-onboard a fidgety bulb hub. (2) Abandoned vendors — the brand vanished, the cloud app 404s, the only login that still works is the one on the sticker, and there is no patch channel. That device is a timed liability: isolate it or retire it; do not “practice” on it from a café. (3) Invisible computers — people do not think of a plug or a printer as a host with a web UI. Topic 4 already taught unique passwords. IoT is where households skip the habit because the object does not look like a PC. The defender sentence is: if it has an Ethernet jack, Wi-Fi, or a cloud app, it has a login, and that login is yours to change only when the object is yours.

Reuse is the second common story. The unique password you finally set is the same as the email that receives the camera’s motion alerts. A stuffed mailbox later becomes a stuffed lens. Store a unique password in a manager you already use. Do not print a new sticker for the fridge. Do not put the new password in a group chat, a gist, or a world-readable notes file. If a relative shares the house, sharing the camera app under a guest profile the vendor provides is different from taping admin/admin to the router. This lesson does not teach you to recover a forgotten camera password by attacking the firmware. If you are locked out of YOUR device, use the vendor’s official reset, then set a unique password immediately — still only on hardware you own.

Walk the room you pay for. For each gadget you can name without guessing a neighbor’s window: open the vendor app or the LAN admin page you already use as the owner, change the factory password to a unique one, check for a firmware update from that same vendor path (not a random forum binary), and turn off remote administration you do not need. “Remote administration” here means a WAN-facing web UI, a vendor toggle labeled “access from anywhere” with no extra factor, or UPnP poking a hole you did not intend. Lesson 3 will isolate cameras onto guest Wi-Fi. This lesson’s verb is change the secret and update the code. If the vendor has no update and no unique-password option, write “no path — isolate or replace” as the treatment, with you as owner and a date — the same ticket shape as Module 5. You will not prove the gadget was dangerous by spraying the old pair at other IPs.

The account that administers the camera should not be your bank password. The Raspberry Pi you use for Cyberlium labs should not be the same host you expose as a toy webcam. If you cannot reach the admin page because you are not on the LAN that owns the device, you are done: that device is not yours. Do not VPN into a workplace IoT VLAN “to finish the homework.” Do not log into a relative’s camera without them standing there and asking. Consent to help set up a doorbell is a conversation, not a CEH lab. Cyberlium’s authorized surface for this lesson is YOUR sticker, YOUR app, YOUR notes file.

Name the refuses so they fit in one breath. NEVER spray default passwords at the internet, a campus, a café, or a /24 you do not administer. NEVER use a search engine of internet-connected devices to find other people’s cameras, baby monitors, or building controllers and then try the sticker. NEVER try the printed pair on a neighbor’s doorbell, a hotel TV stick, a school projector, or a hospital or plant device. NEVER treat “the password was admin” as a defense. NEVER clone a historic IoT worm to “see defaults in the wild.” Historical public reporting that cheap cameras were recruited in bulk is literacy — like a CVE ID. It is not a lab in reproducing the worm, not a GitHub homework, not a reason to nmap 192.168.1.0/24 at a dorm for “practice IoT.” If a blog titled with a cert acronym publishes a default-password spray pack, that blog is not this course.

If you do not own a camera, a plug, or a fancy router, you still complete this lesson. Write that you own no extra gadgets, still define default credentials in your own words, still write the refuse line, still chmod 600. Do not “borrow” a hallway camera because the file felt empty. Empty-of-devices is allowed. Empty-of-ethics is not. Notes go to $HOME/cyberlium-lab/iot-default-creds-notes.txt. The file holds YOUR change/update sentences. It does not hold a classmate’s camera IP, a dump of factory passwords, or a screenshot of a stranger’s lens. World-readable 777 on a shared PC fails even if you never opened a scanner.

On a computer you own, create cyberlium-lab if needed. Walk YOUR room. Change the factory password on devices you administer, or honestly write that a given box is already unique / has no path / is none. Fill the template in your own words. chmod 600. The block writes notes and a tiny checker — there is no scanner, no password list to fire, no extra host, no search-engine query.

cat >> "$NOTES" << 'EOF'
change: unique password ; firmware if vendor still ships ; remote-admin off
refuse: scanning the WAN for default telnet
EOF

A filled notes file with an honest none owned row is complete. A filled notes file that lists a hallway camera you do not administer is not complete — it is an ethics fail even if Python printed PASS. Re-run the checker after you replace parentheticals. Do not gist factory passwords. Do not add a second sitting that “just looks” at a public webcam. Lesson 4 is the inventory lab; it still will not authorize a scan of a plant. You now treat default credentials as the common IoT story and you treat spraying, random device-search, and neighbor lenses as out of this course. This is original Cyberlium teaching mapped to the CEH v13 IoT and OT hacking domain — not official EC-Council training, not a cert, not exam dumps. Next — OT/ICS as Safety, Not a CTF — why you never scan a plant, and why segmentation and vendor patches are the industrial verbs.