mhoppes wrote:I understand about the access list -- but that doesn't change the fact that I found rouge code on this unit.
Matt at this point we have no idea if this is an exploit or not.
I told you how to clear the scripts (factory default unit -
may need to do power on factory default) and that you should apply an access control list to prevent future hacks, which is the best I can do for now.
What is known:- So far you are the first and only one to report this since the last exploit was patched.
- You have the unit accessible from the web without an access control list which is a big no no in my opinion for WISP's but still we should always try to make sure they are as secure as possible.
Possibilities:- They hacked your password.
- One of your computers that access the switch has malware that gave them the IP and password of your switch.
- Their is another exploit to one of the modules we use such as the web service or SSH.
We have said we will look for any known exploits to the services we use in the firmware and if there is and there is a new patch we will release a new code with the new modules compiled in as soon as possible like last time.
So in the past year I have seen security exploits to UBNT gear and Cisco, it happens. The best a manufacturer can do is patch them when they are discovered and reported. UBNT and Cisco are BILLION dollar companies and it happens to them. As well as banks, Amazon, and so on. Are we supposed to be better and never have exploits? Not to mention at this point we are not sure what happened, or if it is an exploit to a package we did not write but simply use in our firmware build.
What would you like us to do that is differnt than I said we would do?