Author Topic: Avast Pro states google wifi router has a weak default password  (Read 222 times)

0 Members and 1 Guest are viewing this topic.

Offline Matt Richards

  • Newbie
  • *
  • Posts: 1
Avast Pro states google wifi router has a weak default password
« on: December 06, 2017, 08:58:25 PM »
I use the google wifi device OnHub AC1900.  When I run Avast Pro, it claims that my router has a weak default password of admin/admin.

However, one cannot even access settings via a web browser on that router.  It requires a phone app and a user defined username/pass to configure it.  From a browser the homepage of the router simply gives links to download the phone app.

My guess is that Avast Pro is simply calling it with a POST and passing admin/admin.  Since it returns a page (the one with download links) Avast assumes that it logged in.

I want to make sure I am not wrong though and there isn't something I am missing with this router.  Like whether or not Avast is using a different protocol or hitting a specific page directly.  The google wifi routers leave much in a black box, so I want to be sure there is no glaring security hole I missed.

Offline Chris-G

  • Jr. Member
  • **
  • Posts: 21
Re: Avast Pro states google wifi router has a weak default password
« Reply #1 on: December 07, 2017, 01:25:52 AM »
I believe this to be a bug.  See this post:  https://forum.avast.com/index.php?topic=209402.msg1423925#msg1423925

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36288
  • 57 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: Avast Pro states google wifi router has a weak default password
« Reply #2 on: December 07, 2017, 01:47:49 PM »
Both topics have been reported on the developers channel.
As soon as I get an answer, I'll post it here.
Free avast! Security Seminar: http://www.authorstream.com/Presentation/bob3160-1425909-protecting-yourself/    -  Important: http://www.organdonor.gov/ -- My Blog: http://bob3160.blogspot.com/ - Win 10 Pro v1703 64bit, 8 Gig Ram, AvastFree 17.6.2307, WinPatrol, Unchecky How to Successfully Install Avast http://goo.gl/VLXde

Offline Alikhan

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2053
Re: Avast Pro states google wifi router has a weak default password
« Reply #3 on: December 07, 2017, 02:04:49 PM »
When Wi-Fi inspector finds a weak service password, it doesn't explicitly state which password that is.  It could be the wi-fi password, router password or the FTP server.

Have you checked all three? Many times users don't change FTP server default password.
Windows 10 Home 64-bit • Avast Internet Security (latest stable version) • Malwarebytes 3 Premium (latest) • Cryptoprevent • Google Chrome • CCleaner •

Offline Chris-G

  • Jr. Member
  • **
  • Posts: 21
Re: Avast Pro states google wifi router has a weak default password
« Reply #4 on: December 07, 2017, 02:43:47 PM »
When Wi-Fi inspector finds a weak service password, it doesn't explicitly state which password that is.  It could be the wi-fi password, router password or the FTP server.
Doesn't it!

Offline Alikhan

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2053
Re: Avast Pro states google wifi router has a weak default password
« Reply #5 on: December 07, 2017, 02:56:13 PM »
Where does that tell you that the weak password is the wi-fi password, router password or the FTP server?

HNS-Weak-Pass just states it's a weak password but doesn't state each one explicitly.
« Last Edit: December 07, 2017, 02:57:48 PM by Alikhan »
Windows 10 Home 64-bit • Avast Internet Security (latest stable version) • Malwarebytes 3 Premium (latest) • Cryptoprevent • Google Chrome • CCleaner •

Offline Pondus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33742
Re: Avast Pro states google wifi router has a weak default password
« Reply #6 on: December 07, 2017, 03:13:33 PM »
To me this seems to be the router log in passwords (not WiFi) .... admin/admin



Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36288
  • 57 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: Avast Pro states google wifi router has a weak default password
« Reply #7 on: December 07, 2017, 03:17:18 PM »

To me this seems to be the router log in passwords (not WiFi) .... admin/admin




That's what I also think. :)
http://www.tp-link.com/us/faq-426.html


(Sorry, I quoted the wrong user. )
« Last Edit: December 07, 2017, 05:25:02 PM by bob3160 »
Free avast! Security Seminar: http://www.authorstream.com/Presentation/bob3160-1425909-protecting-yourself/    -  Important: http://www.organdonor.gov/ -- My Blog: http://bob3160.blogspot.com/ - Win 10 Pro v1703 64bit, 8 Gig Ram, AvastFree 17.6.2307, WinPatrol, Unchecky How to Successfully Install Avast http://goo.gl/VLXde

Offline Chris-G

  • Jr. Member
  • **
  • Posts: 21
Re: Avast Pro states google wifi router has a weak default password
« Reply #8 on: December 07, 2017, 04:36:37 PM »
Where does that tell you that the weak password is the wi-fi password, router password or the FTP server?

HNS-Weak-Pass just states it's a weak password but doesn't state each one explicitly.
That's what I also think. :)
http://www.tp-link.com/us/faq-426.html
But the only usernames/passwords that the router has set to admin/admin, as default are the router passwords.  FTP has to be explicitly enabled and has no defaults. Default WiFi SSID's are conglomerates of text and part MAC addresses and the passwords are pseudo-random numeric, and besides, my PC doesn't have WiFi so Avast can't test for that.  So for Avast to report that it has found admin/admin can only mean that it was checking the routers web interface.