What a default password is
A default password is a username and password set by the manufacturer so you can log in the first time. For a router it might be a label on the underside. For a camera or recorder it may be a simple pair such as an administrator name with a very short or blank password. The idea is convenience: setup should be easy even before you have created an account.
The convenience has a cost. If the login is the same for every unit of a model, or follows a pattern, it is effectively public knowledge. Manuals, support pages and online lists make these combinations easy to find.
How attackers use them
Attackers do not usually pick on individual homes. Instead, automated programs scan large ranges of internet addresses looking for devices that respond, then try a list of well-known factory logins against each one. Success costs the attacker almost nothing, and failure costs even less. If your device is reachable and still uses its original credentials, it can be found and taken over without anyone ever having heard of you.
Once inside, an attacker may:
- Watch a camera feed or listen through a microphone.
- Change settings, including the router’s DNS settings, to redirect traffic.
- Install software that adds the device to a botnet, which is a large pool of hijacked devices used for attacks on others.
- Use the device as a stepping stone to reach other equipment on the same network.
- Lock the owner out by changing the password.
Not every compromise is dramatic. Often nothing visible happens at all, and the device just quietly works for someone else.
Why the problem persists
Several things keep default credentials alive.
- People never change them. Setup is finished once the device works, and the login is out of mind.
- Makers favor easy setup. A device that needs no account creation produces fewer support calls.
- Shared credentials across a product line. Even if a login is not obvious, one leak exposes every unit.
- Hidden accounts. Some devices have extra accounts, for support or testing, that the owner cannot see or change. This is a design problem rather than an owner mistake.
- Embedded devices live a long time. A gadget installed years ago may never be revisited.
Better practice by makers is to generate a unique password per device or force the owner to create one during setup. Rules and guidance in several regions now push in that direction, which fits into broader device regulation, but older devices still in use often predate such expectations.
Changing them: a practical routine
- Do it at setup. Change the login before connecting a device to the internet if possible, or as soon as you can after.
- Make it unique. Never reuse the router password on a camera or the email password on anything. If one device is breached, reuse lets the attacker try the same password elsewhere.
- Prefer length over cleverness. A passphrase of several unrelated words is often easier to remember and harder to guess than a short string of symbols. Avoid names, birthdays and keyboard patterns.
- Use a password manager if you have many devices. It can generate and store long random passwords so you never have to remember them.
- Change the username too, if the device lets you. A default name such as “admin” gives an attacker half of the answer.
- Look for more than one login. Some devices have separate passwords for the web page, the app, the Wi-Fi network and a remote-viewing feature. Check each one.
- Secure the cloud account. Where the device is managed through an online account, use a strong password there and turn on multi-factor sign-in if offered.
What if a device does not let you change it
Occasionally a device has a fixed login that cannot be changed. This is a strong reason to think twice about owning it. If it must stay in use, reduce exposure: turn off remote access, keep it off any port forwarded from the router, and place it on a separate network through network segmentation so that compromise does not spread. Replacing it may be the sensible option, especially if it also stopped receiving firmware updates.
Resetting and secondhand devices
A factory reset typically returns a device to its original login, so you need to set a new password afterward. The same applies to secondhand equipment: assume the previous owner’s settings could remain and reset it before use. When you sell or give away a device, reset it and remove it from your account.
Passwords are only one layer
Changing a default password closes the most common door, but it is not a complete defense. Software flaws can still allow access without any password, and a strong password does not help if the device is never updated. It is best treated as a first step, followed by keeping software current, limiting what is reachable from outside and limiting what each device can see on your network. In that order of effort, though, few actions give so much protection for so little work as replacing the factory login.