I tried to fix my friend's internet and logged into his ISP
One of my close friends was having trouble with his internet, so I was helping him get his Chromecast working. I ended up logged into his ISP's router.
This was back in November 2020. He was with Skywire, a local ISP, and I was looking through his router’s settings for a multicast problem.
His connection turned out to be bridged upstream. I opened the default gateway in a browser and got a Ubiquiti EdgeMAX login page. I knew the manufacturer’s default password, so I tried it.
It let me straight in.
The dashboard said “Welcome ubnt”. There were VLANs for other locations, a management interface, and hundreds of megabits of traffic going through an EdgeRouter X SFP. This was Skywire’s router, serving more connections than my friend’s.
I was meant to be getting his Chromecast working. This seemed like a lot of router for that.
What I saw, with the hostname, location labels and IP addresses redacted. Full-size screenshot.
The email
I didn’t change anything. Knocking out other people’s internet while trying to fix my friend’s Chromecast seemed like the wrong direction, so I took a screenshot and emailed Skywire instead.
The email went out at 22:42 on 24 November 2020. I explained how I’d reached the panel and that I hadn’t touched the settings. I also wrote this, translated from Danish:
I’ve been in IT for a bit, so I know the default password, which is also a Google search away.
I’d been seventeen for sixteen days when I wrote that. And yes, the password is in the quick start guide.
I finished with:
The intention was to help one of your customers. Found a bug.
They fixed it within about ten minutes of receiving the email. They also called me and offered me a beer if I came by their office. Fair play to Skywire, that’s a pretty good response to a teenager turning up in your router.
My friend’s Chromecast got fixed too. It was on a different network from the device trying to cast to it. That was the whole problem.
I’d got into his ISP’s router before I’d managed to get his two devices onto the same network.