dolphins
Miami Dolphins
Premium
join:2001-08-22
Westville, NJ
 ·Comcast
1 edit | Windows Explorer bypasses router password
Posted this in Linksys forum »[Security] Windows Explorer bypasses password
Edit:XP SP2
BEFSR41 V3 Firmware Version: 1.05.00
But I feel this forum to be more appropriate.
I noticed lately when I type 192.168.1.1 in Windows Explorer it takes me to my router settings page but if I use Internet Explorer it prompts me for password. I don't think it was like that on my 98SE box?
I can change all settings including password even after clearing cache and running CCleaner. I don't use AutoComplete so passwords,urls,etc are not stored on this machine.
How can I disable this from happening?
I am unable to do this on an XP Home laptop that is connected to this router?
--
Prevent Malware |
|
Cudni
La Merma - Vigilado
Premium,MVM
join:2003-12-20
Someshire | Maybe this?
»support.microsoft.com/kb/306541
Cudni |
|
sivran
Long Live The Suite
Premium
join:2003-09-15
Arlington, TX
clubs:
·RoadRunner Cable
| reply to dolphins
I am unable to duplicate this. Attempting to access mine through windows explorer results in a password prompt. 2000 Server SP4 with a BEFSR41v2.
--
Think outside the fox...Seamonkey |
|
jack b
Gone Fishing
Premium,MVM
join:2000-09-08
Cape Cod
clubs:
·Comcast
1 edit | reply to dolphins
I can confirm this, it is happening here, too.
In fact, if I open IE(6) and paste in 192.168.0.1 (d-link) the password dialog box pops up pre-filled in, and selecting OK brings me to the web admin application.
I know I NEVER selected SAVE for this logon page.
And from an explorer window, if I paste in the address, it just goes directly right to the first page in the router menu, no userID and password prompt at all!
A feature?
edit: here on XPpro
--
~Help find a cure for Cancer~
~Proud Member of Team Discovery ~ |
|
altermatt
Premium
join:2004-01-22
White Plains, NY
 ·Verizon Online DSL
| reply to dolphins
SMC Barricade, typing my router addy, 192.168.2.1, in Windows Explorer (XP) still gives me a password prompt, just as it does in IE. (Note: for me, 192.168.1.1. is my DSL modem, not my router).
--
The truth of a thing is the feel of it, not the think of it. -- Stanley Kubrick |
|
dolphins
Miami Dolphins
Premium
join:2001-08-22
Westville, NJ
·Comcast
| reply to Cudni
No passwords saved on this machine. |
--
Prevent Malware |
|
dolphins
Miami Dolphins
Premium
join:2001-08-22
Westville, NJ
·Comcast
| reply to jack b
said by jack b  :I can confirm this, it is happening here, too. In fact, if I open IE(6) and paste in 192.168.0.1 (d-link) the password dialog box pops up pre-filled in, and selecting OK brings me to the web admin application. I know I NEVER selected SAVE for this logon page. And from an explorer window, if I paste in the address, it just goes directly right to the first page in the router menu, no userID and password prompt at all! A feature? This is not good! We need to disable this feature. It must be XP SP2(me) and XP Pro(you) because I can't duplicate it on older machines
--
Prevent Malware |
|
FunnyBones
Premium
join:2004-01-22
usa
 ·Vonage
| reply to dolphins
Turn off auto complete |
|
niccolus
Niccolus Leader Of Midgets
Premium
join:2003-10-22
Long Beach, CA
| reply to dolphins
Question: You guys that are experiencing it. Do you have multiple accounts on your PC's or has your PC been used by anyone who may have needed access to the router because another account could have saved the password and since it is not associated with their specific profile it could actually just be filling in. |
|
hurfy
Premium
join:2002-08-06
Spokane, WA
| Couldn't do it on xp pro and a sonicwall. Maybe it is d-link?
Put in password closed explorer and tried again. Got the same login screen. Never asked about saving it nor did it.
Does one or the other method append a slash or something that d-link interpets diferently perhaps?
Autocomplete for the address in explorer now recognizes 3 posibilities (after typing in just 10.0.0.254):
h ttp://10.0.0.254
h ttp://10.0.0.254/main.html
h ttp://10.0.0.254/maintain.html
(done on computer that has never had a url typed in explorer nor ever gone to our sonicwall)
Oh well i tried 
xp pro sp2 but without most current patches i think. |
|
Kayrac
Premium
join:2001-09-29
Rochester, NH
1 edit | reply to dolphins
Nm after testing, it doesn't work on my linksys wrtg54gs |
|
dolphins
Miami Dolphins
Premium
join:2001-08-22
Westville, NJ
1 edit | Works? Meaning you can reproduce this flaw? withdrawn |
|
planet
join:2001-11-05
Olmsted Falls, OH
·Cox HSI
| Running XP HE SP2 with
BEFSR41 V3 Firmware Version: 1.05.00
When I try and access via Windows Explorer it won't load the page.
I remember that I had to place it in my trusted zone for IE to work with it. Wondering if that has anything to do with it. |
|
norwegian
Premium
join:2005-02-15
Outback
·WestNet Broadband
| reply to dolphins
Password prompt when I do this. Cannot reproduce your issue Dolphins.
Auto complete is off here.
XP SP2 Pro
Befsx41 ver 2, firmware 1.50.18
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke |
|
Greg_Z
Premium
join:2001-08-08
Springfield, IL
·Comcast
| reply to dolphins
Dolphins, it is most likely that one machine. Either caching the page, and not clearing, or something is fubared in your install. I have my IE7 and have always with IE6 to clear Temp. Internet files, also do not have AutoComplete turned on.
Also, another thing is, I have registry changes in place to clear certain settings for security purposes.
--
I threw out the map a long time ago. Now I follow my own direction! |
|
Greg_Z
Premium
join:2001-08-08
Springfield, IL
·Comcast
| reply to dolphins
When you attempt to view a password-protected site, you are normally prompted to type your username and password with an option to "Save this password in your password list". This tweak can be used to disable the ability for users to save passwords.
Settings:
User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Internet Settings]
Name: DisablePasswordCaching
Type: REG_DWORD (DWORD Value)
Value: (0 = default, 1 = disable password cache)
This setting controls whether web pages encrypted using Secure Sockets Layer (SSL) should be stored on the hard disk in the temporary Internet cache.
Settings:
User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Internet Settings]
Name: DisableCachingOfSSLPages
Type: REG_DWORD (DWORD Value)
Value: (0 = default, 1 = disabled caching)
--
I threw out the map a long time ago. Now I follow my own direction! |
|
dolphins
Miami Dolphins
Premium
join:2001-08-22
Westville, NJ
·Comcast
| reply to planet
said by planet :Running XP HE SP2 with BEFSR41 V3 Firmware Version: 1.05.00 When I try and access via Windows Explorer it won't load the page. I remember that I had to place it in my trusted zone for IE to work with it. Wondering if that has anything to do with it. You talking about 2 different things, LAN and WAN with LAN being Windows Explorer and WAN being Internet Explorer.
--
Prevent Malware |
|
dolphins
Miami Dolphins
Premium
join:2001-08-22
Westville, NJ
·Comcast
| OK, planet and Greg_Z got me on the right track. I noticed Windows Explorer was given full internet access in McAfee Firewall applications so I blocked it and now I am unable to access the router from WE. But still I shouldn't have to do this, Right? I will look into your reghack when I get back Greg_Z.
I'm late for a proposal with some homeowners.
--
Prevent Malware |
|
Cudni
La Merma - Vigilado
Premium,MVM
join:2003-12-20
Someshire | No, you are right, you should not be able to access router without being challenged, no matter what with.
Cudni |
|
dolphins
Miami Dolphins
Premium
join:2001-08-22
Westville, NJ
·Comcast
1 edit | reply to Greg_Z
Doesn't this reghack essentially do what MKB article that Cudni posted does? And if you read my follow up to Cudni's post you'll see that no passwords have been stored on my machine. Also my original post shows that AutoComplete is not enabled and never will be.
Damn, this is really buggin' me! I know this is something that happened recently cause I've never been able to access my router from WE with being prompted for password.
--
Prevent Malware |
|
