Does BrightBox Remember your Credentials after Factory Reset

It has been suggested here: http://forums.thinkbroadband.com/freeserve/t/4297744... that the BrightBox remembers the original user's ISP Username and Password even after a Factory Reset, so that it would be unwise to sell it on when no longer needed, e.g. on eBay. Indeed the contention is that the user's ISP Username and Password are 'baked' into the device.

Well, I have carried what I believe are exhaustive tests using 2 BrightBox 1's, one an older Orange-badged BrightBox 1 that I have been using for years and the other a brand-new EE-badged BrightBox 1 that had never connected to the Net from here. Both: Runtime Code Version: v0.09.94.0006-OT (Fri Sep 21 03:00:26 2012).

I carried out numerous Factory Resets, both hard and soft, after setting my credentials in the BrightBox. As long as the BrightBox remains unconnected to the user's BB line, as it would be in someone else's home, then the only credentials you can see are the factory settings of ISP Username = readytoconnect@fs and ISP Password = mistyview. Once it is connected to the BB line, within a few seconds the Remote Configuration (TR-069) by EE, recognising the line, will reinstate the user's credentials. This, I believe, is what's happening to the posters in the other thread finding their credentials returning.

Once the BrightBox has been Factory Reset, the only ways to get the user's credential back is either Restore settings from a saved backup or setting them manually or connecting for a few seconds to an EE BB line and allow Remote Configuration to do its thing. Otherwise the factory settings of readytoconnect@fs / mistyview remain. Should a future buyer of a Factory Reset BrightBox ever connect it to his BB line then either:

• If he is not on EE BB, it will sync but nothing will change and it won't connect cuz the ISP Username can only end in '@fs', or
• If he is on EE BB, it will connect to EE who will Remote Configure the new owner's credentials based on the new owner's phone no.

Logically, the original suggestion of the user's credentials being 'baked' into the BrightBox can only be true if EE were to hard-code them before the BrightBox is dispatched. Then nobody but the original user would be able to use it. But this is refuted by the constant return of readytoconnect@fs / mistyview when Factory Reset.

There were some interesting differences of behaviour between the 2 BrightBoxes when subjected to the http://192.168.1.1/cgi/cgi_wan_eth.js script (ISP user credentials) discovered by ScottHelme :

• On the new router the ISP user credentials were always the readytoconnect@fs / mistyview pair regardless of whether it was factory or user settings.
• On the old router the ISP user credentials were only the readytoconnect@fs / mistyview pair when it was factory reset but,
• On the old router the ISP user credentials were both empty when it was user set, surprisingly.

Also the script also always showed the MTU = 1492 even when I had set it to 1500 as usual.

Mind you this script behaviour may only hold for ADSL not Fibre. Its name implies it is for Ethernet WAN whereas for ADSL you'd want DSL WAN. A Fibre EE user has confirmed that the script does return his true credentials.

Note: The above script does not run under IE; I used FireFox.

The 'readytoconnect' login authenticates an internal session, it's the ACS credentials which are 'baked' and paired to the broadband account settings.

Edited by deleted (Sat 01-Feb-14 06:09:14)

ACS?

In reply to a post by vimto_girl:

the ACS credentials which are 'baked' and paired to the broadband account settings.

So, if they are paired then the next owner of the router, if an EE user, will connect to EE as the original owner? Isn't the phone # checked at all?

Hi Ray,

After some further investigation it would seem that you are correct.

If you disconnect the BrightBox from the modem and *then* perform the factory reset, it will indeed revert to the generic credentials. The config update performed via TR-069 happens so quickly that by the time the web UI is responsive, or I can access the device via the serial port, the credentials have already been retrieved. This is what was giving the impression that they were pre-existing upon device boot.

The only way to safely prepare the BrightBox for sale would be to disconnect all network cables from the device, factory reset and then not connect it to the network again prior to sale so it doesn't update with your credentials.

I'm curious at this point about what EE use to update the devices via TR-069. When supplying me with the firmware patch to update my router for testing, the only information they asked me for was the serial number of the device. Given that I can flash a new serial to the device over the serial port, I hope there's more to it than that.

Scott.

Thanks . And for all your help.

In reply to a post by ScottHelme:

The config update performed via TR-069 happens so quickly that by the time the web UI is responsive, or I can access the device via the serial port, the credentials have already been retrieved. This is what was giving the impression that they were pre-existing upon device boot.

Previously you said:

In reply to a post by ScottHelme:

If I put in a wrong password, then factory reset with the long button hold, the password comes back along with resetting all other settings like WiFi SSIDs etc... My router isn't connected to the web, just my test machine so there is no communication externally.

So the router must in fact have been connected to the web?

Hi Oli,

Yes you are indeed correct. Sometimes it's best not to do these kind of things late at night with a beer and a snakes nest of wires down the back of your desk It seems I was mistaken.

The router must have been getting network connectivity from somewhere or been connected to the modem still. By the time I could access the device, it had already updated and appeared to have retained the credentials, hence my concern. I would edit the post, but I think everyone is now aware that there isn't a problem so it can stay as it is.

Scott.

Still harping on that quote of yours. Why do you say:

In reply to a post by ScottHelme:

factory reset with the long button hold

Shouldn't it just be for 8-10 secs? Doesn't a long hold trigger a firmware flash? Or was that in conjunction with a Power ON?

I was under the impression you just hold for 30 seconds and then the LED lights for the network ports do the 'Knight Rider' thing once you release. When the device boots, it's a clean config (or update via TR-069 if you have connectivity).

Isn't 8-10 seconds just to force a reboot?