Testing for unchanged passwords in IoT devices
An agent running on an IoT device of a client's network may receive a default password from a provider network and use the received default password to determine whether the password assigned to the IoT device has been changed from the default password to a different one. The agent may retrieve a salt string, a hashing algorithm, and a hashed string from a password database of the IoT device, combine the salt string with the received default password to generate a salted default password, and apply the hashing algorithm to the salted default password to generate a new hashed string. The agent may then compare the new hashed string to the hashed string retrieved from the password database. If they match, then the agent sends an indication to the provider network that the default password is still assigned to the IoT device.
1. An edge device of a local network, the edge device comprising:
a password database;
one or more processors; and
one or more memories, wherein the one or more memories have stored thereon instructions, which when executed by the one or more processors, cause the one or more processors to implement an agent to:
retrieve security data from the password database of the edge device of a client of the provider network, wherein the security data indicates a hashing algorithm, a salt string, and a first hashed string generated from a password associated with the edge device;
identify the hashing algorithm, the salt string, and the first hashed string based on the obtained security data;
establish a connection with a remote provider network in accordance with a secure communication protocol;
receive, from the provider network via the connection, a default password assigned to the edge device, wherein the default password is stored at the remote provider network and associated with the edge device based on previous reception of the default password from the client by an interface of the remote provider network;
combine, by the agent of the edge device of the local network, the salt string with the default password previously assigned to the edge device and that was received by the edge device via the connection from the remote provider network to generate a salted default password;
apply the hashing algorithm to the salted default password to generate a second hashed string;
determine whether the first hashed string generated from the password that is currently assigned to the edge device matches the second hashed string generated from the default password received from the provider network, wherein the default password is stored at the remote provider network and associated with the edge device based on the previous reception of the default password from the client by the interface of the remote provider network; and
in response to the determination by the agent of the edge device of the local network of whether the first hashed string generated from the password that is currently assigned to the edge device matches the second hashed string generated from the default password received from the provider network, wherein the default password is stored at the remote provider network and associated with the edge device based on the previous reception of the default password from the client by the interface of the remote provider network, send by the agent of the edge device of the local network to the provider network an indication of whether the default password is currently assigned to the edge device for password-based access.
2. The edge device as recited in claim 1 , wherein the determination of whether the first hashed string matches the second hashed string is a determination that the first hashed string does not match the second hashed string, and wherein the indication is that the default password is not currently assigned to the edge device for password-based access.
3. The edge device as recited in claim 1 , wherein the instructions cause the one or more processors to implement the agent to subscribe to a topic according to a publish-subscribe network protocol, and wherein to receive, from the provider network via the connection, the default password associated with the edge device, the instructions cause the one or more processors to implement the agent to:
receive, from the provider network, a message that was published to the topic, wherein the message comprises the default password.
4. The edge device as recited in claim 1 , wherein the retrieval of the security data by the agent from the password database is based on permission granted to the agent to access the password database.
5. The edge device as recited in claim 1 , wherein the edge device is inaccessible from outside of the local network via a public internet protocol address.
6. A method, comprising:
performing, by an agent of an edge device of a local network:
establishing a connection with a remote provider network in accordance with a secure communication protocol;
receiving, from the provider network via the connection, a default password assigned to the edge device of a client of the provider network, wherein the default password is stored at the remote provider network and associated with the edge device based on previous reception of the default password from the client by an interface of the remote provider network;
combining, by the agent of the edge device of the local network, a salt string with the default password previously assigned to the edge device and that was received by the edge device via the connection from the remote provider network to generate a salted default password;
applying a hashing algorithm to the salted default password to generate a first hashed string;
determining whether a second hashed string at the edge device generated from a password that is currently assigned to the edge device matches the first hashed string generated from the default password received from the provider network, wherein the default password is stored at the remote provider network and associated with the edge device based on the previous reception of the default password from the client by the interface of the remote provider network; and
in response to determining whether the second hashed string at the edge device generated from the password that is currently assigned to the edge device matches the first hashed string generated from the default password received from the provider network, wherein the default password is stored at the remote provider network and associated with the edge device based on the previous reception of the default password from the client by the interface of the remote provider network:
sending by the agent of the edge device of the local network to the provider network an indication that the default password is currently assigned to the edge device for password-based access, or
sending by the agent of the edge device of the local network to the provider network an indication that the default password is not currently assigned to the edge device for password-based access.
7. The method as recited in claim 6 , further comprising:
retrieving security data from a password database accessible to the edge device, wherein the security data indicates the hashing algorithm, the salt string, and the second hashed string;
parsing the security data to identify the hashing algorithm, the salt string, and the second hashed string.
8. The method as recited in claim 7 , wherein retrieving security data from a password database comprises:
determining, by the edge device, that the agent is granted permission to access the password database; and
in response to determining the agent is granted permission to access the password database, providing access of the password database to the agent.
9. The method as recited in claim 8 , the method further comprising performing, by the edge device:
generating the salt string based on an algorithm.
10. The method as recited in claim 6 , wherein combining the salt string with the default password to generate the salted default password comprises:
prepending the salt string to the default password, or
appending the salt string to the default password.
11. The method as recited in claim 6 , wherein the edge device is connected to the local network, and wherein the edge device is inaccessible from outside of the local network via a public internet protocol address.
12. The method as recited in claim 6 , further comprising subscribing to a topic according to a publish-subscribe network protocol, and wherein receiving, from the provider network via the connection, the default password comprises:
receiving, from the provider network, a message that was published to the topic, wherein the message comprises the default password.
13. The method as recited in claim 6 , wherein the edge device is associated with the client of the provider network, and wherein the default password is based on a previous submission of the default password to the provider network via a management interface of the client.
14. The method as recited in claim 6 , wherein the agent determines that the second hashed string at the edge device matches the first hashed string, wherein the agent sends to the provider network an indication that the default password is currently assigned to the edge device for password-based access, and further comprising:
subsequent to sending to the provider network an indication that the default password is currently assigned to the edge device for password-based access:
receiving, from the provider network via the connection, the default password associated with the edge device;
combining the salt string with the default password to generate the salted default password;
applying the hashing algorithm to the salted default password to generate the first hashed string;
determining a third hashed string at the edge device does not match the first hashed string; and
in response to determining that the third hashed string at the edge device does not match the first hashed string, sending to the provider network an indication that the default password is not currently assigned to the edge device for password-based access.
15. One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors of an edge device of a local network cause the edge device to:
receive, from a remote provider network via a secure connection, a default password assigned to the edge device of a client of the provider network, wherein the default password is stored at the remote provider network and associated with the edge device based on previous reception of the default password from the client by an interface of the remote provider network;
combine, by an agent of the edge device of the local network, a salt string with the default password previously assigned to the edge device and that was received by the edge device via the connection from the remote provider network to generate a salted default password;
apply a hashing algorithm to the salted default password to generate a first hashed string;
determine that a second hashed string at the edge device generated from a password that is currently assigned to the edge device matches the first hashed string generated from the default password received from the provider network, wherein the default password is stored at the remote provider network and associated with the edge device based on the previous reception of the default password from the client by the interface of the remote provider network; and
in response to the determination that the second hashed string generated from the password that is currently assigned to the edge device matches the first hashed string generated from the default password received from the provider network, wherein the default password is stored at the remote provider network and associated with the edge device based on the previous reception of the default password from the client by the interface of the remote provider network, send by the agent of the edge device of the local network to the provider network an indication that the default password is currently assigned to the edge device for password-based access.
16. The one or more storage media as recited in claim 15 , wherein the program instructions when executed on or across the one or more processors further cause the edge device to, subsequent to the sending to the provider network the indication that the default password is currently assigned to the edge device:
receive, from the remote provider network via a secure connection, the default password associated with the edge device;
combine the salt string with the default password to generate the salted default password;
apply the hashing algorithm to the salted default password to generate the first hashed string;
determine that a third hashed string at the edge device does not match the first hashed string; and
in response to the determination that the third hashed string at the edge device does not match the first hashed string, send to the provider network an indication that the default password is not currently assigned to the edge device for password-based access.
17. The one or more storage media as recited in claim 15 , wherein the edge device is connected to the local network, and wherein the edge device is inaccessible from outside of the local network via a public internet protocol address.
18. The one or more storage media as recited in claim 15 , wherein the program instructions when executed on or across the one or more processors further cause the edge device to subscribe to a topic according to a publish-subscribe network protocol, and wherein to receive, from the remote provider network via the secure connection, the default password associated with the edge device, the instructions when executed on or across the one or more processors further cause the edge device to:
receive, from the provider network, a message that was published to the topic, wherein the message comprises the default password.
19. The one or more storage media as recited in claim 18 , wherein subsequent to passage of at least a predefined threshold amount of time since the sending of the indication that the default password is currently assigned to the edge device without sending of an indication to the provider network that the default password is not currently assigned to the edge device, the edge device is no longer able to receive messages that are published to the topic.
20. The one or more storage media as recited in claim 15 , wherein the program instructions when executed on or across the one or more processors further cause the edge device to access at least one service of the provider network, and
wherein subsequent to passage of at least a predefined threshold amount of time since the sending of the indication that the default password is currently assigned to the edge device without sending of an indication to the provider network that the default password is not currently assigned to the edge device, the edge device is no longer able to access the at least one service of the provider network.