Last week security group SplashData revealed a list of the worst passwords.
Now, none other than tech giant Lenovo has been caught using one of the worst examples on the list to protect file transfers made with its SHAREit software.
SHAREit is a programme that comes bundled with most Lenovo laptops and
desktop computers, and allows users to transfer files to and from
devices wirelessly.
Related: Best free anti-virus
A security advisory from Core Security identifies the company as using the password ‘12345678’ to protect the WiFi hotspot that is created when using the service.
That’s number three on the list of worst possible passwords, directly after ‘123456’ and ‘password’.
The advisory states: “When the WiFi network is on and connected with the default password (12345678), the files can be browsed but not downloaded by performing an HTTP Request to the WebServer launched by Lenovo SHAREit.
“The files are transfered via HTTP without encryption.
A man in the middle attack involves the attacker secretly relaying and possibly altering communication between two parties who think they are only communicating with one another.
The advisory continues: “When the application is configured to receive files, an open WiFi HotSpot is created without any password. An attacker could connect to that HotSpot and capture the information transferred between those devices.”
Related: Best smartphones and mobile phones
There are several other vulnerabilities identified in the advisory, all of which are certainly cause for concern.
Sean Sullivan, Security Advisor at internet security firm F-Secure Labs, said: “It looks to me as though SHAREit is relying on ‘security through proximity’.
“The assumption being that anybody sharing wirelessly will be out of range of anybody with malicious intentions.
“I think that’s a rather poor assumption to make.
This isn’t the first time Lenovo has had trouble with security.
Last year it was caught installing adware in the form of Superfish on several of its laptops.
Superfish collects data, such as web traffic information, to push adverts to users.
Following the revelation, Lenovo promised to reduce the amount of bloatware that came with their products and become “the leader in providing cleaner, safer PCs”.
TrustedReviews has reached out to Lenovo for a response.
Editorial independence
Editorial independence means being able to give an unbiased verdict about a product or company, with the avoidance of conflicts of interest. To ensure this is possible, every member of the editorial staff follows a clear code of conduct.
Professional conduct
We also expect our journalists to follow clear ethical standards in their work. Our staff members must strive for honesty and accuracy in everything they do. We follow the IPSO Editors’ code of practice to underpin these standards.
Editorial independence
Editorial independence means being able to give an unbiased verdict about a product or company, with the avoidance of conflicts of interest. To ensure this is possible, every member of the editorial staff follows a clear code of conduct.
Professional conduct
We also expect our journalists to follow clear ethical standards in their work. Our staff members must strive for honesty and accuracy in everything they do. We follow the IPSO Editors’ code of practice to underpin these standards.
