The camera above the front door worked perfectly. For weeks it also had a second owner.
How a list of 62 factory passwords turned around 600,000 everyday gadgets into a weapon, and why the CRA puts the responsibility on the manufacturer.
The facts
What happened
The Mirai malware scanned the internet for devices such as cameras, video recorders and routers, and tried to log in over Telnet using a built-in list of 62 default usernames and passwords.
What it caused
At its peak around 600,000 devices were infected and turned into a botnet used to attack websites and services. Most owners never noticed their device had been taken over.
What the CRA now asks
Secure by default configuration (Annex I, Part I (2)(b)); protection from unauthorised access (Annex I, Part I (2)(d)); limited attack surfaces (Annex I, Part I (2)(j)).
Source: Antonakakis et al., "Understanding the Mirai Botnet", USENIX Security 2017
The story
Tomás bought the camera after someone stole his bike from the porch, and having it made him feel like a man who handled things. He mounted it above the front door on a Saturday in 2016, opened the app on his phone, and there it was: his own porch, live, in grainy black and white. He never changed the password it came with. Nobody told him to, and honestly, who would want to break into a camera pointed at a doormat?
A few weeks later, something found it. Not a person. A program that never slept, moving from one internet-connected gadget to the next, trying the same 62 passwords that cameras and other devices come with from the factory. On Tomás's camera, one of them worked. It took seconds. Nothing changed in the app. The porch was still there. But from that moment on, the camera had a second owner, and that owner controlled a silent army of around 600,000 gadgets just like it, ready to be pointed at anyone.
Tomás never found out. Most of them never did. That is what makes this story so unsettling: the owners were not careless. They were normal. The Cyber Resilience Act puts the responsibility where it belongs, with the company that made the gadget. Products must be secure out of the box, which means no password shared by every single unit, and EU rules for wireless products already demand the same today. Tomás's camera arrives with a password nobody else has, and the program moves on.
The people and scenes are illustrative. The incident and its facts are real.
The system that would have caught it
Secure by default is a design requirement for the product itself. Shipping one password shared by every unit is a decision, and someone with the authority to stop the release has to own it.
5. Decide and own
One named person responsible for the CRA work, with a budget and the authority to stop a release. Decisions are written down on one page.
How the system worksCould you do this today?
Does every unit you ship have its own password, or none at all, instead of one shared by every unit?
If it applies, how ready are we?
Six yes-or-no questions, two minutes. Your no's come back in the order to fix them.
Not sure the CRA applies to your product? Check that first