quote:

---

Sprint DSL customers are at risk of having their e-mail addresses and passwords stolen -- even when their computers are powered off -- due to weak security controls on their DSL modems.

Experts warned this week that the security problem could enable Internet vandals to wreak havoc from afar with the ZyXel Communications DSL modems issued by Sprint to tens of thousands of its FastConnect broadband customers.

Sprint officials acknowledged that remote access to the administrative software embedded in the ZyXel Prestige 642 and 645 modems is by default protected with a password of "1234." But the company said users are responsible for securing the equipment, which stores login data, including the user's e-mail address and password.

============================

Lawrence Baldwin, operator of the myNetWatchman security service, said the incident shows that some ISPs aren't doing enough to protect customers.

"If you believe that ISPs have some responsibility for the security of their customers, then shipping a modem with a default password is just a major, egregious oversight," he said.

Sprint should proactively scan its network for DSL equipment that is incorrectly configured, and notify users by telephone or e-mail, according to John Navas, an independent telecommunications analyst.

According to David Blumenthal, a spokesman for Earthlink, which provides e-mail service to Sprint FastConnect customers, "there is not a security question involving Earthlink."

---