Diad 6 Security Issue

ClusterFunk

New Member
The only thing required to login to the DIAD is an Employee ID. There is no password. It wouldn't be hard to connect to WiFi and see what IP/Host it connects to and just login to that with telnet and download/pull a manifest from a computer anytime. Anyone going to say anything about that? I mean, it isn't hard to run a loop in python to check a bunch of IDs in a sequence.
 

Cowboy Mac

Well-Known Member
The only thing required to login to the DIAD is an Employee ID. There is no password. It wouldn't be hard to connect to WiFi and see what IP/Host it connects to and just login to that with telnet and download/pull a manifest from a computer anytime. Anyone going to say anything about that? I mean, it isn't hard to run a loop in python to check a bunch of IDs in a sequence.
4F38D232-0351-409D-A5C4-B8FC530062B9.jpeg
 

killamjl

Well-Known Member
While their at it maybe they could OPTIMIZE THE friend'ING CODE so the unregistered listeners and callbacks dont cause a huge memory leak causing the DIAD to crash every 4-5 hours.

1655523917533.png
 

DiadDude

Well-Known Member
The only thing required to login to the DIAD is an Employee ID. There is no password. It wouldn't be hard to connect to WiFi and see what IP/Host it connects to and just login to that with telnet and download/pull a manifest from a computer anytime. Anyone going to say anything about that? I mean, it isn't hard to run a loop in python to check a bunch of IDs in a sequence.
Uh, yeah.. that's not how that works at all, but thanks for playing.
 

Poop Head

Judge me.
The only thing required to login to the DIAD is an Employee ID. There is no password. It wouldn't be hard to connect to WiFi and see what IP/Host it connects to and just login to that with telnet and download/pull a manifest from a computer anytime. Anyone going to say anything about that? I mean, it isn't hard to run a loop in python to check a bunch of IDs in a sequence.
Shut up dude!!

Dont give them anymore ideas!
 

Box Ox

Well-Known Member
The only thing required to login to the DIAD is an Employee ID. There is no password. It wouldn't be hard to connect to WiFi and see what IP/Host it connects to and just login to that with telnet and download/pull a manifest from a computer anytime. Anyone going to say anything about that? I mean, it isn't hard to run a loop in python to check a bunch of IDs in a sequence.
Uh, yeah.. that's not how that works at all, but thanks for playing.

Nonsense! Prepare to be h4x0r3d n00b!
 

ClusterFunk

New Member
Uh, yeah.. that's not how that works at all, but thanks for playing.
Well it's only going to be a server listening for connections, if the Diad 6 doesn't ask you for a password it's not sending a password for authentication to that server. So my assumption is there is some simple protocol that's going to ask for a username. It doesn't even seem to match up any hardware info or have any session info tied to authentication. Middle of the day once I was one digit off logging back in and got someone else's :censored2:.
Even if someone could, what would they even get out of doing that lol
Who knows what they could do with the customer information, they could probably find some way to run scams with valid tracking numbers. Not 100% sure about it, but it seems like a bit of a privacy issue for customers.

I'm just saying, I don't know if these developers are third party or UPS hires them directly. But if a driver was this bad at their job, they'd be fired. Our center just got these things, however they've been out for a long time to the best of my knowledge. Security issues should be a #1 concern, and the constant crashing that's effecting our work performance should be right up there with it. I like to get back in that truck and move in this heat so I can get some air on me, sitting still waiting for an APP to work is irritating and it gets hot.

So far these all they can do is offer us BS "tips" on how to deal with the Diad, instead of actually solving issues. It's like we're supposed to turn a blind eye on anything that's not directly in our control. I with they'd step up and solve their own problems.
 

Thebrownblob

Well-Known Member
The only thing required to login to the DIAD is an Employee ID. There is no password. It wouldn't be hard to connect to WiFi and see what IP/Host it connects to and just login to that with telnet and download/pull a manifest from a computer anytime. Anyone going to say anything about that? I mean, it isn't hard to run a loop in python to check a bunch of IDs in a sequence.
Chinese cat hackers!!!!!
1655555034297.gif
 

One day at a time

Well-Known Member
The only thing required to login to the DIAD is an Employee ID. There is no password. It wouldn't be hard to connect to WiFi and see what IP/Host it connects to and just login to that with telnet and download/pull a manifest from a computer anytime. Anyone going to say anything about that? I mean, it isn't hard to run a loop in python to check a bunch of IDs in a sequence.
Why worry?it will just freeze up,the people trying to get any information will just be like the ups driver and give up. They will actually feel sorry for use and send us a get better card.
 

eats packages

Deranged lunatic
I'm sure the hardware itself is acting like a password. I'm more worried about the risk of other employees especially my sup getting in.

If a device was stolen the OMS probably calls a phone number to some guy who will remove the ID of the device from the list of accepted devices.

My major fear would be if they lazily add driver helper phones from the BYOD program into the mix.

These are the reasons why hackathons nowadays are so successful lol.
 

babboo25

Banned
The only thing required to login to the DIAD is an Employee ID. There is no password. It wouldn't be hard to connect to WiFi and see what IP/Host it connects to and just login to that with telnet and download/pull a manifest from a computer anytime. Anyone going to say anything about that? I mean, it isn't hard to run a loop in python to check a bunch of IDs in a sequence.
LOL
 

Fido

Don’t worry he’s friendly
Well it's only going to be a server listening for connections, if the Diad 6 doesn't ask you for a password it's not sending a password for authentication to that server. So my assumption is there is some simple protocol that's going to ask for a username. It doesn't even seem to match up any hardware info or have any session info tied to authentication. Middle of the day once I was one digit off logging back in and got someone else's :censored2:.

Who knows what they could do with the customer information, they could probably find some way to run scams with valid tracking numbers. Not 100% sure about it, but it seems like a bit of a privacy issue for customers.

I'm just saying, I don't know if these developers are third party or UPS hires them directly. But if a driver was this bad at their job, they'd be fired. Our center just got these things, however they've been out for a long time to the best of my knowledge. Security issues should be a #1 concern, and the constant crashing that's effecting our work performance should be right up there with it. I like to get back in that truck and move in this heat so I can get some air on me, sitting still waiting for an APP to work is irritating and it gets hot.

So far these all they can do is offer us BS "tips" on how to deal with the Diad, instead of actually solving issues. It's like we're supposed to turn a blind eye on anything that's not directly in our control. I with they'd step up and solve their own problems.
Here’s some advice on it.
Don’t try to open the stop. It is more likely to crash the mobile delivery program. Just see the stop see how many boxes there are and what hin and go find the boxes in the truck and just scan as you go.
 

pkgdriver

Well-Known Member
Well it's only going to be a server listening for connections, if the Diad 6 doesn't ask you for a password it's not sending a password for authentication to that server. So my assumption is there is some simple protocol that's going to ask for a username. It doesn't even seem to match up any hardware info or have any session info tied to authentication. Middle of the day once I was one digit off logging back in and got someone else's :censored2:.

Who knows what they could do with the customer information, they could probably find some way to run scams with valid tracking numbers. Not 100% sure about it, but it seems like a bit of a privacy issue for customers.

I'm just saying, I don't know if these developers are third party or UPS hires them directly. But if a driver was this bad at their job, they'd be fired. Our center just got these things, however they've been out for a long time to the best of my knowledge. Security issues should be a #1 concern, and the constant crashing that's effecting our work performance should be right up there with it. I like to get back in that truck and move in this heat so I can get some air on me, sitting still waiting for an APP to work is irritating and it gets hot.

So far these all they can do is offer us BS "tips" on how to deal with the Diad, instead of actually solving issues. It's like we're supposed to turn a blind eye on anything that's not directly in our control. I with they'd step up and solve their own problems.
They have been out for a long time. I may or may not have used it for over 2 1/2 years.
 

Yeet

Not gonna let ‘em catch the Midnight Rider
You need an employee ID number and password to log into IVIS and I’m pretty sure the server knows if something besides an IVIS is trying to log into the system. You also have to be geologically located inside the “geo-fence” or it won’t even let you log in. So no clocking in and out at your car or at home. That and we get to take the unit home so no one else can screw with our board. Not saying feeders are better than you, just saying.
 
Last edited:
Top