Slashdot Mirror
Remote Linksys 0-Day Root Exploit Uncovered
Orome1 writes "DefenseCode researchers have uncovered a remote root access vulnerability in the default installation of Linksys routers. They contacted Cisco and shared a detailed vulnerability description along with the PoC exploit for the vulnerability. Cisco claimed that the vulnerability was already fixed in the latest firmware release, which turned out to be incorrect. The latest Linksys firmware (4.30.14) and all previous versions are still vulnerable."
Yes, you would think the summary would at LEAST say *WHICH* router it affects, since Linksys has lots of different models. It is the WRT54GL.
I *love* that router and have probably 30 of them. Low power draw, real antenna, wall mountable, etc. My recommendation- install Toastman Tomato on it. They never crash, freeze, freak out, not work with certain devices, etc. Rock solid stuff.
Strangely, the WRT54GL is STILL BEING SOLD!
I'm pretty sure my Linksys router doesn't have that vulnerabil -- HA JUST KIDDING, WHO WANTS MY CREDIT CARD NUMBER?
Just gotta ask: have they tried it on any OTHER models? Because that's an OLD OLD router that shouldn't even be running cisco/linksys firmware anymore. Tomato, ddwrt, and openwrt all support it, all have support for it and much improved kernel and userspace versions.
Additionally though the number of different arm processors and SoC arches they're running in their hardware makes me question the odds of a common exploit across all of them, especially since this isn't even a router support the new 'Cisco Cloud' configuration garbage.
Anyway, what do the rest of you think, some wanna-be 'security' company trying to make a name for themselves scaremongering?
What's zero-day about this exploit?
It was found during testing, and there are no exploits in the wild.
As such it fails BOTH tests for being a zero day exploit:
- The company must not know the details of the exploit
- It must be in the wild
Stop using the phrase "zero day" about just any exploitable bug. Call them security vulnerabilities, which is what they are.
Does this work from the WAN side? Video shows the exploit working on the LAN side of the router.
The Department of Homeland Security needs to tell everyone to uninstall their Linksys routers until this is fixed, a la Java.
So it's a vulnerability in the WRT54GL (and maybe the related routers) running mainly older firmware - it's a pretty old router model as are its cousins. And from watching the exploit video, it's a local vulnerability - not one you can exercise against the WAN port. So it looks like not such a big deal. After all, 98% of those just have the default password anyways.
If the more advanced gear (like the RV routers and such) have this issue then I might be concerned. But I don't have enough info yet to worry or not.
-- Josh Turiel
"2. Do not eat iPod Shuffle."
Unless you have remote administration enabled, this exploit is only achievable from a system within the local network. This attack is not an internet threat.
If your Internet provider is "linksys", or if your restaurant is running home networking gear, then it very well may be exploitable.
As if the default administrator login being a blank username with the password "admin" wasn't enough...
Is that correct?
Stupid question, but by "Default installation" do they mean that the default user/pass needs to be unchanged? 70 million routers is a lot.. even if only 1% uses remote administration.
Most Liniksys routers these days run vxWorks. Now that doesn't mean that this vulnerability couldn't be above the OS/driver level and thus still applicable, or that the code isn't broken in the same way, but the GL model is something of an anomaly these days running their Linux firmware. They switches to vxWorks some time ago for most things. They claim it was to use less memory (and they did cut the RAM in their devices), Linux types claim it was to avoid having to GPL things.
Appliances need a system for automatic updates. The average person does not periodically look for updated firmware for their router, toaster, television, thermostat, etc. If it is connected to the internet, it needs an automatic update system.
(Yes, I know this router is old - I'm just speaking in general)
The vulnerability itself was discovered during a Cisco Linksys product security evaluation for a client
has the kind of money to poney up for a security evaluation of this magnitude and buys freakin' crappy a$$ Linksys?
Stupid link talks about WRT54GL only.
To quote the original page:
Exploit shown in this video has been tested on Cisco Linksys WRT54GL, but other Linksys versions/models are probably also affected.
It took quite a while to show up.
says that, Huawei also reported its routers face a similar vulnerability.
---
Protest online. Save the Planet.
Anybody caught using the original firmware on a WRT54GL deserve to be exploited. The L in this product name stands for Linux and most, if not all, third party firmware supports it. If you really want to grab somebody's attention, use a device that does not have any immediate third party support (eg, off the top of my head, the WRT160Nv2, which has the "no" status in DD-WRT router database) as demonstration.
Until you use it as a proxy to launch other attacks. Are you really this stupid?
FUD, smoke, and mirrors. Getting a shell on one linux router is not such a coup.
Well, once you get root on the router you pretty much own everything behind it as well, because most people rely on
the router to protect them.
Sig Battery depleted. Reverting to safe mode.
As if the default administrator login being a blank username with the password "admin" wasn't enough...
I don't care who you are, that there is funny.... LOL
I've found a pile of public access WiFi nodes out there that use the default SSID and the default user/password all over the world. Few folks ever do even basic security like changing the default password, so how bad can this Zero day thing be? Not that bad..
Where are my mod points when I need them?
That would have been semi helpful. Some inkling. My WRT110 has a little setting called 'allow remote admin'. I hope we're talking about that non-issue.
Recent openwrt distros have a problem with the classic wrt54gl in that it doesn't have enough memory. I know because it happened to me. It installs, but when you try to change configuration, it bricks and you need to ground pin 15 to get it to reflash something. From the openwrt site:
"In a test with OpenWrt 10.03.1-rc6, the OS will install but LuCI will be unable to update settings because there isn't enough flash left free."
Old enough versions should work, but I'm happy with my tomato install.
In theory, theory and practice are the same; in practice they're different. (Yogi Berra & A. Einstein)
I RTFAed, I'm not gonna WTFM.
I run Shibby's builds on my Linksys E4200... Can't recommend them enough:
http://tomato.groov.pl/?page_id=164
And its BS like this that I do not trust other companies any more than I have to for security.
So my router was made by me with wifi and all for less than $200 and uses pfsense. If there's a security risk I'm sure there will be a patch unlike some dlink and linksys problems. What happened when my last dlink router had a 0day exploit? dlink's public answer was "I'm sorry, we don't support your 2.3 year old router anymore, but if you buy our new shiniest router ever it has the firmware update to fix that exploit". So you're telling me you expect me to buy your product again when you've proven to me that you expect me to buy a new router from you every two years like clockwork? Heck no.
Besides, now that my Atom is all setup I've noticed latency on gaming is 1/2 of what it used to be and download speeds actually went up! Can't beat that!
Unfortunately there isn't any good open source Windows antivirus that I know of.
An exploit with an administration setup ultimately governed by Linksys? No...
http://tech.slashdot.org/story/12/06/29/1425210/cisco-pushing-cloud-connect-router-firmware-allows-web-history-tracking?sdsrc=rel
http://www.extremetech.com/computing/132142-ciscos-cloud-vision-mandatory-monetized-and-killed-at-their-discretion
WHo'd of thought a way around this brilliant idea? ^_^?
It doesn't seem like they know what they are doing:
http://media.ccc.de/browse/congress/2012/29c3-5400-en-hacking_cisco_phones_h264.html
Another vote here for tomato. Tomato makes me happy. I have it on a buffalo and two linksyses and they all work, WDS actually works, everything works.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I highly recommend getting a fritz box. The amount of stuff they can do is really cool.
The model I have is a NAS server, Media server for my blu-ray player, a PBX for cheap SIP calls, an answering machine for SIP or land line calls, a DECT phone base station, A print server for my USB printer, a VDSL modem, and a 4 port gigabit switch. All that in a small low power box.
Also you can update the firmware fairly easily although it does trash all your settings.
No I don't work for them.
I wished somebody would find an 0day for a popular router model and write a worm that installs TOR exits on all of them automatically.
Replying to my own post. I'm happy I got modded up to a 5, but I made a mistake. It's pin 16 you ground to reflash. You can find full instructions on the web.
Actually, their video doesn't show shit. An apparent DOS box running a few commands, followed by a "nc" connection to a random port that may or MAY NOT actually be to a compromised system. Until they say exactly what they've exploited (with code), it's just Marketing FUD.