Slashdot Mirror
Researchers Hack Over a Dozen Home Routers
An anonymous reader writes "Security researchers at Independent Security Evaluators have published a report demonstrating that a slew of home and small office (SOHO) routers are vulnerable to previously undisclosed vulnerabilities. The report asserts that at least thirteen popular routers can be compromised by a remote attacker, and a number of them do not require knowledge of credentials or active management sessions. Some of the routers are not listed as they work with vendors to fix them, but there are 17 vulnerabilities disclosed, with another 21 pending release. An article on CNET includes an interview with some of the researchers."
An older computer redone with a FreeBSD install makes an excellent router and is extremely secure. I would suggest anyone who is comfortable with a *nix command line use this solution as I've found it to be virtually bulletproof.
If your ISP provides you an insecure router and your credit card numbers are subsequently stolen, whose fault is it? Especially when these routers are only configurable via your ISP?
Researchers? From the linked web page, this looks like an ad for some high-priced security consultants. I stopped reading after, "All 13 routers evaluated can be taking over from the local network." Can be taking over? Kind of makes you wonder how careful their "research" was, although as I said I didn't bother to read any more.
They hacked 13 Solar & Heliospheric Observatory routers.
Yes I did go to the actual article, but got bored after reading the headline.
D6 63 0D 70 89 81 BB 8E 7B 7C 5F 5D 54 EA AB 73
Comprosing cheap routers is a topic that has been covered on Slashdot many times before. In every previous article, they've required that remote administration be enabled on the router, which is generally never a default setting. This report states, "tested with out-of-the-box configuration settings". Really? Yikes.
They're pretty much all CSRF vulnerabilities. Don't save your password to your router or don't use a common router IP address like 192.168.1.1
It's been mentioned, but I have actual metrics (Kill-A-Watt P3) on the electricity used by "old computers"... in my case it was about a buck a day (I'm in So Cal, so YMMV, but I am sure electric rates are going to go up here, since California is going to save the world from global warming [or go broke trying], all by itself, by taxing the bejesus out of anyone with two nickles, You're welcome.)
BTW - anyone with an old VCR or DVD player you REALLY don't use... about $18 year just to keep it plugged in (flashing 12:00 or not). I tossed 2 units in the Goodwill bin a couple of years ago and haven't missed them.
This issue is a bit more complicated than you think.
The Buffalo Nx00 series (mine is an N900 I think) also uses DD-WRT and actively advertises it. In basic mode, it is a Buffalo branded implementation but there is a variable to set which puts it in advanced DD-WRT Mode. It was the primary driver in my decision to purchase said router. My knowledge at the time was that Buffalo only did backup solutions & SANs but went out on a limb and bought it anyway. I have never been more happy. Buy one today!
the people responsible are the ones who committed the crimes, not the people who coulda-shoulda-woulda been in positions to prevent it if they had done X more.
I wonder how DD-WRT stacks up.
-- I ignore anonymous replies to my comments and postings.
dont fuck around
-
Using a firewall box behind the router your ISP mandates you use, will not help you against a number of threats. Basically, they take over your router, put a sniffer on it and they can sniff all your internet traffic. The extra firewall may or may not prevent them gaining access to your computers behind the IPV4-NAT your router usually does. That's the only protection an extra firewall might give you. I'm saying might, since slight misconfiguration or access to a hackable service behind the firewall will negate all security that firewall is giving you.
Advocating FreeBSD, or any other specific solution is not helpful here. There are plenty of other adequate firewall solutions, more or less regardless of the operating system they may be running.
In practice, it will only help if manufacturers and vendors will be found liable for security flaws in their equipment and will automatically have to pay not just the price of the device and all damages to all customers that have bought it, but also a fine if they are found to be negligent. It's clear that vendors don't take security seriously (all tested devices were hacked) and ISPs aren't either. Home users can't be expected to know their security details up to such a high level so can't really be blamed for trusting their ISP or a leading brand to take care of security adequately. ISPs, vendors and manufacturers are supposed to know and actively secure their devices. Since they don't seem to care, some sort of threat should be put in place to make them take this more seriously.
I was promised a flying car. Where is my flying car?
I don't think there's a single person or legal entity "at fault" here. It's a combination of multiple factors. First of all, your credit card company uses a proven flawed security model. Second of all, you should have been more careful with those numbers yourself, since it's a proven flawed system. Third of all, yes, your ISP can be found negligent for not adequately testing the equipment they provided to you. They can blame it on their manufacturer, but if they haven't tested the equipment they should be found criminally negligent in my opinion. You can't ask home users to know this much about computer security, since it's not their profession in general. However, ISPs are in this for a living and should know better.
I was promised a flying car. Where is my flying car?
No- the people responsible are the ones who put users in danger through stupid designs.
They should be releasing 100% of the code, providing security updates, and making sure defaults are such that users are not able to easy install whatever they want. The system should make it somewhat difficult to do point and click installs of potentially dangerous software.
My parents' ISP issued router came down with a case of malware. The ISP kept putting them into walled-garden claiming botnet activity, and after months and months of this, I intervened. upon my investigation (which also took months) and thanks to their reluctant but cooperative security team, we determined it was not the only connected device that had the malware, but the router itself. And only because I "hacked" into it at some point and observed the malware in action, and reported my results back to the ISP. I thought my method (though it required some circumvention) was an intentional feature of the router. I didn't realize it was a vulnerability. Not at the time. I mean how do they remotely configure your router while on call or live chat with them? How can they expect me to think I can't do the same thing myself?
I have a Netgear router, not the exact one mentioned, and not the same firmware.
Tried what they said, and it worked just like they said. I no longer need to use password to access my router.
So great, now tomorrow I get to reset to factory settings and set the whole thing up again for all the MAC addresses.
GC
I've got one of these running debian wheezy. It acts as firewall/router/wifi-hotspot/OpenVPN gateway, and even allows me to have a *real* DMZ, unlike most home routers.
Darren Kitchen: "There's not a consumer demand for security; it's not a feature that will sell it."
PfSense: "Speak of the devil and he shall appear."
Good people go to bed earlier.
Just exploit thousands of them to create new tor exit nodes.
Back then the store bought routers were soooo delicate, they would go bad for reasons I was never able to figure out. So I took an old PC, put Smoothwall on it and used it till the PC finally died a few years later. I configured a few of them for friends as well. Don't know exactly why I started using store-bought routers, probably just because they were smaller than an old commodity PC. Looks like I oughta turn the clock back, huh?
the people responsible are the ones who committed the crimes, not the people who coulda-shoulda-woulda been in positions to prevent it if they had done X more.
The people responsible under the morals and laws of society are the ones who committed the crime.
In Real Life, however, the person who fails to anticipate an obvious and likely course of events can also be said to bear some of the fault.
Or put another way:
If you want to cry about whose fault it is you got raped, then you can walk down an alley full of convicted rapists wearing nothing but a g-string.
But if you'd rather just not get raped to start with, you might want to consider walking somewhere else, wearing different clothing, and/or carrying a gun.
No matter how hard you beat your Utopian Drums, the world has bad people in it who are looking for Victims. You can be proactive about making sure you don't become a victim, or you can piss and moan about it when it happens. But if you ARE going to insist on doing stupid shit, then don't come crying to us about it.
Endian firewall is robust and relatively easy for an average technical end user to implement.
Only idiot, moron, democrat, socialist, communist, progressive folks use a hackable router or firewall! They really are just that dumb! Look at how they vote!
screw you!
Look at the summary chart in the article.
With the exception of two Belkin routers, the victim must have an active management session open at the time of attack and the victim must be tricked into clicking a malicious link that leverages the open management session. This renders this "vulnerability" as highly unlikely. Most people do not open management sessions after initial router setup.
Not surprisingly, this article is full of hyperbole and the likelihood of actual router takeover is minimal to infinitesimally small. Hence, no widespread exploits.