Slashdot Mirror
Researchers Hack Over a Dozen Home Routers
An anonymous reader writes "Security researchers at Independent Security Evaluators have published a report demonstrating that a slew of home and small office (SOHO) routers are vulnerable to previously undisclosed vulnerabilities. The report asserts that at least thirteen popular routers can be compromised by a remote attacker, and a number of them do not require knowledge of credentials or active management sessions. Some of the routers are not listed as they work with vendors to fix them, but there are 17 vulnerabilities disclosed, with another 21 pending release. An article on CNET includes an interview with some of the researchers."
An older computer redone with a FreeBSD install makes an excellent router and is extremely secure. I would suggest anyone who is comfortable with a *nix command line use this solution as I've found it to be virtually bulletproof.
If your ISP provides you an insecure router and your credit card numbers are subsequently stolen, whose fault is it? Especially when these routers are only configurable via your ISP?
They hacked 13 Solar & Heliospheric Observatory routers.
Yes I did go to the actual article, but got bored after reading the headline.
D6 63 0D 70 89 81 BB 8E 7B 7C 5F 5D 54 EA AB 73
Comprosing cheap routers is a topic that has been covered on Slashdot many times before. In every previous article, they've required that remote administration be enabled on the router, which is generally never a default setting. This report states, "tested with out-of-the-box configuration settings". Really? Yikes.
They're pretty much all CSRF vulnerabilities. Don't save your password to your router or don't use a common router IP address like 192.168.1.1
It's been mentioned, but I have actual metrics (Kill-A-Watt P3) on the electricity used by "old computers"... in my case it was about a buck a day (I'm in So Cal, so YMMV, but I am sure electric rates are going to go up here, since California is going to save the world from global warming [or go broke trying], all by itself, by taxing the bejesus out of anyone with two nickles, You're welcome.)
BTW - anyone with an old VCR or DVD player you REALLY don't use... about $18 year just to keep it plugged in (flashing 12:00 or not). I tossed 2 units in the Goodwill bin a couple of years ago and haven't missed them.
This issue is a bit more complicated than you think.
The Buffalo Nx00 series (mine is an N900 I think) also uses DD-WRT and actively advertises it. In basic mode, it is a Buffalo branded implementation but there is a variable to set which puts it in advanced DD-WRT Mode. It was the primary driver in my decision to purchase said router. My knowledge at the time was that Buffalo only did backup solutions & SANs but went out on a limb and bought it anyway. I have never been more happy. Buy one today!
the people responsible are the ones who committed the crimes, not the people who coulda-shoulda-woulda been in positions to prevent it if they had done X more.
I wonder how DD-WRT stacks up.
-- I ignore anonymous replies to my comments and postings.
dont fuck around
-
Using a firewall box behind the router your ISP mandates you use, will not help you against a number of threats. Basically, they take over your router, put a sniffer on it and they can sniff all your internet traffic. The extra firewall may or may not prevent them gaining access to your computers behind the IPV4-NAT your router usually does. That's the only protection an extra firewall might give you. I'm saying might, since slight misconfiguration or access to a hackable service behind the firewall will negate all security that firewall is giving you.
Advocating FreeBSD, or any other specific solution is not helpful here. There are plenty of other adequate firewall solutions, more or less regardless of the operating system they may be running.
In practice, it will only help if manufacturers and vendors will be found liable for security flaws in their equipment and will automatically have to pay not just the price of the device and all damages to all customers that have bought it, but also a fine if they are found to be negligent. It's clear that vendors don't take security seriously (all tested devices were hacked) and ISPs aren't either. Home users can't be expected to know their security details up to such a high level so can't really be blamed for trusting their ISP or a leading brand to take care of security adequately. ISPs, vendors and manufacturers are supposed to know and actively secure their devices. Since they don't seem to care, some sort of threat should be put in place to make them take this more seriously.
I was promised a flying car. Where is my flying car?
I don't think there's a single person or legal entity "at fault" here. It's a combination of multiple factors. First of all, your credit card company uses a proven flawed security model. Second of all, you should have been more careful with those numbers yourself, since it's a proven flawed system. Third of all, yes, your ISP can be found negligent for not adequately testing the equipment they provided to you. They can blame it on their manufacturer, but if they haven't tested the equipment they should be found criminally negligent in my opinion. You can't ask home users to know this much about computer security, since it's not their profession in general. However, ISPs are in this for a living and should know better.
I was promised a flying car. Where is my flying car?
My parents' ISP issued router came down with a case of malware. The ISP kept putting them into walled-garden claiming botnet activity, and after months and months of this, I intervened. upon my investigation (which also took months) and thanks to their reluctant but cooperative security team, we determined it was not the only connected device that had the malware, but the router itself. And only because I "hacked" into it at some point and observed the malware in action, and reported my results back to the ISP. I thought my method (though it required some circumvention) was an intentional feature of the router. I didn't realize it was a vulnerability. Not at the time. I mean how do they remotely configure your router while on call or live chat with them? How can they expect me to think I can't do the same thing myself?
I've got one of these running debian wheezy. It acts as firewall/router/wifi-hotspot/OpenVPN gateway, and even allows me to have a *real* DMZ, unlike most home routers.
Darren Kitchen: "There's not a consumer demand for security; it's not a feature that will sell it."
PfSense: "Speak of the devil and he shall appear."
Good people go to bed earlier.
Just exploit thousands of them to create new tor exit nodes.
Endian firewall is robust and relatively easy for an average technical end user to implement.
Only idiot, moron, democrat, socialist, communist, progressive folks use a hackable router or firewall! They really are just that dumb! Look at how they vote!
screw you!
Look at the summary chart in the article.
With the exception of two Belkin routers, the victim must have an active management session open at the time of attack and the victim must be tricked into clicking a malicious link that leverages the open management session. This renders this "vulnerability" as highly unlikely. Most people do not open management sessions after initial router setup.
Not surprisingly, this article is full of hyperbole and the likelihood of actual router takeover is minimal to infinitesimally small. Hence, no widespread exploits.