Slashdot Mirror
Researchers Hack Over a Dozen Home Routers
An anonymous reader writes "Security researchers at Independent Security Evaluators have published a report demonstrating that a slew of home and small office (SOHO) routers are vulnerable to previously undisclosed vulnerabilities. The report asserts that at least thirteen popular routers can be compromised by a remote attacker, and a number of them do not require knowledge of credentials or active management sessions. Some of the routers are not listed as they work with vendors to fix them, but there are 17 vulnerabilities disclosed, with another 21 pending release. An article on CNET includes an interview with some of the researchers."
An older computer redone with a FreeBSD install makes an excellent router and is extremely secure. I would suggest anyone who is comfortable with a *nix command line use this solution as I've found it to be virtually bulletproof.
They hacked 13 Solar & Heliospheric Observatory routers.
Yes I did go to the actual article, but got bored after reading the headline.
D6 63 0D 70 89 81 BB 8E 7B 7C 5F 5D 54 EA AB 73
Yours for either A. having your credit card information on the network in an unencrypted state, B. transmitting it without making sure the HTTPS lock is present, and/or C. not having adequate deskop security.
It takes more than just an accessible router to get to sensitive information... if an unauthorized party is able to access that information, 9 times out of 10 it'll be a user's fault.
I see where you went wrong. You are trusting the same guys that try to oversell and under-deliver all while trying to legislate away competition to be technically competent and deliver you a secure router. What makes you think this time will be any different?
Comprosing cheap routers is a topic that has been covered on Slashdot many times before. In every previous article, they've required that remote administration be enabled on the router, which is generally never a default setting. This report states, "tested with out-of-the-box configuration settings". Really? Yikes.
They're pretty much all CSRF vulnerabilities. Don't save your password to your router or don't use a common router IP address like 192.168.1.1
It's been mentioned, but I have actual metrics (Kill-A-Watt P3) on the electricity used by "old computers"... in my case it was about a buck a day (I'm in So Cal, so YMMV, but I am sure electric rates are going to go up here, since California is going to save the world from global warming [or go broke trying], all by itself, by taxing the bejesus out of anyone with two nickles, You're welcome.)
BTW - anyone with an old VCR or DVD player you REALLY don't use... about $18 year just to keep it plugged in (flashing 12:00 or not). I tossed 2 units in the Goodwill bin a couple of years ago and haven't missed them.
This issue is a bit more complicated than you think.
The Buffalo Nx00 series (mine is an N900 I think) also uses DD-WRT and actively advertises it. In basic mode, it is a Buffalo branded implementation but there is a variable to set which puts it in advanced DD-WRT Mode. It was the primary driver in my decision to purchase said router. My knowledge at the time was that Buffalo only did backup solutions & SANs but went out on a limb and bought it anyway. I have never been more happy. Buy one today!
the people responsible are the ones who committed the crimes, not the people who coulda-shoulda-woulda been in positions to prevent it if they had done X more.
Using a firewall box behind the router your ISP mandates you use, will not help you against a number of threats. Basically, they take over your router, put a sniffer on it and they can sniff all your internet traffic. The extra firewall may or may not prevent them gaining access to your computers behind the IPV4-NAT your router usually does. That's the only protection an extra firewall might give you. I'm saying might, since slight misconfiguration or access to a hackable service behind the firewall will negate all security that firewall is giving you.
Advocating FreeBSD, or any other specific solution is not helpful here. There are plenty of other adequate firewall solutions, more or less regardless of the operating system they may be running.
In practice, it will only help if manufacturers and vendors will be found liable for security flaws in their equipment and will automatically have to pay not just the price of the device and all damages to all customers that have bought it, but also a fine if they are found to be negligent. It's clear that vendors don't take security seriously (all tested devices were hacked) and ISPs aren't either. Home users can't be expected to know their security details up to such a high level so can't really be blamed for trusting their ISP or a leading brand to take care of security adequately. ISPs, vendors and manufacturers are supposed to know and actively secure their devices. Since they don't seem to care, some sort of threat should be put in place to make them take this more seriously.
I was promised a flying car. Where is my flying car?
My parents' ISP issued router came down with a case of malware. The ISP kept putting them into walled-garden claiming botnet activity, and after months and months of this, I intervened. upon my investigation (which also took months) and thanks to their reluctant but cooperative security team, we determined it was not the only connected device that had the malware, but the router itself. And only because I "hacked" into it at some point and observed the malware in action, and reported my results back to the ISP. I thought my method (though it required some circumvention) was an intentional feature of the router. I didn't realize it was a vulnerability. Not at the time. I mean how do they remotely configure your router while on call or live chat with them? How can they expect me to think I can't do the same thing myself?
I disagree. There is a demand for security, at least among some a certain set of consumers. The current problem is that apparently none of the commercially available routers appear to be worth anything when it comes to security. Every time an article like this appears on /. I keep looking for some recommendations as to what to do. And I never find anything.
The only recommendation I did find was from Mr. Kitchen, about using an old computer and smoothwall. Well, first, physically that wouldn't work (the cable modem, router, and switch all live up on a small shelf near the patch panel for my house. Yes, I paid $$ to get the place wired). Second, I really doubt my ability to keep a linux box up, operating, and fully patched. Keeping the router's firmware up to date is easy (it checks itself, and will pop up on the admin page when a new firmware is available: some will even flash themselves if you allow it): a unix OS isn't going to be that easy.
I really don't understand why some manufacturer doesn't use this as a marketing opportunity. There is a niche here. I'd may more (maybe significantly more) for something that is secure, works well, and meets my needs.