Slashdot Mirror
Extraneous Network Services Leave Home Routers Unsecure
An anonymous reader writes "Today's home routers include a multitude of extra functionality, such as the ability to act as a file and print server. An article from CNET shows how an attacker can use vulnerabilities in these services, such as buffer overflows, directory traversal, race conditions, command injections, and bad permissions to take over the router from the local network without knowing the administrative password. Some of the worst vulnerabilities were in undocumented, proprietary services that users cannot disable and allowed an attacker to achieve a root shell. The researchers who discovered the vulnerabilities will be demonstrating them at the Wall of Sheep and Wireless Village at DEF CON."
Didn't DEFCON end yesterday?
Is anyone as tired as I am over these security risks, especially from CNET? I remember when it was announced that someone could spy thru your window, video tape the lights on your modem and decode your communication. Another day, another risk that only happens in either a lab, workshop or a marketer's imagination. 99% are just to attract eyeballs for ad revenue...especially from CNET.
I was under the impression that the Wall of Sheep was a way to out those who came to Defcon with improperly secured devices, not show off hacks of "civilians" devices.
LOADS of routers are pwned far more easily than that, from simple SQL injection (either via query string or crafting get/post requests), or there's sometimes bootloaders that give *full* access to the filesystem via TFTP (you can download all init scripts for example), you can sometimes find undocumented manufacturer backdoor passwords which are hard coded, and there's lots of misconfigured routers and you can often rely on trivial stuff like default passwords and what not. Even in 2013 there's lots of routers and similar equipment that are sold or configured in a state that isn't far from swiss cheese...
It's rather easy to poke at the firmware and finding holes using binwalk and IDA Pro if you have basic RE knowledge.
Attacker has to have access from the LAN side, and must install USB memory first.
The jokes on them because I use my neighbor's unsecured WiFi. I even use his pool when their not home. I'm a great neighbor.
I looked at some of the source code, and the bash commands they execute, and it looks like you have to be on the local (class C) lan in order to attack at least the Linksys beast (the 192.168.blah.blah sure looks like you can't get there from the WAN side), and if you have the services turned off, then you might be less vulnerable, and if you use hard, non-trivial, non-default passwords, that makes it harder too. I suppose it also helps if you have a router acting as a DNS server, after your WAN facing gateway, and the local DNS box not acting as the main switch (so to sum up, Gateway-DNS-Switch), with everything after the gateway as a Class C lan.
routers should route and probably run access control lists and other firewall stuff like expose some ports in your dmz.
servers should serve.
Servers route poorly, routers serve poorly.
And this one (of may) reason why you should flash your firmware and put a non vendor one on it. I did a review here: Security-Lessons-Linux-WAP/(language)/eng-US. The actual PDF is here 048-049_kurt.pdf
.
I just recently installed a wlan router at a friends place. The goal was to make it rock solid and secure.
Here is what I did:
- Changed default username and set very strong password
- Changed web admin interface to non default high port, allow only https
- Only allow access to the admin interface from a specific ip/mac address
- Disable telnet and ssh acces
- Disable print server and usb samba share
- Disable upnp and all vpn/ipsec passthrough
- Enable statefull firewall, connections must originate from inside lan, everything else does not pass the wan interface
- Disable dns cache and use the dns servers from the isp (served via dhcp)
- Enable wpa2 for wlan with max password length.
So far it sails smooth and no complains. No need to activate all these settings on the routers.
The LAN side access isn't difficult with WIFI, and the ATTACKER doesn't need to plug-in his own USB, having any USB plugged in will activate the unauthenticated SMB.
The take-home message, then, is don't plug USB storage into your router, and do use WPA2, not earlier WiFi security protocols.
It's worrisome because although NAT is not designed to take the place of a firewall, in fact it often does. For home or SOHO users, it's actually reasonably good as a firewall. They "should" have better, you might argue, but in fact they don't, most often. IPv6 removes the need for NAT, possibly leaving many SOHO users with no firewall-like protection.
You can have NAT with IPv6 - I believe there's even an RFC for it, and an implementation on FreeBSD. Linux did get patches that were rejected. Hell, there's even NAT-PT, which lets IPv4-only hosts access IPv6 only hosts (and vice-versa). Imagine that - we could switch and continue life as we know it, and don't care if we're talking to an IPv4 or IPv6 host.
NAT has an awesome advantage - it isolates your internal network numbering from the external network numbering. Many early RFCs on the early Internet were fixated around people having to renumber their networks because of conflicts in their network addressing, and enough people had trouble that they created the private address space so future networks will not have to undergo such renumberings and disruption.
It certainly would be nice to be isolated from my ISP's whims and wishes for most of my stuff on the network. Sure I'll have to deal with it for a few servers I have, but I'd rather do it for a few than for every.
Of course, the problem is the IPv6 fanboys who believe IPv6 means complete end-to-end connectivity again and that NAT has absolutely no use in an IPv6 world and even suggesting NAT impacts IPv6 "purity" that keeps IPv6 adoption from happening widely. Of course, end-to-end connectivity is broken anyways with proper firewalls (at least a program can detect private network access and assume firewall usage, but with IPv6, it's impossible).
And I'm sure people would prefer to have IPv6 to operate like IPv4 did with NAT as it's a lot less to learn and things work on IPv6 as they did with IPv4.
NAT + stateful firewall ~= !NAT + stateful firewall. I.E., NAT gives you no more protection than a proper firewall would.
For a change, why don't you tell me tips how to improve the security of my equipment, instead of going "naa-naa-na-naa-naa, there's this and that vulnerability in your gear".
As long as it's only "vulnerable" to "attacks" from the local network, who really cares about vulnerabilities? It's a home router; I'm surprised home routers even have the ability to enforce things like directory permissions at all. I hardly need to "protect" my files from my wife; if she wants to read my stuff, she has much easier ways than launching a buffer overflow attack on my router.
If you want real security, buy something designed to care.
It's worrisome because although NAT is not designed to take the place of a firewall, in fact it often does. For home or SOHO users, it's actually reasonably good as a firewall. They "should" have better, you might argue, but in fact they don't, most often. IPv6 removes the need for NAT, possibly leaving many SOHO users with no firewall-like protection.
That is tangential to the question of whether IPv6 comes with or without a firewall. Any router that's worth anything comes with a firewall. Regardless of whether it has NAT or not. !NAT != !Stateful_firewall.
On the question of this story, I do agree with bobstreo - routers should route and servers should serve i.e. routers shouldn't have things like FTP, SCP, SSH, SMTP, IMAP/POP or any other servers on it. It should have 2 and only two functions - routing traffic from one network to another, and providing a filter on the traffic that comes into the LAN that's behind it. Beyond that, nothing. One way could be to, as some have suggested, put something like pFsense, m0n0wall or OpenWRT
One of the recommendations is that manufacturers use signed updates... This won't help with issues like those disclosed, and may even make it worse...
The primary reason for including signed updates is to prevent third party firmware from being used, it does nothing to stop the official firmware from having security holes, and it's very unlikely that a hacker is going to completely reflash the device to run a custom firmware rather than backdooring the existing firmware. On the other hand, manufacturers generally only support these devices with official firmware updates for a very short period of time if at all, so third party firmware may be the only way to fix some of these holes.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Look if you don't have to have WIFI at home then don't.
You can buy a USB to rj45 adapter for any device. Buy an 8 or 12 port switch, locate it centrally, run short cords from there to multiple jacks in rooms and from there have short cords available for plugin. Done. Use different color cords for devices in close proximity just to make it easy to trouble shoot.
Its clean, it's convenient you can scale it up as you need and you don't have to worry about all the bad programming bugs that WIFI routers are sporting.
Pfsense and a computer with two network cards is all you need. Pick up a used cisco access point and add a 3rd nic for wireless.
Rock soild, Guaranteed no back doors. Installs in less than 15 minutes from cd. Dependability based BSD and the parts you put in it. Get a cheap core2duo era xeon 1u server for 100 bucks, and make it look even slicker
-
and my router is as secure as the zipper on my fly
Firewalls have nothing to do w/ end to end connectivity. End to end connectivity simply means that the source or destination addresses are not tampered with while the packets are en route - something that's violated in NAT. A packet can go from a source to a destination, and get dropped by the firewall if it violates certain rules, but that doesn't mean that end to end connectivity is not there.
NAT-PT is not about IPv4-IPv6 connectivity - it's just about bringing certain features, such as load balancing, to IPv6 - that's one of the rare benefits to NAT. Also, in NAT-PT, there is a 1:1 relationship between the public address and link-local address, unlike in IPv4, where a 1:many relationship was needed due to address shortage.