Slashdot Mirror
D-Link Router Backdoor Vulnerability Allows Full Access To Settings
StealthHunter writes "It turned out that just by setting a browsers user-agent to 'xmlset_roodkcableoj28840ybtide' anyone can remotely bypass all authentication on D-Link routers. It seems that thttpd was modified by Alphanetworks who inserted the backdoor. Unfortunately, vulnerable routers can be easily identified by services like shodanHQ. At least these models may have vulnerable firmware: DIR-100, DI-524, DI-524UP, DI-604S, DI-604UP, DI-604+, TM-G5240."
Are these people too stupid to know that eventually, somebody _will_ analyze their firmware and find this? I think it is time to make them liable for a bit more than the device when things like these get found. Say, 10x the new value of the device to any customer that wants to give it back.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Can the manufacturer be made liable for damages? Not sure what the are smoking there...
That the consumer is always so proactive with updates that they'll upgrade their router the instant a fix is released.......NOT.
NotSurprisingAnymore
And the post points out (in 2010) that if you reverse the string it was "edit by 04882 Joel Backdoor" so it was clearly a backdoor.
The big scandal here is how can a backdoor be known since 2010 and not revealed??!!!
Read backwards it reads the same as the comment subject. Is this the guy behind it? http://www.joesdata.com/executive/Joel_Liu_421313008.html Assuming good will, it seems like debugging code left in the final firmware release.
Yay.
I'm always amazed to read about things like this because most engineers are not morons. Why would they do it? How could they not know it would be discovered?
The Black Hats have probably known about this for a long time...
If you want news from today, you have to come back tomorrow.
PDF link, published earlier this year, shows how many manufacturers use a stack with a UPnP vuln that gives root, even from the WAN side:
http://www.defensecode.com/public/DefenseCode_Broadcom_Security_Advisory.pdf
Point is, you probably weren't as safe as you thought you were, even before this new disclosure.
I think a huge problem with consumer-grade wifi routers today is that as manufacturers race to support new models with new wifi standards and new competitive feature sets, older models quickly become abandonware. There's very little guarantee around firmware updates for critical vulnerabilities, and end users are mostly oblivious to being at risk. By the time you pick up that $80 model from the store it's probably borderline EOL already.
How to bury your company's reputation with one password.
The Beatings Will Continue... Until the Firmware Improves.
Because friends don't let friends run crappy firmware with back doors/known problems.
http://www.linuxpromagazine.com/Issues/2010/119/Security-Lessons-Linux-WAP/(tagID)/337
1. ``i am not secure, but i want to be.''
2. ``ignorance will not make me more secure''
3. ``no product available will make me completely secure''
4. ``if i cannot understand the entirety of my system, i can make no claims to it's security''
5. ``just because knowledge is denied, does not mean that knowledge is protected.''
6. ``i am not secure, but i want to be.''
Not because I'm not using one of the models listed, but because mine shits itself when you actually try to get it to do something. But yeah, if you get a wireless router, definitely install one of the open source firmwares for it.
Just goes to show that unless you read the code yourself or reverse engineer it yourself, you just cant be sure whats there. Now they found one. Waiting more news in other manufacturer and models in 3... 2... 1...
Heay!
That's the combination on my luggage!
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
At least the DIR-655 isn't part of this. I started getting worried for moment... I have and like that little router... It also sounds like this isn't a problem as long as remote management isn't turned on... (which is kinda a dumb idea anyway unless you really need to remotely change your router settings). The DIR-655 is a good router other than that, but unfortunately isn't compatible with DD-WRT or some of the open source firmware out there. Wish it was, but the last time I checked, these firmware releases were not available for the 655.
There is a systemic complete and total regard for basic tenets of security in nearly the entire home router/cpe market.
Start with crypto - no hwrng and a known "less than ideal" version of /dev/random to feed your "secure" wpa and ssh sessions.
Worse:
There is no privilege separation in most routers, which was ok when they were single function devices - BUT: not ok, when vulnerability via services like samba can be used to root most of the top 10 current home routers:
http://securityevaluators.com/content/case-studies/routers/soho_service_hacks.jsp
Once an attacker p0wns your home gateway they can change your dns to malicious sites, as dnschanger did:
http://www.dcwg.org/
or have it participate in botnets, or inflict further attacks on unsuspecting devices both inside and outside your firewall, or sniff your traffic - there is no security when your front door is left wide open.
What nearly every home router and cpe manufacturer is shipping is **rotware**, running 4-7 year old kernels with known CVEs, and 10 year old versions of critical services like dnsmasq. You'd think that new 802.11ac devices available for this christmas might have some modern software on it, but just to pick out a recent example - the "new" netgear nighthawk router runs Linux 2.6.36.4 and dnsmasq 2.15, according to their R7000 gpl code drop -
http://kb.netgear.com/app/answers/detail/a_id/2649
Brand new hardware - 4+ and 10 year old software respectively.
It's unfair of me to pick on Netgear, every router I've looked at this christmas season has some major issues.
Right now, the only current hope for decent security in home routers is in open, modern, and maintained firmware. And I wish the manufacturers (and ISPs, AND users, and governments) understood that, and there was (in particular) a sustainable model for continuous updates and upgrades as effective as android's in this market. I don't care if it came from taxation, isp fees, or built into the price of the device - would you willingly leave your networks' front door open if you understood the consequences?
Rotten routers with closed source code, and no maintenance, are a huge security risk, and they are holding back the ipv6 transition, (and nearly all current models have bufferbloat, besides)
How can the dysfunctional edge of the Internet be fixed?
Found thuis out about my stock wrt54g a while ago:
http://www.securityfocus.com/archive/1/442452/30/0/threaded
You don't even need any special password/user-agent/... If you know the setting you want to change, it's only a simple post request and you are done.
This is NOT a small, obscure problem for users of DLINK routers. Although it does not open up Wifi access or anything like that, having access to the configuration panel of your router is bad news even from inside the network. I can't think of anyway to automatically exploit it via a browser (XSS-style) but a small executable (or trusted Java applet, for instance) could do it.
Additionally, I wonder how many small establishments are offering free wifi using DLINK equipment. Those networks are now vulnerable.
If I was a bad(er) guy, the first thing I would change would be the DNS settings. Forcing all computers behind the router to use a DNS I control opens up all sorts of interesting ways to mess with people.
sheep.horse - does not contain information on sheep or horses.
My home DSL (Billion) does DNS lookup *extremely* slowly. Often timing out.
I noticed also that Yandex (the email service I switched to when I abandoned US email), has a different certificate. It had a Yandex Extrernal CA one, then a Global Trust one.
So your post explains a lot. I'll contact my ISP.
Read it and weep:
http://www.washingtonpost.com/world/national-security/us-spy-agencies-mounted-231-offensive-cyber-operations-in-2011-documents-show/2013/08/30/d090a6ae-119e-11e3-b4cb-fd7ce041d814_story_1.html
"Much more often, an implant is coded entirely in software by an NSA group called Tailored Access Operations (TAO). As its name suggests, TAO builds attack tools that are custom-fitted to their targets. "
"Tailored Access Operations has software templates to break into common brands and models of “routers, switches and firewalls from multiple product vendor lines,” according to one document describing its work."
So on the one hand they're supposed to defend US networks from attack, while on the other hand they have detailed knowledge of these backdoors and use them for their own use while keeping them secret.
So yes, the NSA did have a hand in it, at the minimum it kept it secret while exploiting it.
Or they put it there in the first place...
How will that help the "cyber infrastructure" if they put in backdoors exploitable by anyone...?
In most of the companies that do such gear, the chap(s) in charge of actually developing and making them are treated as disposable cost factors. Who are under constant threat of being outsourced to some third world country. And the products they develop are basically abandoned once the next release hits the shelves, otherwise the incentives to buy new stuff would not be as high.
All the while the Cxx who "supervise" them (and who in a lot of cases couldn't even configure the products the company makes, let alone really care) walk away with more or less obscene bonuses. You know, just to show the little guys who is boss, and so.
Not a big surprise, then, that the developers apparently don't put their entire energy in making the best possible product. Would you, in their stead?
And make sure you end this company's existence.
D-Link should update their firmware: Joel left the company a long time ago. And you should never hard-code usernames in a firmware, only group names. This is basic stuff.
As a software engineer who has worked on some larger projects, I can tell you that you are in fantasy land if you think that every line of code can be vetted without spending a small fortune on code review. Those costs might be justifiable for a project like a space shuttle guidance system, where the cost of failure is billions of dollars and multiple lives, but nobody is going to shell out that kind of budget for a sub $100 consumer router.
HA! I just wasted some of your bandwidth with a frivolous sig!
Why do all these router vendors even bother producing their own nonstandard firmware?
Most of the hardware is based around a small set of common chipsets anyway, so why not use an existing firmware such as dd-wrt or openwrt.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
It seems like they have about as many remote vulnerabilities as your run-of-the-mill Windows installation.
Maybe we should follow the same advice as is given to protect Windows from remote attackers: don't connect it directly to the Internet; put it behind a hardware firewall, opening only the ports you need. Like http port 80.
Oh, wait...
does belkin router have same issues...
I have no problem with information being freely disseminated, but it's sickening to see a front page story that doesn't require the slightest shred of attention or interest before it begins shedding the exact specifics of vulnerabilities that still apply to real people. Congratulations, Slashdot, you're worse than Kotaku. Because while they may post inflammatory and nonsensical bile to get their views, you're happily and wholeheartedly fucking people with these routers by not only publicizing these vulnerabilities, but making them front-page, expanded news.
Apple's AirPort line of routers is one of the few consumer grade families of network gear that are not abandonware -- updates are provided fairly regularly. I believe that under the covers they're running VxWorks with a custom IP stack from Apple. As far as I know, there are no back-doors or security problems with them. (I would not be at all surprised to find out that the NSA has infiltrated one -- they are designed and the firware is written in the USA.) I've been using them for years -- they're very reliable -- never need to be rebooted, and they perform well. Yes, they cost a little more, but then it looks like you get what you pay for. -- Ian.
Ian Ameline
Many folks are installing pfSense etc on thin clients (plentiful on Ebay and dirt cheap). Choose whatever distro you like then have at it. Rolling your own goes back to floppy-based Linux routers and is old news.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
The Beatings Will Continue... Until the Firmware Improves.
Who owns D-Link ?
Cisco.
That answers your question.
Remember to throw away all 4 dlinks at the office.
Minor nitpick - you're thoroughly mistaken. The National Council of Examiners for Engineering and Surveying has standards for certifying software engineers just like any other branch of engineering.
"The term engineer is reserved for disciplines requiring strict standards and provable output"
Perhaps you're unaware that software can be much more provable than concrete or steel. Dlink could have had strict standards that would have prevented this problem. Few developers employ engineering methods properly, and few developers create software that is known to be reliable.
Most people building software are not engineers, just as most people building houses are not engineers and most people building machines are not engineers. Go back to your Engineering 101 book and look up the definition of "engineering". It's 100% applicable to the design of software systems. People simply fail to apply it where they should, in many cases.
The fact that I can build a shed without an engineering degree doesn't mean civil engineering doesn't exist, and simple software doesn't mean there's no such thing as properly engineered software systems.
I checked DIR-605L firmware 1.12; seems NOT to have this particular backdoor. Not trying to bruteforce different useragents though.
These guys are already scanning the entire internet to find these boxes. I've seen numerous requests across geographies originating from their IP address.
https://ip.robtex.com/209.126.230.72.html#whois
... to not put any software or firmware on it at all. That way people just hire the kid down the street to load free software on it (or do it yourself).
now we need to go OSS in diesel cars
The wireless function on my DI-542 died a couple years ago. Maybe it was the NSA trying to upgrade the firmware...
I can't really believe anyone is still running those things.
I have a DI-524 (old, never updated).
Tried with a direct about:config line (must be created) in FF... didn't work. Tried with User Agent Switcher extension... didn't work.
In all occasions, access to the router is challenged with a user/password dialogue. Maybe it would have worked with the default (empty, AFAIR) password.
Just for the record, I use WPA2.
if someone made a virus that automatically flashes vulnerable router firmware with DD-WRT with tor turned on.
It's even easier to verify. You don't need to write your own program, though that would be fun. You can use curl or wget. Both support using custom User-Agent strings. One or the other will come pre-installed by default on your system, unless it is that Other OS.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.