Slashdot Mirror
D-Link Router Backdoor Vulnerability Allows Full Access To Settings
StealthHunter writes "It turned out that just by setting a browsers user-agent to 'xmlset_roodkcableoj28840ybtide' anyone can remotely bypass all authentication on D-Link routers. It seems that thttpd was modified by Alphanetworks who inserted the backdoor. Unfortunately, vulnerable routers can be easily identified by services like shodanHQ. At least these models may have vulnerable firmware: DIR-100, DI-524, DI-524UP, DI-604S, DI-604UP, DI-604+, TM-G5240."
Are these people too stupid to know that eventually, somebody _will_ analyze their firmware and find this? I think it is time to make them liable for a bit more than the device when things like these get found. Say, 10x the new value of the device to any customer that wants to give it back.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
That the consumer is always so proactive with updates that they'll upgrade their router the instant a fix is released.......NOT.
"A quick Google for the “xmlset_roodkcableoj28840ybtide” string turns up only a single Russian forum post from a few years ago, which notes that this is an “interesting line” inside the /bin/webs binary. I’d have to agree."
Even if they do, it sounds like they'll be almost four years late.
And the post points out (in 2010) that if you reverse the string it was "edit by 04882 Joel Backdoor" so it was clearly a backdoor.
The big scandal here is how can a backdoor be known since 2010 and not revealed??!!!
Read backwards it reads the same as the comment subject. Is this the guy behind it? http://www.joesdata.com/executive/Joel_Liu_421313008.html Assuming good will, it seems like debugging code left in the final firmware release.
PDF link, published earlier this year, shows how many manufacturers use a stack with a UPnP vuln that gives root, even from the WAN side:
http://www.defensecode.com/public/DefenseCode_Broadcom_Security_Advisory.pdf
Point is, you probably weren't as safe as you thought you were, even before this new disclosure.
I think a huge problem with consumer-grade wifi routers today is that as manufacturers race to support new models with new wifi standards and new competitive feature sets, older models quickly become abandonware. There's very little guarantee around firmware updates for critical vulnerabilities, and end users are mostly oblivious to being at risk. By the time you pick up that $80 model from the store it's probably borderline EOL already.
The Beatings Will Continue... Until the Firmware Improves.
Because friends don't let friends run crappy firmware with back doors/known problems.
http://www.linuxpromagazine.com/Issues/2010/119/Security-Lessons-Linux-WAP/(tagID)/337
Heay!
That's the combination on my luggage!
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
There is a systemic complete and total regard for basic tenets of security in nearly the entire home router/cpe market.
Start with crypto - no hwrng and a known "less than ideal" version of /dev/random to feed your "secure" wpa and ssh sessions.
Worse:
There is no privilege separation in most routers, which was ok when they were single function devices - BUT: not ok, when vulnerability via services like samba can be used to root most of the top 10 current home routers:
http://securityevaluators.com/content/case-studies/routers/soho_service_hacks.jsp
Once an attacker p0wns your home gateway they can change your dns to malicious sites, as dnschanger did:
http://www.dcwg.org/
or have it participate in botnets, or inflict further attacks on unsuspecting devices both inside and outside your firewall, or sniff your traffic - there is no security when your front door is left wide open.
What nearly every home router and cpe manufacturer is shipping is **rotware**, running 4-7 year old kernels with known CVEs, and 10 year old versions of critical services like dnsmasq. You'd think that new 802.11ac devices available for this christmas might have some modern software on it, but just to pick out a recent example - the "new" netgear nighthawk router runs Linux 2.6.36.4 and dnsmasq 2.15, according to their R7000 gpl code drop -
http://kb.netgear.com/app/answers/detail/a_id/2649
Brand new hardware - 4+ and 10 year old software respectively.
It's unfair of me to pick on Netgear, every router I've looked at this christmas season has some major issues.
Right now, the only current hope for decent security in home routers is in open, modern, and maintained firmware. And I wish the manufacturers (and ISPs, AND users, and governments) understood that, and there was (in particular) a sustainable model for continuous updates and upgrades as effective as android's in this market. I don't care if it came from taxation, isp fees, or built into the price of the device - would you willingly leave your networks' front door open if you understood the consequences?
Rotten routers with closed source code, and no maintenance, are a huge security risk, and they are holding back the ipv6 transition, (and nearly all current models have bufferbloat, besides)
How can the dysfunctional edge of the Internet be fixed?
Apparently IE might let you change the user agent
http://stackoverflow.com/questions/6995311/how-can-i-spoof-the-user-agent-of-a-javascript-get-request
You'd just need to work in some cross domain exploit somehow... or have a subdomain of your website resolve to 192.168.1.1
Read it and weep:
http://www.washingtonpost.com/world/national-security/us-spy-agencies-mounted-231-offensive-cyber-operations-in-2011-documents-show/2013/08/30/d090a6ae-119e-11e3-b4cb-fd7ce041d814_story_1.html
"Much more often, an implant is coded entirely in software by an NSA group called Tailored Access Operations (TAO). As its name suggests, TAO builds attack tools that are custom-fitted to their targets. "
"Tailored Access Operations has software templates to break into common brands and models of “routers, switches and firewalls from multiple product vendor lines,” according to one document describing its work."
So on the one hand they're supposed to defend US networks from attack, while on the other hand they have detailed knowledge of these backdoors and use them for their own use while keeping them secret.
So yes, the NSA did have a hand in it, at the minimum it kept it secret while exploiting it.
Certainly, DNS would be a pretty quick way to abuse all devices on the other side of the router. It might be detected when the owner verifies the settings themselves or watches their own network traffic and observes the DNS lookups hitting the wrong destination. It's likely that this would have set off red flags before now. Many anti-malware packages check for DNS redirections, for example.
Being able to manipulate the router's config interface would allow an external entity the ability to upload a new firmware to the router. The new firmware would offer the attacker switches to flip at will that would enable packet sniffing of all traffic and man-in-the-middle SSL attacks. Organized crime / NSA (redundant to mention both, I know) seek no deeper capabilities than this.
You bring up a great point of smaller establishments running WiFi on D-Link equipment. Perhaps their SSID's should be modified to read, "HACKED BY NSA - DO NOT USE!"
$5 / month hosted VPS on linux = awesome!
That only applies if you think of the firmware as being worth the sale of only one router. The models listed are all consumer grade, but I'm willing to bet that because they're cheap they're also popular. Your $100 router all of a sudden is $10m in sales if 100k are sold, across those six (so far identified ) ranges. Not so hard to imagine? Now think of those who work from home over networks served by that hardware, or the SMB with only a couple of clients on the network and no need for professional switching equipment. Now it's business loss to consider, even if only downtime to fix the breach is the only loss experienced.
I can easily see something like this having the potential to cause losses not dissimilar to your "shuttle crash" scenario. It's "keys to the kingdom" external access to what should be a private network.
Finally, there's no chance in hell of even 1% of these devices receiving a firmware update. Nobody (outside of us) upgrades the firmware on their home router; They run it from factory until death, then buy another one. These devices will be vulnerable for the foreseeable future.
Finally had enough. Come see us over at https://soylentnews.org/
Remind me never to pick you as a team-mate for Trivial Pursuit.