Slashdot Mirror
Backdoor Discovered In Netgear and Linkys Routers
An anonymous reader writes "A hacker has found a backdoor in the Linksys WAG200G router, that gives access to the admin panel without authentication. Further research shows that these devices are made by Sercomm, meaning that Cisco, Watchguard, Belkin and various others maybe affected as well. From the article: 'The backdoor requires that the attacker be on the local network, so this isn’t something that could be used to remotely attack DSL users. However, it could be used to commandeer a wireless access point and allow an attacker to get unfettered access to local network resources.'"
http://www.shodanhq.com/search?q=port%3A32764
Thank goodness for OpenBSD and a bit of elbow grease.
Trolling is a art,
Glad I have a Zoom router. I don't trust those other brands, they haven't been in the business long enough.
Attacking the router from inside the network is only a matter of infecting a computer inside the network.
Then the compromised computer is used to modify the DNS settings.
Then the whole network depending on the router to provide proper DNS is now visiting whatever hosts the attackers desire.
$5 / month hosted VPS on linux = awesome!
Oh wait, if anyone edited this shit instead of piling more images and whatever else Dice's marketing team deems "awesome and revolutionary to leverage for Slashdot," this might be a reputable god-damned tech news site anymore.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
(insert expected comment about how Slashdot editors... don't).
It is LinkSys, not Linkys.
Although "Linky" seems almost appropriate, considering that's what routers do!
"Linkys". because details are for samzenpussies.
this is getting annoying enough.
Rich
in my country prosecutors wiretapps almost 2.000.000 peoples per year. it's good to know that they also have easy access to our networks :)
Get a refund. This shit must cost them or it will never stop.
I only use OpenWRT.
Until someone figures out a way to find out NSA BIOS tampering and I just chuck out all my networking gear.
"Linksys (...) devices are made by Sercomm, meaning that Cisco, Watchguard, Belkin (...)"
It reminds me that scary graph where half a dozen companies control almost all the stuff you see on supermarket shelves.
I remember reading nice fairy tales in school about open markets, and fair and diverse competition being paramount to the western economic model...
Who has that anymore?
Poor people, the type who can afford only Android devices.
Trolling is a art,
Who has that anymore?
People that don't want to give any money to a cable company and want to give as little money as possible to the AT&T monopoly, and would rather have their money go to a friendly CLEC. I gave up my 50mbit Comcast cable internet connection for a 14mbit DSL connection because several times a week, packet loss would go through the roof and throughput would slow to a crawl on the Comcast connection, while the DSL provider has been rock solid.
I did a web search for "linksys router backdoor" and this story was one of the top results:
http://news.techworld.com/security/1682/critical-flaws-in-linksys-and-netgear-kit/
"...a hard-wired user account with a known password. Any user with access to a LAN with an affected WG602 device connected to it would be able to gain full administrator access to the device..."
You can telnet into most Huawei/Vodafone DSL modems with admin/{VF-}[Countrycode]hg[ModelId] through the ethernet port...
Their backdoors are implemented at much higher quality level.
AntiFA: An abbreviation for Anti First Amendment.
There is a supported feature on Netgear routers where so long as you're on the internal network you can send a magic packet (using a utility called TelnetEnable) to open up the telnet port, then you can telnet in and issue commands as the super user. All TelnetEnable needs is the IP address of the router, it's MAC address, and a widely known default username and password - all things anyone connected to the network can get easily.
It seems like this guy stumbled upon a similar feature.
Yes, this stuff should be better protected, but it's not necessarily a vulnerability. For example, you can log into your router this way and use iptables to add some custom firewall rules that the web admin interface doesn't support. The main hole here is A) Most people don't know it's even there, and B) The default username/password is the same for every router by default. You do need to be on the LAN side to send the magic packet in the first place.
With or without Dell. My bet is on the former.
While it's not a very big issue, it's a start... and all good things start with simple steps ...
given it's been going on for a while, now the ball is rolling and the public is learning
it's up to someone smarter than me to figure out how to get these little back doors
more into the public eye.
if you see me, smile and say hello.
Doing that just hurts the retailer; they won't be able to return the units to the vendor or manufacturer as their sales contract (they're not protected by the law in the same way end users are) will limit the criteria returns for credit are available under.
On top of that, the retailers can't generally refuse to do business with the vendor as end users expect to see certain brands on the shelves. Don't stock Cisco? Netgear? People will shop somewhere that does.
That basically leaves the retailer stuck with dead stock and a big bill through no fault of their own. If you deal with the vendor or manufacturer directly then you can force some change, but you need to be a pretty big business to be able to get their attention. Smaller shops are just rounding errors in the big picture.
You mean like how any web page with javascript? It's not that difficult to get $ethX and get the gateway, which will probably be the router. Ooops, it's now fully available to the attacker on the outside world.
There an interesting video the other day http://boingboing.net/2013/12/31/jacob-appelbaums-must-watch.html I believe he mentions the NSA and hacking wireless routers, perhaps they created it.
additional several router models are susceptible to a hack so easy it's ridiculous, namely adding a certain user agent string to your browser lets you in.
I personally don't use wireless at home any longer,
"If any question why we died, Tell them because our fathers lied."
back doors sre built into every thing.
period, end of text.
regards,
mike
So much for "business class" routers/firewalls, and it wasn't on the list.
I've got a couple of old computers around. Time, again, to build my own. Another plus is that local DHCP addrersses will show up in DNS.
Also, even with fibre to the curb/cabinet, which I've had in both Finland and the UK, both involve DSL modems for the final copper link. In Finland, it was an off-the-shelf VDSL2 device, but in the UK I use BT, and I didn't pay enough attention.
Also, the older ADSL modems are widely used in China still - though I think Metropolitan Area Networks are becoming more popular undoubtedly involving local fibre connections (I had a symmetric 10BaseT connection in my flat when I lived here ~10 years ago and it only cost 99rmb/month).
Max.
> Or does such a thing already exist?
The wrt54gL (L for Linux) is an example of such a device. The early versions of wrt54g were popular with people using openWRT and such of course. Recognizing this, the company released a version specifically for nerds.
I'd love to see some other, more up-to-date options. I have some projects that would fit nicely in several MBs of RAM, without necessarily needing all the ports. A Raspberry Pi would work, but a beefed up WRT would be better.
Dear lord, I hate it when neckbeards such as yourself talk about how a full PC running OpenBSD or Linux is somehow the "cheap" option compared to a goddamn $40 home router. You make the entire IT profession seem like a bunch of blithering idiots.
Most civilized people don't have Alphas, SPARCs or even old PCs lying around. They'll end up paying more than $40 to acquire such a system, too.
Since most people have several devices on their home network these days, including wireless devices, they'll again need to buy several cabled network cards and at least one wireless network card. You're looking at $100 or more, depending on the type and number of network cards you need to buy.
Then they'll have to waste time setting up this system. If they don't already have experience with installing and configuring OpenBSD and Linux, they'll waste even more time. Good luck getting the wireless network card working! That can be a real battle under Linux, and absolute hell under OpenBSD, even for experienced sysadmins. Anyone with a real job paying a real salary or billing rate will be out hundreds of dollars.
If they manage to get this far, probably spending several hundred dollars getting the equipment in the first place, and then potentially spending at least a day (but likely far more) setting it up, then they'll have to actually start using it. This involves leaving a full computer running 24/7, likely consuming a large amount of power (especially if it's the outdated workstation or PCs that you're advocating). Electricity is quite expensive in many areas.
Way to go, neckbeard. Your "cheap" option only costs $600 or more, just to do the same job that a $40 home router can do. And that's ignoring the ongoing cost of running the system, which depending on local electricity rates can cost a few hundred dollars more per year. The $40 home router will consume a comparatively insignificant amount of electricity, likely costing less than $10 a year even in areas with extremely high electricity prices.
It's so hard to take you seriously when you advocate spending 10 or 20 times as much on some custom Linux or OpenBSD router than it'd cost to buy a cheap home router.
Any old/small PC will use way more electricity than the small embedded box you are replacing. Even if you get the PC for free, you'd have spent more on extra electricity in a year than you would have paid for a new device that was ready to run and has no back doors.
I was promised a flying car. Where is my flying car?
These back doors may exist in new devices, but any older device is likely to have a back door. If the vendor updates the devices at all, they usually stop doing that shortly after they stop sales of the device. Your perfectly fine WiFi router or DSL box will most likely have vulnerabilities on it that make it just as insecure as these new devices.
I actively check my DSL router and I know my ISP and several security minded customers do the same. Any WiFi router in my home runs a modified Linux distribution like Tomato, openWRT or DD-WRT that is actively maintained. While it's bad that A-brand companies evidently don't do this this the stuff they buy from other vendors, most devices in the field are just as vulnerable as these boxes are, simply because they don't get updates.
Burning vendors for selling insecure devices is good practice to get this problem solved. Burning them for not being responsible for their sale and updating or liberating the devices they sold should be just as normal as burning them for new equipment. You can't expect people to buy a new device every year simply because the vendor refuses responsibility once it's left their factory.
I was promised a flying car. Where is my flying car?
"The product does something by design which I, the purchaser, was not made sufficiently aware of at time of purchase. Had I known that this product was designed to operate in this way I would not have purchased it. The vendor made no effort to advise purchasers of this functionality, which adversely affects users of the product."
In the free world the media isn't government run; the government is media run.
Sonic is a fine provider but it is not have the reach Comcast does. Comcast business is the answer. Unlike their consumer services, the business basic connection has an SLA and a CIR (no bandwidth caps), and you call a different support center with people that actually know what they are talking about.
I never said cheapest. If you are interested in setting up a home network, securely. For less than $200, you can have a soekris box (http://soekris.com/products/net4501-1.html) and you're good to go. If you need extra ports, you can always get a switch.
Also, there is a cost to learning, and that is time and effort. If you are not willing to take the time and spend the effort to do things securely and you come to slashdot bitching about it, perhaps you do deserve to get pwned.
So now you've gone from advocating "pentium-2 class machines or smaller" to a $200 486?!
I'm sure an OpenBSD router is great and all, but there's got to be a cheaper way to do it. At least suggest some little $50 ARM computer or a mini-ITX PC with a low-wattage CPU or something!
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Sure. Why not.
Backdoors and more... I recently purchased a LinkSys and could not access the web interface unless a Windows machine was present on my network. I verified this my starting a Windows VM on the linux host where I was running my web browser. With the Windows VM running, my web browser (linux) could access the LinkSys. Without the Windows VM running, my web browser (linux) could NOT access the LinkSys. Once I got DD-WRT installed, problem fixed.
Step 1 - replace the junk firmware with DD-WRT, OpenWRT, etc.
Step 2 - laugh at the people who get their wifi pwned
Linksys has had far to many "backdoors" for them to trust their products anymore.
"Well I would move, but that would wreak my uptime..."
Seems like it would have been easier to grab an ethernet cord and plug into the router rather than do a port scan and reverse engineer the firmware....
Cable universally has bufferbloat problems. Only decent cure is a router with fq_codel qos.
I hear ya. Personally, I don't do anything that doesn't make me money. I mean, I earn X dollars an hour at work so anything that I do has to be saleable for at least that amount. I used to have hobbies and I used to learn about stuff just for the pleasure of learning. It was all so useless! It didn't make me no money. Hanging around and doing stuff with my family doesn't pay the bills either so that had to go, too.
Lighten up Francis. A lot of the people reading this have old computers kicking around that are too slow to do what they want on their main box. Just repurpose one of these and the cost to you is functionally ZERO.
the major advances in civilization are processes which all but wreck the societies in which they occur - A.N. White
Since most people have several devices on their home network these days, including wireless devices, they'll again need to buy several cabled network cards and at least one wireless network card. You're looking at $100 or more, depending on the type and number of network cards you need to buy.
er, if it's functioning as a router, they just need one interface per network, not one per device as you seem to be implying. Though since most home routers bundle a router and switch (and sometimes modem) into a single package, the confusion is understandable. If additional ports are needed (e.g. for multiple wired devices), then a standard desktop switch can be used to provide them.
http://www.rakuten.com/prod/pogoplug-mobile-wireless-backup-access-share-your-pc-mac-tablet/223435914.html?listingId=206407980
There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
duh, everyone knows people don't even change the default password
Who has that anymore?
People that don't want to give any money to a cable company and want to give as little money as possible to the AT&T monopoly, and would rather have their money go to a friendly CLEC. I gave up my 50mbit Comcast cable internet connection for a 14mbit DSL connection because several times a week, packet loss would go through the roof and throughput would slow to a crawl on the Comcast connection, while the DSL provider has been rock solid.
Yeah, there's no way I'd give any money to the local cable companies in my area. I have 6mbps DSL through a CLEC and it's great. Unlike what I've seen on my friends cable connection, there's no traffic shaping or blocking of common ports. Last time I read the contract it basically said I could do whatever I want with the connection as far as running servers is concerned, this in contrast to the cable company (and also AT'Ts high speed option) that explicitly disallows things such as hosting web or gameservers, and will play whack-a-mole with your ports if they notice.
Where you spend most time w/ MORE reliability vs. redirected or downed DNS even since Hosts do more w/ less (1 file) @ a faster level (ring 0) vs redundant browser addons (slowing up slower ring 3 browsers) via filtering 4 the IP stack (coded in C, loads w/ OS, & 1st net resolver queried w\ 45++ yrs.of optimization):
---
APK Hosts File Engine 9.0++ 32/64-bit:
http://start64.com/index.php?option=com_content&view=article&id=5851:apk-hosts-file-engine-64bit-version&catid=26:64bit-security-software&Itemid=74
(Details of hosts' benefits enumerated in link)
Summary:
---
A. ) Hosts do more than AdBlock ("souled-out" 2 Google/Crippled by default) + Ghostery (Advertiser owned) - "Fox guards henhouse", or Request Policy -> http://yro.slashdot.org/comments.pl?sid=4127345&cid=44701775
B. ) Hosts add reliability vs. downed or redirected DNS + secure vs. known malicious domains too -> http://tech.slashdot.org/comments.pl?sid=3985079&cid=44310431 w/ less added "moving parts" complexity + room 4 breakdown,
C. ) Hosts files yield more speed (blocks ads & hardcodes fav sites - faster than remote DNS), security (vs. malicious domains serving mal-content + block spam/phish), reliability (vs. downed or Kaminsky redirect vulnerable DNS, 99% = unpatched vs. it & worst @ ISP level + weak vs FastFlux + DynDNS botnets), & anonymity (vs. dns request logs + DNSBL's).
---
* Addons are more complex + slowup browsers in message passing (use a few concurrently - you'll see) Addons slowdown SLOWER usermode browsers layering on MORE: I work w/ what you have in kernelmode, via hosts ( A tightly integrated PART of the IP stack itself )
APK
P.S.=> Hosts can also "seal in" malware already inside you vs. communicating back to its C&C servers (vs. what YOU yourself noted, nullifying them, as well as working to bypass DNS faults itself shown above - & even a DNS server on the SAME MACHINE has to obey it locally since it's part of the IP stack itself)...
... apk
"Backdoor Discovered In Netgear and Linkys Routers"
Obviously the backdoor was in the missing S
-- 29A the number of the Beast
Where you spend most time w/ MORE reliability vs. redirected or downed DNS even since Hosts do more w/ less (1 file) @ a faster level (ring 0) vs redundant browser addons (slowing up slower ring 3 browsers) via filtering 4 the IP stack (coded in C, loads w/ OS, & 1st net resolver queried w\ 45++ yrs.of optimization):
---
APK Hosts File Engine 9.0++ 32/64-bit:
http://start64.com/index.php?option=com_content&view=article&id=5851:apk-hosts-file-engine-64bit-version&catid=26:64bit-security-software&Itemid=74
(Details of hosts' benefits enumerated in link)
Summary:
---
A. ) Hosts do more than AdBlock ("souled-out" 2 Google/Crippled by default) + Ghostery (Advertiser owned) - "Fox guards henhouse", or Request Policy -> http://yro.slashdot.org/comments.pl?sid=4127345&cid=44701775
B. ) Hosts add reliability vs. downed or redirected DNS + secure vs. known malicious domains too -> http://tech.slashdot.org/comments.pl?sid=3985079&cid=44310431 w/ less added "moving parts" complexity + room 4 breakdown,
C. ) Hosts files yield more speed (blocks ads & hardcodes fav sites - faster than remote DNS), security (vs. malicious domains serving mal-content + block spam/phish), reliability (vs. downed or Kaminsky redirect vulnerable DNS, 99% = unpatched vs. it & worst @ ISP level + weak vs FastFlux + DynDNS botnets), & anonymity (vs. dns request logs + DNSBL's).
---
* Addons are more complex + slowup browsers in message passing (use a few concurrently - you'll see) - Addons slowdown SLOWER usermode browsers layering on MORE: I work w/ what you have in kernelmode, via hosts ( A tightly integrated PART of the IP stack itself )
APK
P.S.=> Hosts can "seal in"/trap malware already inside you vs. communicating back to its C&C servers (vs. what YOU yourself noted, effectively nullifying them, & bypassing DNS faults as shown above - & even a DNS server on the SAME MACHINE has to obey it locally since hosts = part of the IP stack itself)...
... apk
By the way, as to WatchGuard being included in this description... WatchGuard devices are in NO way susceptible to this backdoor. Though we have some older hardware that uses Sercomm hardware, we NEVER used their firmware. We run our own firmware on all our devices, and it does not have this backdoor. If you have our products, you are welcome to test yourself by nmapping your local and wireless interfaces. You will not find port 32764 or any service like the one described.