Slashdot Mirror
Backdoor Discovered In Netgear and Linkys Routers
An anonymous reader writes "A hacker has found a backdoor in the Linksys WAG200G router, that gives access to the admin panel without authentication. Further research shows that these devices are made by Sercomm, meaning that Cisco, Watchguard, Belkin and various others maybe affected as well. From the article: 'The backdoor requires that the attacker be on the local network, so this isn’t something that could be used to remotely attack DSL users. However, it could be used to commandeer a wireless access point and allow an attacker to get unfettered access to local network resources.'"
http://www.shodanhq.com/search?q=port%3A32764
Thank goodness for OpenBSD and a bit of elbow grease.
Trolling is a art,
Attacking the router from inside the network is only a matter of infecting a computer inside the network.
Then the compromised computer is used to modify the DNS settings.
Then the whole network depending on the router to provide proper DNS is now visiting whatever hosts the attackers desire.
$5 / month hosted VPS on linux = awesome!
Oh wait, if anyone edited this shit instead of piling more images and whatever else Dice's marketing team deems "awesome and revolutionary to leverage for Slashdot," this might be a reputable god-damned tech news site anymore.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
(insert expected comment about how Slashdot editors... don't).
It is LinkSys, not Linkys.
Although "Linky" seems almost appropriate, considering that's what routers do!
"Linkys". because details are for samzenpussies.
this is getting annoying enough.
Rich
Get a refund. This shit must cost them or it will never stop.
"Linksys (...) devices are made by Sercomm, meaning that Cisco, Watchguard, Belkin (...)"
It reminds me that scary graph where half a dozen companies control almost all the stuff you see on supermarket shelves.
I remember reading nice fairy tales in school about open markets, and fair and diverse competition being paramount to the western economic model...
Who has that anymore?
People that don't want to give any money to a cable company and want to give as little money as possible to the AT&T monopoly, and would rather have their money go to a friendly CLEC. I gave up my 50mbit Comcast cable internet connection for a 14mbit DSL connection because several times a week, packet loss would go through the roof and throughput would slow to a crawl on the Comcast connection, while the DSL provider has been rock solid.
I did a web search for "linksys router backdoor" and this story was one of the top results:
http://news.techworld.com/security/1682/critical-flaws-in-linksys-and-netgear-kit/
"...a hard-wired user account with a known password. Any user with access to a LAN with an affected WG602 device connected to it would be able to gain full administrator access to the device..."
You can telnet into most Huawei/Vodafone DSL modems with admin/{VF-}[Countrycode]hg[ModelId] through the ethernet port...
Their backdoors are implemented at much higher quality level.
AntiFA: An abbreviation for Anti First Amendment.
There is a supported feature on Netgear routers where so long as you're on the internal network you can send a magic packet (using a utility called TelnetEnable) to open up the telnet port, then you can telnet in and issue commands as the super user. All TelnetEnable needs is the IP address of the router, it's MAC address, and a widely known default username and password - all things anyone connected to the network can get easily.
It seems like this guy stumbled upon a similar feature.
Yes, this stuff should be better protected, but it's not necessarily a vulnerability. For example, you can log into your router this way and use iptables to add some custom firewall rules that the web admin interface doesn't support. The main hole here is A) Most people don't know it's even there, and B) The default username/password is the same for every router by default. You do need to be on the LAN side to send the magic packet in the first place.
Where, how and who would this help?
You would need to get between then 'house' and the exchange or telco http://en.wikipedia.org/wiki/Digital_loop_carrier
With this method you would be free of any skilled unique ethernet packet logging after the 'modem' in the home network.
The main win for this would be the speed offered locally. While your real packets are still finding that best effort or dedicated loop out of your state, country the "wiretap" has won the networking race.
A cheap version of MINERALIZE and RADON. http://cryptome.org/2014/01/nsa-codenames.htm
Domestic spying is now "Benign Information Gathering"
Uh oh. You may find yourself throwing out more than just that. This was slashdotted not long ago. Just search for "BIOS".
With or without Dell. My bet is on the former.
While it's not a very big issue, it's a start... and all good things start with simple steps ...
given it's been going on for a while, now the ball is rolling and the public is learning
it's up to someone smarter than me to figure out how to get these little back doors
more into the public eye.
if you see me, smile and say hello.
You mean like how any web page with javascript? It's not that difficult to get $ethX and get the gateway, which will probably be the router. Ooops, it's now fully available to the attacker on the outside world.
There an interesting video the other day http://boingboing.net/2013/12/31/jacob-appelbaums-must-watch.html I believe he mentions the NSA and hacking wireless routers, perhaps they created it.
additional several router models are susceptible to a hack so easy it's ridiculous, namely adding a certain user agent string to your browser lets you in.
I personally don't use wireless at home any longer,
"If any question why we died, Tell them because our fathers lied."
So much for "business class" routers/firewalls, and it wasn't on the list.
I've got a couple of old computers around. Time, again, to build my own. Another plus is that local DHCP addrersses will show up in DNS.
Also, even with fibre to the curb/cabinet, which I've had in both Finland and the UK, both involve DSL modems for the final copper link. In Finland, it was an off-the-shelf VDSL2 device, but in the UK I use BT, and I didn't pay enough attention.
Also, the older ADSL modems are widely used in China still - though I think Metropolitan Area Networks are becoming more popular undoubtedly involving local fibre connections (I had a symmetric 10BaseT connection in my flat when I lived here ~10 years ago and it only cost 99rmb/month).
Max.
I still have an external USRobotics Courrier HST Dual Standard. It has the daughterboard upgrade and the 56k flash. Got it on the "SysOp" deal so they attached a metal "not for resale" plate on the top.
Turn in your nerd card with that zoom crap. Next you'll be posting photos of zyxel gear.
> Or does such a thing already exist?
The wrt54gL (L for Linux) is an example of such a device. The early versions of wrt54g were popular with people using openWRT and such of course. Recognizing this, the company released a version specifically for nerds.
I'd love to see some other, more up-to-date options. I have some projects that would fit nicely in several MBs of RAM, without necessarily needing all the ports. A Raspberry Pi would work, but a beefed up WRT would be better.
Real SysOps used roboboards, not your crappy USRevive-its.
Turn YOUR nerd card in with that single-user crap.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
I win! Original Hayes Smartmodem 300. (bulletproof aluminum case and all) [still functional, as far as I know]
Zoom modems were terrible..
Dear lord, I hate it when neckbeards such as yourself talk about how a full PC running OpenBSD or Linux is somehow the "cheap" option compared to a goddamn $40 home router. You make the entire IT profession seem like a bunch of blithering idiots.
Most civilized people don't have Alphas, SPARCs or even old PCs lying around. They'll end up paying more than $40 to acquire such a system, too.
Since most people have several devices on their home network these days, including wireless devices, they'll again need to buy several cabled network cards and at least one wireless network card. You're looking at $100 or more, depending on the type and number of network cards you need to buy.
Then they'll have to waste time setting up this system. If they don't already have experience with installing and configuring OpenBSD and Linux, they'll waste even more time. Good luck getting the wireless network card working! That can be a real battle under Linux, and absolute hell under OpenBSD, even for experienced sysadmins. Anyone with a real job paying a real salary or billing rate will be out hundreds of dollars.
If they manage to get this far, probably spending several hundred dollars getting the equipment in the first place, and then potentially spending at least a day (but likely far more) setting it up, then they'll have to actually start using it. This involves leaving a full computer running 24/7, likely consuming a large amount of power (especially if it's the outdated workstation or PCs that you're advocating). Electricity is quite expensive in many areas.
Way to go, neckbeard. Your "cheap" option only costs $600 or more, just to do the same job that a $40 home router can do. And that's ignoring the ongoing cost of running the system, which depending on local electricity rates can cost a few hundred dollars more per year. The $40 home router will consume a comparatively insignificant amount of electricity, likely costing less than $10 a year even in areas with extremely high electricity prices.
It's so hard to take you seriously when you advocate spending 10 or 20 times as much on some custom Linux or OpenBSD router than it'd cost to buy a cheap home router.
Any old/small PC will use way more electricity than the small embedded box you are replacing. Even if you get the PC for free, you'd have spent more on extra electricity in a year than you would have paid for a new device that was ready to run and has no back doors.
I was promised a flying car. Where is my flying car?
These back doors may exist in new devices, but any older device is likely to have a back door. If the vendor updates the devices at all, they usually stop doing that shortly after they stop sales of the device. Your perfectly fine WiFi router or DSL box will most likely have vulnerabilities on it that make it just as insecure as these new devices.
I actively check my DSL router and I know my ISP and several security minded customers do the same. Any WiFi router in my home runs a modified Linux distribution like Tomato, openWRT or DD-WRT that is actively maintained. While it's bad that A-brand companies evidently don't do this this the stuff they buy from other vendors, most devices in the field are just as vulnerable as these boxes are, simply because they don't get updates.
Burning vendors for selling insecure devices is good practice to get this problem solved. Burning them for not being responsible for their sale and updating or liberating the devices they sold should be just as normal as burning them for new equipment. You can't expect people to buy a new device every year simply because the vendor refuses responsibility once it's left their factory.
I was promised a flying car. Where is my flying car?
"The product does something by design which I, the purchaser, was not made sufficiently aware of at time of purchase. Had I known that this product was designed to operate in this way I would not have purchased it. The vendor made no effort to advise purchasers of this functionality, which adversely affects users of the product."
In the free world the media isn't government run; the government is media run.
I thought that 'RAGEMASTER' was a particularly elegant, if unnerving little toy... Totally passive, delivers the tempest attack from hell when illuminated by a remote RF source. They had some similar mechanisms for tapping keyboards as well. Time to break out the Tinfoil Compute Enclosure, I suppose.
I never said cheapest. If you are interested in setting up a home network, securely. For less than $200, you can have a soekris box (http://soekris.com/products/net4501-1.html) and you're good to go. If you need extra ports, you can always get a switch.
Also, there is a cost to learning, and that is time and effort. If you are not willing to take the time and spend the effort to do things securely and you come to slashdot bitching about it, perhaps you do deserve to get pwned.
So now you've gone from advocating "pentium-2 class machines or smaller" to a $200 486?!
I'm sure an OpenBSD router is great and all, but there's got to be a cheaper way to do it. At least suggest some little $50 ARM computer or a mini-ITX PC with a low-wattage CPU or something!
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Sure. Why not.
Backdoors and more... I recently purchased a LinkSys and could not access the web interface unless a Windows machine was present on my network. I verified this my starting a Windows VM on the linux host where I was running my web browser. With the Windows VM running, my web browser (linux) could access the LinkSys. Without the Windows VM running, my web browser (linux) could NOT access the LinkSys. Once I got DD-WRT installed, problem fixed.
Step 1 - how?
USR's problem was 3Com. And it's too bad your Telebit can't find any other whales to sing to.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
"Well I would move, but that would wreak my uptime..."
Seems like it would have been easier to grab an ethernet cord and plug into the router rather than do a port scan and reverse engineer the firmware....
Lighten up Francis. A lot of the people reading this have old computers kicking around that are too slow to do what they want on their main box. Just repurpose one of these and the cost to you is functionally ZERO.
the major advances in civilization are processes which all but wreck the societies in which they occur - A.N. White
Since most people have several devices on their home network these days, including wireless devices, they'll again need to buy several cabled network cards and at least one wireless network card. You're looking at $100 or more, depending on the type and number of network cards you need to buy.
er, if it's functioning as a router, they just need one interface per network, not one per device as you seem to be implying. Though since most home routers bundle a router and switch (and sometimes modem) into a single package, the confusion is understandable. If additional ports are needed (e.g. for multiple wired devices), then a standard desktop switch can be used to provide them.
http://www.rakuten.com/prod/pogoplug-mobile-wireless-backup-access-share-your-pc-mac-tablet/223435914.html?listingId=206407980
There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
Who has that anymore?
People that don't want to give any money to a cable company and want to give as little money as possible to the AT&T monopoly, and would rather have their money go to a friendly CLEC. I gave up my 50mbit Comcast cable internet connection for a 14mbit DSL connection because several times a week, packet loss would go through the roof and throughput would slow to a crawl on the Comcast connection, while the DSL provider has been rock solid.
Yeah, there's no way I'd give any money to the local cable companies in my area. I have 6mbps DSL through a CLEC and it's great. Unlike what I've seen on my friends cable connection, there's no traffic shaping or blocking of common ports. Last time I read the contract it basically said I could do whatever I want with the connection as far as running servers is concerned, this in contrast to the cable company (and also AT'Ts high speed option) that explicitly disallows things such as hosting web or gameservers, and will play whack-a-mole with your ports if they notice.
"Backdoor Discovered In Netgear and Linkys Routers"
Obviously the backdoor was in the missing S
-- 29A the number of the Beast
I loved that modem - I had the internal version for my IIe. And it could keep up with my typing!! Now I'll have to dig around and see if it still works...