Slashdot Mirror
Asus Wireless Routers Can Be Exploited By Anyone Inside the Network
An anonymous reader writes A currently unpatched bug in ASUS wireless routers has been discovered whereby
users inside a network can gain full administrative control, according to recent research conducted by security firm Accuvant. Although the flaw does not allow access to external hackers, anyone within the network can take administrative control and reroute users to malicious websites, as well as holding the ability to install malicious software. The vulnerability stems from a poorly coded service, infosvr, which is used by ASUS to facilitate router configuration by automatically monitoring the local area network (LAN) and identifying other connected routers. Infosvr runs with root privileges and contains an unauthenticated command execution vulnerability, in turn permitting anyone connected to the LAN to gain control by sending a user datagram protocol (UDP) package to the router.
In relevant part: The block starts off by excluding a couple of OpCode values, which presumably do not require authentication by design. Then, it calls the memcpy and suspiciously checks the return value against zero. This is highly indicative that the author intended to use memcmp instead. That said, even if this check was implemented properly, knowing the device’s MAC address is hardly sufficient authentication,” said Drake.
Here are the technical details at GitHub.
every HTTP request goes to a site that has nothing to do with goats!
The preceding post was not a Slashvertisement.
What about ASUS routers flashed with DD-WRT or Tomato or somesuch?
We play the game with the bravery of being out of range
Alternatively, disable the infosvr service by killing the process after each boot. For extra fun/irony, use the exploit to do this:
$ ./asus-cmd "killall -9 infosvr"
He's already got a temporary patch up which will disable the vulnerable feature. (He also shows a few other ways of securing the issue)
http://forums.smallnetbuilder....
Their motherboards turned to shit in the meantime as well.
Here's the full file common.c for those who want to read the source code.
What do you think about the code?
It looks like it's official, people who make networking gear are either incompetent or lazy.
Possibly both.
Lost at C:>. Found at C.
when you know it's yet another, all-too-common bug? Say it. Say IT. SAY IT!
Couple things that make this benign for most Asus owners. One is, much of Asus routers are consumer driven and two your talking about a person who would have to access that router locally as a end user. Not from the internet side of the router. This means you either are too dumb to use a password to control who accesses your network or you allow that user to access the local network with a password. I just do not see much exploitation of this simply because of the required local access needed. The people who want to steal and hack their way into your network are in places like North Korea, China, Russia. Not sitting in your home accessing your network.
Have it repaired or get your money back. This shit has got to cost them.
Automobile recalls in the future could be handled with OTA updates, but you insist on making it cost "them" by giving up your ability to transport yourself.
In return for you trying to prove a point, they'll keep your car for a week just to fuck with you, only to perform the 5-minute OTA update in front of you when you return.
But hey, stand your ground on the petty shit...
sounds like this could be useful to me since i just received an AC68U which does not accept the default username and passsword.
Are there detailed instructions on how to execute this exploit?
Yep. A software update is going to repair that faulty throttle cable.
I've a had a few recalls on my car and all have been hardware related.
However, if I read this correctly, you would have to have the network key or physical access to the router in order to use this exploit. I use mine with WPA2 authentication, and only give the key to trusted individuals. I don't care what brand of router you have access to...if I have physical access, I can compromise it. So, unless you're using one of these routers in a commercial environment (I do use mine for work, but not in the office setting) then there's little to worry about it. That said, I will be updating my firmware with the fix ASAP.
The correct answer is 42.
This is not petty shit. If vendors are made to realize that shoddy software will cause them significant problems, they will improve their software quality. "We'll just patch bugs in the field" makes releases out of beta grade software. No, you won't patch that in the field. I'll return it to you and you having to handle that device will cost you more than I paid you for it. Learn the lesson or go out of business.
My company makes a product that runs on ASUS routers. We've put in a workaround to this vulnerability for our users - see our blog post on the subject here: https://www.aterlo.com/blog/
You can tell the other people who replied to you to suck it, because routers running alternative firmware ARE vulnerable if that alternative firmware is forked from asuswrt. AsusWRT-Merlin is one example, and is actually shown in TFA.
Have it repaired or get your money back. This shit has got to cost them.
Or, don't let untrusted users on your private network.
Just connect an access point to an OpenBSD box, and this crap won't happen.
Why will that prevent it from happening? Anyone that owns the access point can inspect and modify all of the traffic that passes through it.
This way asus-cmd is like systemd for Asus wireless routers.
So, i have a free-while-youre-with-tmobile router from TMobile. Its a NTAC68U with a custom firmware. The custom firmware IS vulnerable. But, the firmware is simplified, and doesn't have any way of getting a command line interface to run killall.
Im a geek, so I can reflash to Merlin or something like that. But most people with these routers will be non-technical folks. I hope the TMobile folks patch this quickly.
Old news. I've known about this unauthenticated code execution for 9 years (shortly after I got my WL-500g).
Here's a little utility I wrote years ago that exercises one of the benign opcodes, with the cmd execution opcode defined:
https://github.com/awalls-cx18/wl500g-infoclient/blob/master/infoclient.c#L55
Guess I didn't hype it up in the security circles properly.
Comcast opening access to your router to people you don't know is nothing to worry about. What could possibly go wrong?
It's all about writing services that could be written in eg. C# in C or legacy-style C++. I'm not convinced that even the modern C++ styles are safe - there's still many more ways to do mistakes with regard to memory than in C#.
Today's drive by wire vehicles don't have throttle cables. The faulty logic driving the throttle servo can be fixed with an OTA tho.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
..for example the Bewan iBox stores wlan passwords and remote access keys in plaintext, which can be dumped from internal network by anyone. Here is my notes on the topic which I did report to CERT-FI in 12/2010.