Slashdot Mirror
Flaw In Netgear Wi-Fi Routers Exposes Admin Password, WLAN Details
An anonymous reader writes A number of Netgear home wireless routers sport a vulnerability that can be misused by unauthenticated attackers [here's the report at seclists.org] to obtain the administrator password, device serial number, WLAN details, and various details regarding clients connected to the device, claims systems/network engineer Peter Adkins. The vulnerability is found in the embedded SOAP service, which is a service that interacts with the Netgear Genie application that allows users to control (change WLAN credentials, SSIDs, parental control settings, etc.) their routers via their smartphones or computers.
want to "remote manage" their home router ? it's inherently dangerous . Someday we'll have a hardened DD-WRT for all major routers , easy enough to be used by anyone. Most of the firmware shipped by manufacturers is closed and is generally of low quality.
Once again, "cloud connected" devices are not properly secured.
Shocker.
"A plan fiendishly clever in its intricacies"- Homer Simpson
I am always amazed at the number of times I have logged into wifi access points with the default admin password. I have actually logged in and fixed businesses configuration errors. If we can't even get people to change the password, all the rest of the security is useless.
Did you guys get hacked or what? It seems like this site has been down as much as it has been up lately...
Taking guns away from the 99% gives the 1% 100% of the power.
Do not buy a router unless OPENWRT supports it.
Always overwrite what ever firmware came with the router with a new install of free software.
The days when Joe Sixpack can just buy a router an plug it in are over! You must do this.
Security experts need to take a close at uboot software commonly used to install alternate firmware. And check if NSA has hacked that up as well.
Most consumer device deployments of uboot have a short (3 second) window in which they look for a tftp server broadcasting an update. This is very useful for developers of openwrt and pals, because it allows them to push a test image to the device's memory and boot on it.
However, it could also be used as an attack vector against home grade routers, if the NSA had a REALLY invested interest in you. Orchestrating a system reboot of your open firmware back to uboot (say, by causing a severe memory corruption event or something similar which panics the kernel-- maybe a hidden function in the LAN asic perhaps) followed by tftp of a new compromised image using say, a compromised windows workstation in the target network to do the serving.
You would have to completely replace the stock uboot on such routers to remove the small 3 second window.
It seems every few months someone discovers a vulnerability in a home router, and some websites even test multiple routers in a security "shoot-out". I've been reading these reports for years, but I've never seen an Apple router mentioned. Are Apple routers that much more secure or does no-one bother to test them?
Once again, Slashdot takes a big outage in the middle of the day.
Are you guys completely incompetent, or just lazy and reckless?
Based on what my family knows from the intel agencies we worked in, it's a feature.
What, you thought you lived in a Free Society, with Rights?
-- Tigger warning: This post may contain tiggers! --
Uh, folks, most of the Netgear WNR**** series routers DO already use DDWRT/openwrt as the base for the firmware.
I have a WNR2000v4, and lo and behold, it runs openWRT.
Slashdot still uses http.
I think most consumer grade routers are more inclined to be designed for simplicity of setup then security. Even today, a lot of tech challenged consumers find setting up a router challenging. But most router makers at least default to a secure wireless connection. Although plenty of end users never bother to change the Administrative password. Unfortunately security is not just about device makers taking steps. But rather the end user becoming smarter about how they should protect themselves. I think consumers have used the tactic of just adding another weak layer of software security in the form of a firewall or a Anti Virus program.
This most likely helps a singular device, but does nothing to help that big open door called the internet which is always on. I don't think people realize how that always on access can mean a lot of access to someone like a hacker.
'works as intended'
sincerely,
your favorite tla
Usually the only network interface UBoot is configured to use is on the local network side, on a wired interface and the IP address used is non-routable. You are not getting your alternate firmware loaded without being physically present with the router, connected by a wire, so some external party isn't going to compromise your router this way...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
You would have to completely replace the stock uboot on such routers to remove the small 3 second window.
There are replacement uboots for many devices. I'm not up on which routers have 'em. I replaced the uboot on my pogoplugs to make them better debian hosts. I may even start using the net booting feature.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I have a Netgear N300 Wireless Router Model WNR2000v2. I have no WiFi devices.
In the router manager Web pages, I unchecked the checkboxes for "Enable Wireless Router Radio" and "Turn Remote Management On". I also unchecked all of the checkboxes under "Guest Network Settings", "Wireless Settings", and "Wireless Repeating Function". The wireless LED indicator on the router is not lighted.
Therefore, I expect this is not a problem for me.
Don't you love the professionalism and issue escalation of the NETGEAR support team? Shows that we, the mere mortals, are not alone here at all!
If even the security research guy can't get them to stop sitting on their arses, what the mere mortals without such pressing issues are left to do when they encounter the various bugs here and there?
Usually the only network interface UBoot is configured to use is on the local network side, on a wired interface and the IP address used is non-routable.
Which means if they compromised a machine on your LAN you're hosed. They now have your router firmware firmly under their control.
Who needs an intercept in the ISP, lawful or otherwise, when they can have your router send them copies of whatever they want. (Not to mention using it to attack any other devices behind it and cooperate with malware on them.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
If they have a compromised machine on your network, you are hosed in more ways than them being able to change your router firmware. I think the bigest risk at that point is someplace else...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
incredibly secure
I think that qualifier demands you back this claim with some sort of source..
Nah. Just use the literal meaning of "incredible". B-)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way