Slashdot Mirror
At Least 700,000 Routers Given To Customers By ISPs Are Vulnerable To Hacking
itwbennett writes: More than 700,000 ADSL routers provided to customers by ISPs around the world contain serious flaws that allow remote hackers to take control of them. Most of the routers have a 'directory traversal' flaw in a firmware component called webproc.cgi that allows hackers to extract sensitive configuration data, including administrative credentials. The flaw isn't new and has been reported by multiple researchers since 2011 in various router models.
I've always run my own hardwsare for years for a reason: it gives me a buffer beyond which I know the ISP no longer has control of my home network. 2x OpenWRT routers, a managed switch in the middle, and a lightweight embedded PC running the essential network services (dhcp, dns, ntp, etc), and the IT management overhead is fairly low.
I realize this isn't the router in question, but I refuse to use my Comcast modem--which has a wireless router built in--as anything but a modem, preferring to run everything through my own hardware. Also disabling that stupid Comcast Hot Spot functionality--like Hell am I paying Comcast for the privilege of hosting a part of their "free wireless" network, whether it affects my own personal bandwidth or not (or whether it leaves a door open to hacking into my own private network).
"An unauthenticated attacker that is connected to the router's LAN may be able to read critical system files on the router."
Big fuckin' deal. Anyone that is on your LAN that wants to access shit can already do so. This won't allow remote attackers to access anything. I would wager that virtually all residential routers at one point or another allowed unauthenticated access to their configuration, and were eventually patched via firmware. Why do I even bother coming to this site anymore?
The Carna botnet found 400,000 vulnerable devices without really trying (just using plain simple default login params) and that was a few years ago. Some times, I wish whoever ran that botnet had torched the whole thing and sent a wake up call. We are just setting the stage for the next great botnet.
Having been a field engineer, where I had to fix and make work the stuff the idiots who called them selves engineers doing the design, having a backdoor to access systems was very useful. Customer didn't remember the password? No problem, I still had a way into the control system. I did, however, wonder what other equipment had the same "feature?" My stuff had no public facing interface no network connection so illicit access was not an issue except maybe if a disgruntled employee decided to have some fun; but the general design approach was "we need backdoors for support reasons" and that mentality carried over as equipment became more connected and no one ever seems 2015-03-20o question it or assess the risks vs reward for such a design philosophy. Of course, no one would ever access the proprietary "Company Confidential" engineering support documentation, right? It's kept safe right here on our internal document so no one weill ever know our backdoor user is "admin" with a password of "Pass1234" and thus we can make them easy for our field support staff, who we at HQ all know are dumb knuckle dragging mouth breathers anyway, to remember.
I'm a consultant - I convert gibberish into cash-flow.
"Many of the routers have additional flaws. For example, around 60 percent have a hidden support account with an easy-to-guess hard-coded password that’s shared by all of them. Some devices don’t have the directory traversal flaw but have this backdoor account, Lovett said."
Dlink, ZTE etc. all vulnerable.
Cisco too, loads of execute and directory traversals:
http://www.cvedetails.com/vendor/16/Cisco.html
Juniper seem to be quite reasonable, but far from perfect:
http://www.cvedetails.com/vendor/874/Juniper.html
Thomson v-good:
http://www.cvedetails.com/vendor/1996/Thomson.html
Probably the best choice at this point is a Thomson Router, French company, unlikely to be loyal to the UStasi.
Is there is a nice list of backdoor accounts somewhere?
Most of the vulnerable devices he identified are ADSL modems with router functionality that were supplied by ISPs to customers in Colombia, India, Argentina, Thailand, Moldova, Iran, Peru, Chile, Egypt, China and Italy. A few were also found in the U.S. and other countries, but they appeared to be off-the-shelf devices, not distributed by ISPs.
Belkin.
As a Uessian, I don't give a crap. Botnets? What's a botnets?
Why doesn't the OP mention that they're only talking about the Belkin N150, with various versions of the firmware prior to v1.00.08?
Many of the routers in Thailand are hacked to use a DNS owned by a Lebanese company that replaces the DNS entries of ad-networks by their own ad-networks and redirect servers.
The largest ISP hands out ZyXEL routers that are vulnerable. This is probably also happening in other countries, only for Thailand this must be already a million dollar business.
Check the DNS entry of your router! You might not observe that you are hacked if you use an ad-blocker or hard-coded DNS in your system.
At Least 700,000 Routers Given To Customers By ISPs Are Vulnerable To Hacking
Almost seems like it was on purpose.
"If any question why we died, Tell them because our fathers lied."
This is a preliminary workaround so im sure many of you will find bugs, but heres what im using:
1. unbox the router from your ISP. Many will come with an extra CAT 5 cord. Set this aside.
2. position the router (and wireless antennas should it come with wireless) directly above your garbage can
3. releasing the device will cause it to fall at 9.81m/s^2 directly into the bin (NOTE: this DOES NOT WORK or may respond slowly in areas without earth mode gravity...double check first.)
4. Wind the cat 5 cord in a pretty loop and hang it up with the rest of them.
5. continue instructions at: https://openwrt.org./
Good people go to bed earlier.
Comcast charges a rental fee for their router, it's right on the bill. Qwest, er Century Link, did the same thing
Never let a lack of data get in the way of a good rant.
...I completely disabled it from my ISP provided router. Doesn't, of course, mean it cannot be hacked, but it at least keeps one vector out of the equation. I also turned off wireless on my PC (PC came with this capability; I even turned off the Bluetooth though that avenue would require a much closer proximity to attack it). I don't trust wireless period. Even WPA2 has been shown to be vulnerable under certain conditions and who really know if it's under every condition yet. Call me paranoid. lol :)
I would assume that every router is vulnerable to hacking.
It's like saying that only a percentage of CPU's are prone to execute code.
The webpage linked shows precisely ONE router model. Or, am I blind?
http://www.cvedetails.com/cve/...
When replacing my parents' AT&T U-Verse router with a brand new U-Verse router, I was dismayed to note that it only supports 802.11g. WTF? That's a wifi standard from 2003. It's as if AT&T give zero fucks about your wi-fi experience.
Remember kids, if you're not paying for the service, YOU ARE THE PRODUCT THAT IS BEING SOLD.
This is just one example of why there needs to be a clear "right to fix" when it comes to firmware. For *any* object with firmware in it, the owner of the hardware MUST have a legal right to unlock (if locked), reverse engineer (if required), change, update and fix the firmware. We are heading into an abyss where flaws/bugs/exploits in our cars, thermostats, TV's, phones, IOT tags, routers, etc. etc. WILL be found years after they have been sold. There is no way we can rely on the original equipment maker to keep these objects up to date - indeed they might not even be around in a few years when the objects become popular enough to become a target - so we must demand a clear, unambiguous right to fix!
Hmmm
Unless networking between local systems, 802.11g is more than adequate for the Wan link speed they're likely getting from AT&T DSL.
Since you said you were replacing their router and it's your parents ( if your parents are like mine ), I would wager they're not running
NAS backups locally, or doing much else between local systems requiring lots of bandwidth. So I'm not sure I would see a need for
them to run N or even AC class WI-FI. ( Mine most certainly didn't. )
What's the top speed offerings on Uverse . . . . 45Mb/sec best case ? ( I have cable and not in AT&T territory so I have no idea )
This is precisely why I use a Smoothwall and, besides that, it was free. I used an old computer laying around and the Smoothwall distribution is free. It's feature rich, secure, well supported by the user community and oh, did I mention IT IS FREE? As in beer.
Summary:
1. Belkin ADSL routers are crap and hackable
2. This has been known since 2011
3. As a result, only 700K of them are still in use worldwide
Where's the news? Where's the angle? Pre-fixing a number with "More than" doesn't make it big, it only makes it sound that way. 700K isn't even a spit in the ocean, I live in a medium sized city in a small country and it has more than 700K routers. This is just fearmongering, and it's not even a very good attempt at it. Why was this posted?
This defeatist message brought to you by the domestic ISP oligopoly. "We'll never upgrade your access speed so give up and use any old crap we deliver. And remember to tip the installer handsomely for the privilege of waiting around all day for them to show up."
With only 3 non-overlapping channels, and often wifi access points choosing their own overlapping channel (like 3 or 8), your parent's wireless is likely interfering with a neighbor's wireless. This is much more likely in an apartment complex.
If someone is running 802.11g (or, 802.11b because they only have 6mbps DSL and 11mbps 802.11b is more than enough for their DSL), they are occupying the wireless channel for an extended amount of time.
Even a group of grandmas in an apartment complex running 802.11b only to access their 6mb DSL connection would quickly see their speeds plummet because of CMSA/CA causing a cascade failure of the wireless signal.
Going with the current wireless standard (802.11n in both 2.4 and 5ghz) is the right answer. 802.11ac is very new, so I would agree for now that the additional cost isn't worth it. At the very least, 802.11n 2.4ghz should be default.
Grammer Nazis - I mod you "troll" unless you actually add something on-topic. Yes, I know I have mispellings in my sig.
Even OpenWRT included proprietary software. The only way to really gain control over your device is to use a OpenWRT derived distribution called LibreCMC and make sure your bootloader is free software too. There are less than a dozen devices you can really have complete control over. There are zero devices with ADSL or cable modem chips as these combo modem routers are dependent on proprietary component for the modem portion. Thereby your losing control over the device. We therefore need a router and a separate modem currently for any secure setup. While I'm hardly going to call a router with LibreCMC secure it is the best starting point as we must discard any device and distribution dependent on proprietary pieces of code from being trustworthy or securable. What we don't know can't be secured.