Slashdot Mirror
At Least 700,000 Routers Given To Customers By ISPs Are Vulnerable To Hacking
itwbennett writes: More than 700,000 ADSL routers provided to customers by ISPs around the world contain serious flaws that allow remote hackers to take control of them. Most of the routers have a 'directory traversal' flaw in a firmware component called webproc.cgi that allows hackers to extract sensitive configuration data, including administrative credentials. The flaw isn't new and has been reported by multiple researchers since 2011 in various router models.
I've always run my own hardwsare for years for a reason: it gives me a buffer beyond which I know the ISP no longer has control of my home network. 2x OpenWRT routers, a managed switch in the middle, and a lightweight embedded PC running the essential network services (dhcp, dns, ntp, etc), and the IT management overhead is fairly low.
I realize this isn't the router in question, but I refuse to use my Comcast modem--which has a wireless router built in--as anything but a modem, preferring to run everything through my own hardware. Also disabling that stupid Comcast Hot Spot functionality--like Hell am I paying Comcast for the privilege of hosting a part of their "free wireless" network, whether it affects my own personal bandwidth or not (or whether it leaves a door open to hacking into my own private network).
The description says that a remote hacker can get admin credentials. Didn't read TFA. What I don't understand is why a router like that has any kind of management enabled on the WAN side by default at all.
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
Having been a field engineer, where I had to fix and make work the stuff the idiots who called them selves engineers doing the design, having a backdoor to access systems was very useful. Customer didn't remember the password? No problem, I still had a way into the control system. I did, however, wonder what other equipment had the same "feature?" My stuff had no public facing interface no network connection so illicit access was not an issue except maybe if a disgruntled employee decided to have some fun; but the general design approach was "we need backdoors for support reasons" and that mentality carried over as equipment became more connected and no one ever seems 2015-03-20o question it or assess the risks vs reward for such a design philosophy. Of course, no one would ever access the proprietary "Company Confidential" engineering support documentation, right? It's kept safe right here on our internal document so no one weill ever know our backdoor user is "admin" with a password of "Pass1234" and thus we can make them easy for our field support staff, who we at HQ all know are dumb knuckle dragging mouth breathers anyway, to remember.
I'm a consultant - I convert gibberish into cash-flow.
Your browser runs in your network. A browser with CSRF vulns might be exploitable if you visit a site containing something like this:
<img src="http://10.10.10.1/cgi-bin/vulnerable.cgi?enable_wan_admin=1&old_pass=admin&new_pass=now_i_own_your_router>
Why doesn't the OP mention that they're only talking about the Belkin N150, with various versions of the firmware prior to v1.00.08?
Many of the routers in Thailand are hacked to use a DNS owned by a Lebanese company that replaces the DNS entries of ad-networks by their own ad-networks and redirect servers.
The largest ISP hands out ZyXEL routers that are vulnerable. This is probably also happening in other countries, only for Thailand this must be already a million dollar business.
Check the DNS entry of your router! You might not observe that you are hacked if you use an ad-blocker or hard-coded DNS in your system.
This is a preliminary workaround so im sure many of you will find bugs, but heres what im using:
1. unbox the router from your ISP. Many will come with an extra CAT 5 cord. Set this aside.
2. position the router (and wireless antennas should it come with wireless) directly above your garbage can
3. releasing the device will cause it to fall at 9.81m/s^2 directly into the bin (NOTE: this DOES NOT WORK or may respond slowly in areas without earth mode gravity...double check first.)
4. Wind the cat 5 cord in a pretty loop and hang it up with the rest of them.
5. continue instructions at: https://openwrt.org./
Good people go to bed earlier.
Never attribute to malice what can be adequately explained by stupidity. Some suit probably heard "blah blah blah shit that isn't important blah blah" when an engineer told them about this problem (and I am sure one did, unless they were too afraid of being fired for daring to suggest that the suit didn't know everything about everything).
Never underestimate the power of stupid people in large groups.
Comcast charges a rental fee for their router, it's right on the bill. Qwest, er Century Link, did the same thing
Never let a lack of data get in the way of a good rant.
The webpage linked shows precisely ONE router model. Or, am I blind?
http://www.cvedetails.com/cve/...
When replacing my parents' AT&T U-Verse router with a brand new U-Verse router, I was dismayed to note that it only supports 802.11g. WTF? That's a wifi standard from 2003. It's as if AT&T give zero fucks about your wi-fi experience.
Remember kids, if you're not paying for the service, YOU ARE THE PRODUCT THAT IS BEING SOLD.
This is just one example of why there needs to be a clear "right to fix" when it comes to firmware. For *any* object with firmware in it, the owner of the hardware MUST have a legal right to unlock (if locked), reverse engineer (if required), change, update and fix the firmware. We are heading into an abyss where flaws/bugs/exploits in our cars, thermostats, TV's, phones, IOT tags, routers, etc. etc. WILL be found years after they have been sold. There is no way we can rely on the original equipment maker to keep these objects up to date - indeed they might not even be around in a few years when the objects become popular enough to become a target - so we must demand a clear, unambiguous right to fix!
Hmmm
Unless networking between local systems, 802.11g is more than adequate for the Wan link speed they're likely getting from AT&T DSL.
Since you said you were replacing their router and it's your parents ( if your parents are like mine ), I would wager they're not running
NAS backups locally, or doing much else between local systems requiring lots of bandwidth. So I'm not sure I would see a need for
them to run N or even AC class WI-FI. ( Mine most certainly didn't. )
What's the top speed offerings on Uverse . . . . 45Mb/sec best case ? ( I have cable and not in AT&T territory so I have no idea )
Summary:
1. Belkin ADSL routers are crap and hackable
2. This has been known since 2011
3. As a result, only 700K of them are still in use worldwide
Where's the news? Where's the angle? Pre-fixing a number with "More than" doesn't make it big, it only makes it sound that way. 700K isn't even a spit in the ocean, I live in a medium sized city in a small country and it has more than 700K routers. This is just fearmongering, and it's not even a very good attempt at it. Why was this posted?
With only 3 non-overlapping channels, and often wifi access points choosing their own overlapping channel (like 3 or 8), your parent's wireless is likely interfering with a neighbor's wireless. This is much more likely in an apartment complex.
If someone is running 802.11g (or, 802.11b because they only have 6mbps DSL and 11mbps 802.11b is more than enough for their DSL), they are occupying the wireless channel for an extended amount of time.
Even a group of grandmas in an apartment complex running 802.11b only to access their 6mb DSL connection would quickly see their speeds plummet because of CMSA/CA causing a cascade failure of the wireless signal.
Going with the current wireless standard (802.11n in both 2.4 and 5ghz) is the right answer. 802.11ac is very new, so I would agree for now that the additional cost isn't worth it. At the very least, 802.11n 2.4ghz should be default.
Grammer Nazis - I mod you "troll" unless you actually add something on-topic. Yes, I know I have mispellings in my sig.