Slashdot Mirror

← Back to Stories (view on slashdot.org)

At Least 700,000 Routers Given To Customers By ISPs Are Vulnerable To Hacking

Posted by Soulskill on from the seeds-of-a-class-action dept.

itwbennett writes: More than 700,000 ADSL routers provided to customers by ISPs around the world contain serious flaws that allow remote hackers to take control of them. Most of the routers have a 'directory traversal' flaw in a firmware component called webproc.cgi that allows hackers to extract sensitive configuration data, including administrative credentials. The flaw isn't new and has been reported by multiple researchers since 2011 in various router models.

26 of 96 comments (clear)

  1. Run your own equipment by chuckinator · · Score: 5, Informative

    I've always run my own hardwsare for years for a reason: it gives me a buffer beyond which I know the ISP no longer has control of my home network. 2x OpenWRT routers, a managed switch in the middle, and a lightweight embedded PC running the essential network services (dhcp, dns, ntp, etc), and the IT management overhead is fairly low.

    1. Re:Run your own equipment by Njorthbiatr · · Score: 3, Informative

      Me too, since the only reason they want you to use their router is in the first place is to price gouge with rental fees.

    2. Re:Run your own equipment by Anonymous Coward · · Score: 4, Informative

      Uh no, those hotspot things require people to be a subscript, it's not pure public and unrestricted access.

    3. Re:Run your own equipment by neghvar1 · · Score: 3, Informative

      This is why I always run my own router behind the ISP's router. Create a DMZ between the 2 routers with a 255.255.255.252 subnet so that the only available IP addresses are one for the WAN port on my router and the other for the LAN port on the ISP router.

    4. Re:Run your own equipment by ckatko · · Score: 4, Insightful

      You seem to be under the assumption that your hardware, and your compiler are incapable of being attack vectors.

      http://cm.bell-labs.com/who/ke...

    5. Re:Run your own equipment by jader3rd · · Score: 2

      I would prefer it if it was illegal to have service providers also provide the hardware. Because since they provide 'free' hardware, the cost of that hardware is in your bill. So even though you aren't using the 'free' hardware, you're still subsidizing it in some way.

    6. Re:Run your own equipment by RPI+Geek · · Score: 3, Insightful
      I did this quite recently and I couldn't agree more!

      After my Linksys started dying on a regular basis, I repurposed an old laptop that had been sitting untouched for years into an OpenBSD router. After fiddling with it for a while to get the settings correct, I switched out my old Linksys and haven't had so much as a hiccup since then. The 26 days uptime is ~19 more than my average with the crappy old Linksys, at the cost of a bit more power consumption. At some point I may upgrade my hardware to something lower-power, but so far I'm calling my experiment a sucess.

      --

      - "Nobody came out that night, not one was ever seen. But Old Man Stauf is waiting there, crazy sick and mean!"
    7. Re:Run your own equipment by RabidReindeer · · Score: 5, Funny

      Well, if EVERYONE decides they'll mooch off their neightbor, it's Communism!

      And if no one actually HAS WiFi to mooch off of, that's Soviet-style Communism.

    8. Re:Run your own equipment by Anonymous Coward · · Score: 2, Informative

      But they can't, since once they stop subscribing, they're no longer able to use the WiFi.

      So quit all you want, then you can't mooch because they're actively requiring you to be a subscriber.

      Is this flying past you somehow?

    9. Re:Run your own equipment by houstonbofh · · Score: 3, Insightful

      You seem to be under the assumption that your hardware, and your compiler are incapable of being attack vectors.

      Possible attack vectors vs known attack vectors. I guess you could also add "likely attack vectors" since they keep getting compromised, and not updated. Of course, so does user home equipment.

      The big difference is, if I own it, I can upgrade the software, and choose secure passwords. If I rent it, I have to trust that Comcast is a conscientious as I am. Stop laughing!

    10. Re:Run your own equipment by Raistlin77 · · Score: 2

      Reduce to slowest/cheapest option, disable wi-fi on your router, mooch to your heart's content off your neighbor's high-speed connection.

    11. Re:Run your own equipment by tlhIngan · · Score: 2

      Me too, since the only reason they want you to use their router is in the first place is to price gouge with rental fees.

      Not the only reason. Some are now using these routers to set up a hotspot from your home. Peeps connectin' for free - what could go wrong?

      Now of course, that's silly economics. If people can legally mooch off their neighbors, why would they pay for their own connection? so everyone decides to drop their service at the same time, including the person who was the last unwitting provider in the hood.

      To use those hotspots require you to be a subscriber of said service. So if you're a Comcast subscriber, you can use those Comcast hotposts that Comcast makes available.

      If your neighbors want to use your hotspot, they're still paying for internet service. Just a crappier version of it because the hotspot one is usually rate limited. They could just instead use the one they're paying for.

      It's not "free wifi" - it's a gated access wifi - as long as you're a subscriber to internet service from that company, you can use that hotspot.

      Mooching off your neighbours means yours sits idle. Comcast or whoever still gets their pound of flesh from you every month. (And your neighbor is free to mooch off your modem since they subscribe to the same service).

      And yes, it's an annoyance if you're in a marginal area with overlap and your wifi switches from your home router to your neighbor's.

    12. Re:Run your own equipment by chuckinator · · Score: 2

      Unfortunately, that's not entirely true with cable modems. Connecting to the DOCSIS network grants your ISP admin rights over the device. That's a big reason why you should separate the functionality of your primary gateway route from your DOCSIS demarcation device.

  2. And this is why... by barlevg · · Score: 2

    I realize this isn't the router in question, but I refuse to use my Comcast modem--which has a wireless router built in--as anything but a modem, preferring to run everything through my own hardware. Also disabling that stupid Comcast Hot Spot functionality--like Hell am I paying Comcast for the privilege of hosting a part of their "free wireless" network, whether it affects my own personal bandwidth or not (or whether it leaves a door open to hacking into my own private network).

    1. Re:And this is why... by Anonymous Coward · · Score: 3, Interesting

      Why don't you just buy a docsis 3 modem then? Stop paying for the privilege of renting a modem.

    2. Re:And this is why... by barlevg · · Score: 3, Insightful

      Wow. You're absolutely right. They charge me $10/mo, and modems are less than $100. That's insane.

    3. Re:And this is why... by chihowa · · Score: 2

      Keep in mind that it's purely a monetary win, though. Even though you own the modem, they completely control it and can (and do) reflash its firmware. You should still treat it as a potentially hostile device on your network.

      There are other limitations, too, like Comcast's refusal to sell you static IP addresses unless you rent a modem from them.

      --
      If you want a vision of the future, imagine a youtube comments section scrolling - forever.
  3. Service backdoors by Registered+Coward+v2 · · Score: 4, Interesting

    Having been a field engineer, where I had to fix and make work the stuff the idiots who called them selves engineers doing the design, having a backdoor to access systems was very useful. Customer didn't remember the password? No problem, I still had a way into the control system. I did, however, wonder what other equipment had the same "feature?" My stuff had no public facing interface no network connection so illicit access was not an issue except maybe if a disgruntled employee decided to have some fun; but the general design approach was "we need backdoors for support reasons" and that mentality carried over as equipment became more connected and no one ever seems 2015-03-20o question it or assess the risks vs reward for such a design philosophy. Of course, no one would ever access the proprietary "Company Confidential" engineering support documentation, right? It's kept safe right here on our internal document so no one weill ever know our backdoor user is "admin" with a password of "Pass1234" and thus we can make them easy for our field support staff, who we at HQ all know are dumb knuckle dragging mouth breathers anyway, to remember.

    --
    I'm a consultant - I convert gibberish into cash-flow.
    1. Re:Service backdoors by cliffjumper222 · · Score: 3, Funny

      > no one ever seems 2015-03-20o question it or assess the risks vs reward for such a design philosophy.

      This date brought to you by the backdoor to the letter "t"!

  4. Belkin N150 by Anonymous Coward · · Score: 5, Informative

    Why doesn't the OP mention that they're only talking about the Belkin N150, with various versions of the firmware prior to v1.00.08?

  5. Many routers are hacked to use a rogue DNS by Anonymous Coward · · Score: 4, Interesting

    Many of the routers in Thailand are hacked to use a DNS owned by a Lebanese company that replaces the DNS entries of ad-networks by their own ad-networks and redirect servers.

    The largest ISP hands out ZyXEL routers that are vulnerable. This is probably also happening in other countries, only for Thailand this must be already a million dollar business.

    Check the DNS entry of your router! You might not observe that you are hacked if you use an ad-blocker or hard-coded DNS in your system.

  6. Ive developed a workaround for many models. by nimbius · · Score: 3, Funny

    This is a preliminary workaround so im sure many of you will find bugs, but heres what im using:
    1. unbox the router from your ISP. Many will come with an extra CAT 5 cord. Set this aside.
    2. position the router (and wireless antennas should it come with wireless) directly above your garbage can
    3. releasing the device will cause it to fall at 9.81m/s^2 directly into the bin (NOTE: this DOES NOT WORK or may respond slowly in areas without earth mode gravity...double check first.)
    4. Wind the cat 5 cord in a pretty loop and hang it up with the rest of them.
    5. continue instructions at: https://openwrt.org./

    --
    Good people go to bed earlier.
    1. Re:Ive developed a workaround for many models. by camperdave · · Score: 2

      Directions unclear. Router bounced off lid of garbage can and landed on toe. Involuntary spasm caused garbage can to be knocked over and to become tripping hazard. In hospital with concussion. Garbage everywhere.

      --
      When our name is on the back of your car, we're behind you all the way!
  7. Various router models? by EmagGeek · · Score: 2

    The webpage linked shows precisely ONE router model. Or, am I blind?

    http://www.cvedetails.com/cve/...

  8. Re:even worse threat: AT&T routers support 802 by nehumanuscrede · · Score: 2

    Hmmm

    Unless networking between local systems, 802.11g is more than adequate for the Wan link speed they're likely getting from AT&T DSL.
    Since you said you were replacing their router and it's your parents ( if your parents are like mine ), I would wager they're not running
    NAS backups locally, or doing much else between local systems requiring lots of bandwidth. So I'm not sure I would see a need for
    them to run N or even AC class WI-FI. ( Mine most certainly didn't. )

    What's the top speed offerings on Uverse . . . . 45Mb/sec best case ? ( I have cable and not in AT&T territory so I have no idea )

  9. Fear mongering by Anonymous Coward · · Score: 2

    Summary:

    1. Belkin ADSL routers are crap and hackable
    2. This has been known since 2011
    3. As a result, only 700K of them are still in use worldwide

    Where's the news? Where's the angle? Pre-fixing a number with "More than" doesn't make it big, it only makes it sound that way. 700K isn't even a spit in the ocean, I live in a medium sized city in a small country and it has more than 700K routers. This is just fearmongering, and it's not even a very good attempt at it. Why was this posted?