Slashdot Mirror
New SOHO Router Security Audit Uncovers Over 60 Flaws In 22 Models
Home and small-office routers have become a hotbed for security research lately, with vulnerabilities and poor security practices becoming the rule, rather than the exception. A new security audit by researchers from Universidad Europea de Madrid only adds to that list, finding 60 distinct flaws in 22 different device models. They posted details of their research on the Full Disclosure mailing list, and the affected brands include D-Link, Belkin, Linksys, Huawei, and others. Many of the models they examined had been distributed to internet customers across Spain by their ISPs. About half of the flaws involve Cross Site Scripting and Cross Site Request Forgery capabilities, though there is at least one backdoor with a hard-coded password. Several routers allow external attackers to delete files on USB storage devices, and others facilitate DDoS attacks.
How can this be? I pays good money for good stuffs. Dlink is goods?
Netgear has some major security flaws they they've refused to address for a long time. Mainly direct remote access. I'm not sure if this is by design via the NSA or because they are horrifically lazy, but I stopped caring what they thought and installed Linux on my router. Openwrt and dd-wrt work better than the original in most cases, except in the realm of tx power modification. That seems to have sucked since people started frying their antenna's and the dev's stopped pursuing it.
With 22 different models of crap home routers I would have expected the pen-testing equivalent of clotted rivers of gore pouring through heaps of smouldering rubble and pooling around the skull pyramids that seem to rise higher than the walls that once offered the false promise of shelter. Not merely 60 serious vulnerabilities.
Fuck off with these horseshit "features" that nobody wants.
Most of you /.'ers that have read my comments know that I like to dis Apple, can't stand the fucking fanbois, but I have yet to see the Airport listed in any of these articles.
If you have point it out to me, it seems they are fairly sound devices.
"If any question why we died, Tell them because our fathers lied."
Then you will see headlines like this "New audit of devices from Internet of Things category uncovers 65 000 flaws in 8 000 different devices, 240 million of this devices are in use today globally". Just think about those botnets...
Let's face it, manufactures make stuff for pennies and sell it for as much as they can with as little support and warranty as they can. Notice how you can hardly talk to anyone about a issue without handing over a credit card. Firmware is as flimsy as the antenna these routers use. Nothing about a router seems well built, they skimp on heat sinks and shielding and wonder why their is so much interference? Throw the FCC a few bucks and they pretty much pass anything. Even then the FCC cares so little about security or function other then what is important to specs. Anymore if a product does not perform as expected it goes back in the box and back to the store. Can't count on anyone knowing how to fix it and most times you get another of the same its defective too. I don't spend a lot of routers anymore. Tear apart a expensive router and its made just as poorly as a cheaper one. Just more bands that flake out against each other. Sorry for the rant, but its about time the router makers get hit with payback for lousy firmware. Too bad its the end user that pay's the price.
Past research has shown that the security of ISP-provided routers is often worse than that of off-the-shelf ones. Many such devices are configured for remote administration to allow ISPs to remotely update their settings or troubleshoot connection problems. This exposes the routers’ management interfaces along with any vulnerabilities in them to the Internet, increasing the risk of exploitation.
So, in other words, these models were specifically made for and distributed by an ISP, and were not off-the-shelf models. The backdoors were there for the ISP managers. For 99% of network users out there, these vulnerabilities are of no practical concern.
described attack and info URL doesn't work on my unit
Does anyone who actually owns a WRT54GL run the stock firmware on them? I thought the whole point of that router was the fact you can drop Tomato, DD-WRT or OpenWRT onto it - I've had OpenWRT running my home network for years now.
... expecting all models to be flawless.
Really, there ought to be some sensible minimum standards for commercial products that can be connected to the internet. This could include that the company had a decent policy for security fixes and a published contact point for people reporting such problems.
And how about a pre-published, minimum security support length, so that people buying a smartphone/router/etc. will know in advance how many years it will be supported with security fixes. There are "use by" dates on food, why not on all internet connected devices.
Does anyone know of a SOHO package that can keep out the three letter agencies? I'm pretty sure even if these SOHO routers had stellar security does anyone believe they could keep out the NSA or a determined attacker from compromising your network? Even the best models basically just have a linux distro running iptables.
This Sig does not Exist.
Some of these flaws (maybe all) can be accessed by default logins. As soon as you have passed that, you have full control. To help prevent that you can change the device's IP and give it unique login credentials. It won't stop someone determined who wants access as all it needs is brute force to find the device's IP login page. In other words some of the vulnerabilities aren't device issues but user responsibilities. That pretty much goes for non-isp supplied routers.
A few ISP supplied routers do have backdoors and are remotely controlled ostensibly for the benefit of the user. In these cases it is almost impossible to alter the unit's IP address or login credentials.
Don't be apathetic. Procrastinate!
Assuming somebody does sell a secure SoHo router product, or is our only option to install something like DD-WRT and be vigilant when it comes to security updates?
Agreed. Slashdot has gotten retarted
... not letting me delete my account.
Slashdot is like the Mafia, CIA, and the Los Angeles Science Fiction Society: Once a member, ALWAYS a member.
As LASFS says: "Death Will Not Release You."
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Delete your account means what?
Scientology is the only reason that some data has been deleted from Slashdot. But your account is here because why?
Just stop visiting here. Or delete your cookies. Or be responsible for what you have posted. Or you can just plead "I was drunk."
Delete your account has the follow-on effects of, what exactly? What is it that you wish to omit from the record?
Or is it everything? Because unless you are a Scientologist with lots of money, probably nothing will be removed other than your ability to log on.
And log on is different from log in. And Scientology is just the first thing that came to mind.
Seems to be most/all browser vulnerabilities. Which begs the wisdom of embedding a mini web server on your security devices. For example, the UPnP protocol, putting convenience over security.
They listed the Linksys WRT54GL. Alex, I'll take "Routers nobody should be using anymore" for $2000.
After years of dealing with POS routers from Linksys, D-Link, Netgear, Belkin, etc., I finally wised up and bought a Mikrotik router a couple years ago. It gives me rock solid, bullet-proof performance for a fraction of the price of the crap you find on the shelves in the big box stores.
Unfortunately DD-WRT is the worst as far as "open source" embedded distributions are concerned. They violate licenses and don't respect users rights to the source code. Unfortunately even the better embedded distributions like OpenWRT include proprietary bits. None of this is good if your concerned about security. While I'm not going to suggest LibreCMC is magically more secure the fact of the matter is you can't build a secure distribution or router from proprietary software. Unfortunately this does severely limit the devices you can run LibreCMC on. However if you care about your privacy and security it's the only acceptable starting point.