Slashdot Mirror

← Back to Stories (view on slashdot.org)

Researcher Find D-Link DWR-932 Router Is 'Chock Full of Holes' (helpnetsecurity.com)

Posted by msmash on from the security-woes dept.

Reader JustAnotherOldGuy writes: Security researcher Pierre Kim has unearthed a bucketload of vulnerabilities in the LTE router/portable wireless hotspot D-Link DWR-932. Kim found the latest available firmware has these vulnerabilities: Two backdoor accounts with easy-to-guess passwords that can be used to bypass the HTTP authentication used to manage the router
-A default, hardcoded Wi-Fi Protected Setup (WPS) PIN, as well as a weak WPS PIN generation algorithm
- Multiple vulnerabilities in the HTTP daemon
- Hardcoded remote Firmware Over The Air credentials
- Lowered security in Universal Plug and Play, and more.
"At best, the vulnerabilities are due to incompetence; at worst, it is a deliberate act of security sabotage from the vendor," says Kim, and advises users to stop using the device until adequate fixes are provided.

70 comments

  1. "Oh my God, it's full of holes!" by neo-mkrey · · Score: 3, Funny

    Of course it is David, it's D-Link.

    1. Re:"Oh my God, it's full of holes!" by Anonymous Coward · · Score: 0

      A friend of mine used to pronunce the name as "D minus link", as in just barely above total failure.

  2. UPnP by Anonymous Coward · · Score: 0

    D-Link sucks so bad its UPnP security is worse than none at all!

  3. They by Anonymous Coward · · Score: 0

    They just hired some teen with basic computing skills who can package and upload roms, zero security experts working at d-link in taiwan... (and they have plenty of educated people in the field there, but it's cheaper to hire a teen)

    1. Re:They by Anonymous Coward · · Score: 0

      This should not be an issue for you. As long as you are not the teen in question.

  4. Sue them! by Anonymous Coward · · Score: 0

    It's the only way they pay notice.

  5. Those are "Speed Holes" by decipher_saint · · Score: 2, Funny

    For faster internet DUH

    --
    crazy dynamite monkey
    1. Re:Those are "Speed Holes" by UnknowingFool · · Score: 1

      Pschaw. Every one knows you also need racing stripes with speed holes for the fastest internet.

      --
      Well, there's spam egg sausage and spam, that's not got much spam in it.
    2. Re:Those are "Speed Holes" by Neuronwelder · · Score: 1

      LOL!!

    3. Re:Those are "Speed Holes" by Neuronwelder · · Score: 1

      I was laughing at the speed holes comment, please to get me confused.

    4. Re:Those are "Speed Holes" by Anomalyst · · Score: 1

      And an exrra cost $99 Munster power cable (withmatching racing stripe) the gold-plated prongs will smooth out those nasty voltage sags and reduce Petahertz heterodyning interference.

      --
      There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
    5. Re:Those are "Speed Holes" by Anonymous Coward · · Score: 0

      It's smooths the current of data and reduces packet turbulence which brings down a net and another.

    6. Re:Those are "Speed Holes" by arglebargle_xiv · · Score: 1

      For faster internet

      And great justice!

    7. Re:Those are "Speed Holes" by KingMotley · · Score: 1

      If they were serious about faster internet, they would paint their routers red instead of the slow white/black.

  6. Same Tune, New Stanza by TheHawke · · Score: 1

    Do these sound familiar? Google Quanta router security holes. You'll find the issues that the D-Link has are remarkably similar to what the Quanta firmware had.

    I could safely guess is that Quanta foisted the firmware and designs off onto D-Link for a small tune so they could recover some of the cost.

    BTW, the tech that found the D-Link issues, found the holes in the Quanta routers as well.

    --
    First rule of holes; When in one, stop digging.
  7. Hey! by halivar · · Score: 3, Funny

    Guess who has two thumbs and bought a D-Link router yesterday?

    *This* dumbass. :(

    1. Re:Hey! by Anonymous Coward · · Score: 2, Informative

      Guess who has two thumbs and bought a D-Link router yesterday?

      *This* dumbass. :(

      return it... we have to push back on bad products in a way that manufactures will understand, return the product as defective.

    2. Re:Hey! by A10Mechanic · · Score: 2

      Bob Kelso? But seriously, never look at car prices after you've bought a car, and avoid SlashDot after buying tech gear.

    3. Re:Hey! by skegg · · Score: 1

      Nice one, Alice.

    4. Re:Hey! by adolf · · Score: 1

      Surely you can shove OpenWRT, Shibby's build of version of Tomato-USB, or (*shudder*) DD-WRT on the thing, yes?

      --
      Kid-proof tablet..
    5. Re:Hey! by barc0001 · · Score: 2

      I haven't bought a D-Link router in years. They used to be all right value for the money but over the last 6-8 years it seems like the quality vastly varied between even small model revisions so I got tired of the D-Link Russian Roulette and started buying other routers. ASUS routers have been consistently good in my experience so far, Linksys is a crap shoot like D-Link so I avoid, NetGear is utilitarian but acceptable.

    6. Re:Hey! by Narcocide · · Score: 2

      Linksys stopped being good sometime shortly after being sold to Cisco. NetGear is usually fine but will fall over under heavy traffic if you add too many custom routes.

    7. Re:Hey! by shellster_dude · · Score: 1
      To quote the article:

      As the router has a sizable memory (168 MB), a decent CPU and good free space (235 MB) with complete toolkits installed by default (sshd, proxy, tcpdump )

      So why not just take advantage of having awesome hardware, and replace the crappy firmware with something else like OpenWRT?

    8. Re: Hey! by Anonymous Coward · · Score: 0

      Because only one in a hundred (one in a thousand?) purchasers will have any idea that such a thing exists, and only a small fraction of those will actually replace the firmware.

    9. Re:Hey! by adolf · · Score: 1

      In this lesser Slashdot that we have these days (wherein I don't even see anyone saying "just use an old box for pfsense and be done"), I'll second Asus.

      The stock firmware is allegedly built upon OpenWRT, and for those that like Tomato-USB/Shibby, they're generally all well-supported.

      I have had many small networks that would have fallen over (and indeed, were actively falling-over), which were absolutely saved by proper QoS rules in Shibby's builds of Tomato-USB.

      For the home-gamer: Multiple massive torrents, voip, and Netflix, Youtube, general web browsing and email, and low-latency gaming on the same absolutely-saturated cheap last-mile pipe? Easily handled, and all work fine.

      --
      Kid-proof tablet..
    10. Re:Hey! by arglebargle_xiv · · Score: 1

      I pretty much put D-Link on my permanent never-buy blacklist after having to play with a DSL-502. Dear ghod, how can you cram so much fail into such a small box?

    11. Re:Hey! by naughtynaughty · · Score: 1

      Why use an old box for pfSense when you can buy an outstanding Intel N3150 based tiny box that consumes 10W for less than $130?

      Stop buying routers for WiFi and buy a plain, simple AP and stick it behind pfSense.

    12. Re:Hey! by adolf · · Score: 1

      Why do that, when for $50-$100 you can get an ARM box that just does everything -- including AP duties -- while also consuming insignificant power?

      It even comes with a reasonably-good Gigabit switch that can also tackle VLAN duties.

      Thanks for the flame, though. It almost felt like old times.

      --
      Kid-proof tablet..
    13. Re:Hey! by Fnord666 · · Score: 1

      Why do that, when for $50-$100 you can get an ARM box that just does everything -- including AP duties -- while also consuming insignificant power?

      It even comes with a reasonably-good Gigabit switch that can also tackle VLAN duties.

      Would you mind sharing a link or at least a name?

      --
      'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
    14. Re:Hey! by barc0001 · · Score: 1

      >(wherein I don't even see anyone saying "just use an old box for pfsense and be done")

      As I've gotten older and I do this stuff for my day job my enthusiasm for doing it on off hours has waned, especially now that there are consumer devices that will get you 99% of the way there with very little hassle and the devices are silent and small compared to even an old HTPC case. A lot of people aren't going to customize anything if they can get close enough with an off the shelf product. That said, I did throw Tomato on my ASUS RT-N16 so perhaps I am not 100% sold on off the shelf.

    15. Re:Hey! by adolf · · Score: 2

      Sure. I use one of these, with this firmware, making it a cute little self-contained Linux box with both a HTML GUI and a command-line interface that is as complete as you want to make it. (I've got a build environment on mine, just because I can.)

      802.11ac, dual-core 800MHz ARM, 256MB of RAM and 128MB of flash (all of which are complete overkill for this application), along with multiple USB ports for plugging in random goodies.

      --
      Kid-proof tablet..
  8. There's Your Problem. by Anonymous Coward · · Score: 1, Insightful

    UPnP has no security.

    Only morons leave it enabled on Home routers.

    1. Re:There's Your Problem. by Anonymous Coward · · Score: 1

      The problem manifested here is yours: only morons make blanket statements concerning the intelligence of large groups of people without clinical testing to back it up. Most of those people are not morons, they're just educated in other domains.

    2. Re:There's Your Problem. by Anonymous Coward · · Score: 0

      I tried, but it broke all of my consoles and several games. It's difficult to forward ports when they're randomly decided at the time the connection is about to be made.

    3. Re: There's Your Problem. by Anonymous Coward · · Score: 0

      IOW only a moron underestimates the power of large groups of other morons.

    4. Re:There's Your Problem. by Anonymous Coward · · Score: 0

      Most of those people are not morons, they're just educated in other domains.

      And I'm still better than most people in their own domains even if I have no education or experience in their domain. If you considered "logic" as a domain that encompasses nearly domains except human interaction, then I'm a master in that super-domain.

  9. Don't just stop using it. by Anonymous Coward · · Score: 1

    At the very least return it for a full refund. If you feel litigious, sue D-Link. Backdoor accounts and other deliberate vulnerabilities must become expensive for the dickheads who make them.

  10. So which routers have good security? by Anonymous Coward · · Score: 1

    Cisco, Linksys, D-Link all have security problems. At this point I would hazard a guess that most routers have security problems.

    So which SOHO routers *don't* have security problems? What can I tell my non-computer-savy relatives to get?

    Do you have to flash DD-WRT software to improve the security situation?

    1. Re:So which routers have good security? by Narcocide · · Score: 1

      What can I tell my non-computer-savy relatives to get?

      An education, or at least better help.

      Do you have to flash DD-WRT software to improve the security situation?

      An old used PC with 2 or more ethernet ports that's running OpenBSD also does just fine.

    2. Re:So which routers have good security? by Gaygirlie · · Score: 1

      I just assume they *all* have security-problems and look for routers that have the hardware-features I want and that are supported by OpenWRT instead.

    3. Re:So which routers have good security? by naughtynaughty · · Score: 1

      An old used PC is such a memory hog, as well as likely being a space hog and noisy. You'll spend more money on electricity than the money it would take to buy a modern tiny PC to do the job better.

      Intel N3150 based tiny PC, 2GB SODIMM and a 4GB flash drive will set you back $130. Silent, small as a fat paperback book and you'll save $50 in electricity per year compared to that old noise maker.

      Reusing old PCs sounds environmentally friendly but it probably is short sighted.

    4. Re:So which routers have good security? by hodet · · Score: 1

      I would love a Raspberry Pi with two Ethernet ports. That would be my new router.

    5. Re:So which routers have good security? by Anonymous Coward · · Score: 0

      Sorry to post as AC, but I don't have my password handy.

      Buffalo has a line of SOHO routers that run DD-WRT from the factory. I use one and it's solid and reliable.

      http://www.buffalotech.com/pro...

    6. Re:So which routers have good security? by hodet · · Score: 1

      I recently bought a Cisco 4200v1 and D-Link DIR615 at a yardsale for $10. Slapped OpenWRT on them. $10 lol.

    7. Re:So which routers have good security? by Narcocide · · Score: 1

      You're on the right track, but even if you add a second ethernet device the Raspberry Pi itself only has enough throughput to keep up with basic DSL speeds. There are other, less popular single-board ARM computers that would be better suited for this task.

  11. Product recall time? by davidwr · · Score: 1

    Not only is it not fit for its advertised purpose, it's unsafe to use.

    --
    Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
    1. Re:Product recall time? by Anomalyst · · Score: 1

      Rough Nadir announces his new consumer retorts sponsored book
      "Unsafe at any BPS"

      --
      There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
  12. D-link has always been shit by Anonymous Coward · · Score: 0

    And always will be.

  13. Fuck D-Link by honestmonkey · · Score: 1

    I've said it before. Fuck D-Link and fuck their routers. May they rot in hell.

    --
    Everything you know is wrong, Just forget the words and sing along.
    1. Re:Fuck D-Link by Anomalyst · · Score: 1

      fuck their routers

      Mixing saline bodily fluids and electrical equipment likely voids the warranty and that it's not the volts, its the amperage that's the real danger.

      --
      There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
    2. Re:Fuck D-Link by hodet · · Score: 1

      Shit you really hate D-Link.

  14. loonix by Anonymous Coward · · Score: 0

    loonix strikes again. stop using this crap people.. FFS!

  15. Don't buy a router unless you can install openwrt. by anwyn · · Score: 3, Insightful

    Where ever you look commercial routers are full of security vulnerabilities.

  16. Researcher find? by reboot246 · · Score: 1

    Who the hell wrote that headline? Is English your second language?

    1. Re:Researcher find? by Anonymous Coward · · Score: 0

      They only remind us the site is US centric. That doesn't mean the editors don't work from India now.....

    2. Re:Researcher find? by Anonymous Coward · · Score: 0

      Don't you get it?
      It's newspaper headline style with 'find' as a nouned verb (where 'nouned' is a verbed noun).

  17. flashrouters.com by Anonymous Coward · · Score: 0

    Many of my wifi routers are now laptops running hostapd, but the ones that are not I buy with open firmware from these guys: https://www.flashrouters.com/

    1. Re: flashrouters.com by WarJolt · · Score: 1

      You have some incredibly power hungry routers.

  18. Re: Correction ( Score: +1, TrumpIsACokehead ) by Anonymous Coward · · Score: 0

    Far, far too verbose. I quit after the third made-up word. Admit it, you swallowed three sets of Scrabble and Will Self. Best stick your fingers down your throat before it happens again.

  19. D-Link security by Z80a · · Score: 1

    Those D-Link routers are actually very, very secure.
    No attacker (or you) are able to properly send or receive packets on it's network (when you can actually get in it), which thwart most attacks.

  20. Re:Don't buy a router unless you can install openw by Anonymous Coward · · Score: 0

    +1

  21. The D-Link DWR-932 case is very tight... by LordHighExecutioner · · Score: 1

    ...so they had to place holes elsewhere for a proper CPU venting.

  22. D-Link is the most secure by a_claudiu · · Score: 1

    In fact is indestructible https://www.youtube.com/watch?...

  23. Re:Don't buy a router unless you can install openw by Anonymous Coward · · Score: 0

    The research for network protocols was done by the American universities as part of a government funded research program into fault-tolerant networks. The assumption had been that TCP/IP would always be run on networks in secure environments. They had some whack-a-doodle ideas (like trailer packets with the header at the end of the packet). Everything is documented in the RFC lists.

    It took third party companies to clean up and optimize the TCP/IP stack, then sell it on as a usable product.

  24. If you bought a router, it's junk. by Anonymous Coward · · Score: 0

    If you bought a router, any router, it is only a matter of time before it will be compromised.

    Do yourself a favor and use Smoothwall.

  25. D-Link routers can be broken hardware wise too by foxalopex · · Score: 1

    I remember an article years ago of a D-Link router where they cheaped out and left out a filtering capacitor. An engineer figured this out because hilariously they left the solder pads on the actual circuit boards so a fix was to solder in your own filtering capacitor. The missing capacitor resulted in the power supply being noisy and eventually corrupting ram which would lead to the router crashing. D-Link of course in their brilliance figured the quick fix was to reboot your router every 15 minutes, stable connection be dammed. This wasn't even a bright decision in the long run because I imagine all the tech support calls would have killed whatever savings that single part meant.

    At the end of the day folks, buy a good reliable router that works with opensource firmware. (I prefer shibby tomato.) and almost never experience problems again.

  26. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  27. Re: Correction ( Score: +1, TrumpIsACokehead ) by Anonymous Coward · · Score: 0

    Maybe he will share :D