Slashdot Mirror
Researcher Find D-Link DWR-932 Router Is 'Chock Full of Holes' (helpnetsecurity.com)
Reader JustAnotherOldGuy writes: Security researcher Pierre Kim has unearthed a bucketload of vulnerabilities in the LTE router/portable wireless hotspot D-Link DWR-932. Kim found the latest available firmware has these vulnerabilities: Two backdoor accounts with easy-to-guess passwords that can be used to bypass the HTTP authentication used to manage the router
-A default, hardcoded Wi-Fi Protected Setup (WPS) PIN, as well as a weak WPS PIN generation algorithm
- Multiple vulnerabilities in the HTTP daemon
- Hardcoded remote Firmware Over The Air credentials
- Lowered security in Universal Plug and Play, and more.
"At best, the vulnerabilities are due to incompetence; at worst, it is a deliberate act of security sabotage from the vendor," says Kim, and advises users to stop using the device until adequate fixes are provided.
-A default, hardcoded Wi-Fi Protected Setup (WPS) PIN, as well as a weak WPS PIN generation algorithm
- Multiple vulnerabilities in the HTTP daemon
- Hardcoded remote Firmware Over The Air credentials
- Lowered security in Universal Plug and Play, and more.
"At best, the vulnerabilities are due to incompetence; at worst, it is a deliberate act of security sabotage from the vendor," says Kim, and advises users to stop using the device until adequate fixes are provided.
Of course it is David, it's D-Link.
I first read "bucketload" as Buckethead.
Regarding Donald Trump:
Half of me was reluctant to write this letter out of concern that Donald Trump may be one of those people who say choleric things for the sole purpose of gaining attention. But given Trump's track record, I have concluded that an unholy alliance of pretentious Zendiks and the most inimical pillocks you'll ever see has been instrumental in devising increasingly illaudable ways to replace intellectual discourse with programs designed to instill sectarian and ideological doctrines, so I've decided to proceed. I can think of no better place to start than by noting that if you're the type who dares to think for yourself then you've probably already determined that if we look beyond his delusions of grandeur, we see that it is of vital importance that we straighten out our thinking and change the path we're on. It is a matter of life and death, a road either to safety or to ruin. That's why I proclaim that you should check out some of the things Trump is saying about irreligionism. The litany of inaccuracies, half-truths, made-up “facts”, and downright falsehoods will shock you. And I won't even bother mentioning that we must decidedly stick to the facts and offer only those arguments that can be supported by those facts. A compossible option is to encourage individuals to come out of their cocoons and flourish. If we follow that approach, however, we must bear in mind that a former member of Trump's klatch of grumpy theologasters has called Trump a perfidious falsifier. I admire this person's courage, but I disagree with his use of the term “perfidious falsifier”. It's not solely because Trump is a perfidious falsifier that he has been doing anything and everything needed to further his loathsome cause. Rather, he's been doing this because he teaches workshops on sensationalism. Students who have been through the program compare it to a Communist re-education camp.
The law is not just a moral stance. It is the consensus of society on our minimum standards of behavior. When lying and evidence-tampering fail, Trump usually turns to outright intimidation to damage the self-esteem and physical health of millions of young men and women. In fact, I have said that to Trump on many occasions, and I will keep on saying it until he stops sullying a profession that's already held in low esteem. Though many people agree that we must work together against factionalism, prætorianism, ruffianism, etc., Trump's hangers-on consider his modes of thought a breath of fresh air. I, however, find them more like the fetid odor of opportunism.
If there's one thing that Trump is good at, it's spreading the germs of hatred, of discord and jealously, of dissolution and decomposition. Trump sincerely believes that the only way to expand one's mind is with drugs—or maybe even chocolate. Unfortunately for him, that's all in his imagination. Trump needs to get out of that fictional world and get back to reality, where people can see that he sometimes has trouble convincing people that metagrobolism is a sine qua non for mankind's happiness. When he has such trouble, he usually trots out a few ill-bred quodlibetarians to constate authoritatively that our only chance of saving the planet is to accept unending regulations and straightjacket “reforms” from Trump's myrmidons. Whether or not that trick of his works, it's still the case that Trump is completely vulgar. We all are, to some extent, but he sets the curve. Stripping from the term “parthenogenetic” the negative connotations it evokes, I will try to work together towards a shared vision.
I am not mistaken when I say that it remains to be seen whether Trump's flock is capable of self-critique. Will its members acknowledge their own insularity and excesses, or will they continue down the path of smug self-congratulation and vanity, never passing up an opportunity to destroy our culture, our institutions, and our way of life? In either case, there are
D-Link sucks so bad its UPnP security is worse than none at all!
They just hired some teen with basic computing skills who can package and upload roms, zero security experts working at d-link in taiwan... (and they have plenty of educated people in the field there, but it's cheaper to hire a teen)
It's the only way they pay notice.
For faster internet DUH
crazy dynamite monkey
Do these sound familiar? Google Quanta router security holes. You'll find the issues that the D-Link has are remarkably similar to what the Quanta firmware had.
I could safely guess is that Quanta foisted the firmware and designs off onto D-Link for a small tune so they could recover some of the cost.
BTW, the tech that found the D-Link issues, found the holes in the Quanta routers as well.
First rule of holes; When in one, stop digging.
Guess who has two thumbs and bought a D-Link router yesterday?
*This* dumbass. :(
UPnP has no security.
Only morons leave it enabled on Home routers.
At the very least return it for a full refund. If you feel litigious, sue D-Link. Backdoor accounts and other deliberate vulnerabilities must become expensive for the dickheads who make them.
Cisco, Linksys, D-Link all have security problems. At this point I would hazard a guess that most routers have security problems.
So which SOHO routers *don't* have security problems? What can I tell my non-computer-savy relatives to get?
Do you have to flash DD-WRT software to improve the security situation?
Not only is it not fit for its advertised purpose, it's unsafe to use.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
And always will be.
I've said it before. Fuck D-Link and fuck their routers. May they rot in hell.
Everything you know is wrong, Just forget the words and sing along.
loonix strikes again. stop using this crap people.. FFS!
Where ever you look commercial routers are full of security vulnerabilities.
Who the hell wrote that headline? Is English your second language?
Many of my wifi routers are now laptops running hostapd, but the ones that are not I buy with open firmware from these guys: https://www.flashrouters.com/
Those D-Link routers are actually very, very secure.
No attacker (or you) are able to properly send or receive packets on it's network (when you can actually get in it), which thwart most attacks.
+1
...so they had to place holes elsewhere for a proper CPU venting.
In fact is indestructible https://www.youtube.com/watch?...
The research for network protocols was done by the American universities as part of a government funded research program into fault-tolerant networks. The assumption had been that TCP/IP would always be run on networks in secure environments. They had some whack-a-doodle ideas (like trailer packets with the header at the end of the packet). Everything is documented in the RFC lists.
It took third party companies to clean up and optimize the TCP/IP stack, then sell it on as a usable product.
If you bought a router, any router, it is only a matter of time before it will be compromised.
Do yourself a favor and use Smoothwall.
I remember an article years ago of a D-Link router where they cheaped out and left out a filtering capacitor. An engineer figured this out because hilariously they left the solder pads on the actual circuit boards so a fix was to solder in your own filtering capacitor. The missing capacitor resulted in the power supply being noisy and eventually corrupting ram which would lead to the router crashing. D-Link of course in their brilliance figured the quick fix was to reboot your router every 15 minutes, stable connection be dammed. This wasn't even a bright decision in the long run because I imagine all the tech support calls would have killed whatever savings that single part meant.
At the end of the day folks, buy a good reliable router that works with opensource firmware. (I prefer shibby tomato.) and almost never experience problems again.
Comment removed based on user account deletion