Slashdot Mirror
Backdoor Account Found in D-Link DIR-620 Routers (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: Security researchers have found a backdoor account in the firmware of D-Link DIR-620 routers that allows hackers to take over any device reachable via the Internet. Discovered by Kaspersky Lab researchers, this backdoor grants an attacker access to the device's web panel, and there's no way in which device owners can disable this secret account. The only way to protect devices from getting hacked is to avoid having the router expose its admin panel on the WAN interface, and hence, reachable from anywhere on the Internet.
This is why I will never buy or recommend any router that cannot be flashed/used with OpenWRT/LEDE.
https://www.youtube.com/watch?v=s1A4B9AzFNU#t=1m26s
I don't know how many people actually enable WAN access to begin with. And it's off by default.
But, regardless, that's probably not the major problem. The major problem comes if your own network is compromised, say, by an IoT device. Then it potentially has a password to your router.
That seems to me to be likely a much bigger problem.
You are not alone. This is not normal. None of this is normal.
I mean seriously, who in their mind would ever expose the admin interface to the WAN in the first place? There is no good reason to ever do this.
Tweaking the router remotely for your elderly parents or other friends is a valid use-case... Yes, you can — and I do — achieve that by ssh-ing into a Unix computer behind the router, and then use a tunnel to talk to the router's LAN interface. But that may be too complex for most people, wouldn't you agree?
In Soviet Washington the swamp drains you.
Cannot be flashed with third party firmware. I use OpenWRT and DD-WRT and I *refuse* to buy any consumer router that doesn't have at least a porting effort to one of these third party firmware packages.
It's not a perfect solution, but it's one heck of a lot better than just trusting the manufacturer to do the right thing and fix their security issues in a timely manner.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Nobody said or implied it provides an absolute guarantee of security.
Why would anyone still buy anything from D-Link or e.g. Cisco?
With their stuff, backdoors are not the exception but mandatory feature for every device they sell. 2013, 2016, now.
https://www.theregister.co.uk/... DIR-100, DI-524, DI-524UP, DI-604S, DI-604UP, DI-604+ and TM-G5240" maybe more.
https://thehackernews.com/2016... DWR-932 B
So, sure once maybe it's an error or oversight. But the number of backdoors with pretty much all router manufacturers, from low end cheapo consumer D-Link to usurious Cisco plated with gold stuff, shows it's not an oversight but pretty much deliberate. Both manufacturers are only examples here. All of them have similar holes several times over the last few years, repeatedly. Or they are too incompetent to be allowed to design and then sell anything to the public.
Too complex for most people - yes
Too complex for someone who can be trusted to remotely tweak a router - no
At this point, I think it's fair to say that it was a backdoor that also had a router. Indeed I suspect the router was probably found left on the backdoor.
Some drink at the fountain of knowledge. Others just gargle.
they rather you go buy a new D-Link Router, if i had one of these routers i would be sure to buy another brand, but if D-Link quickly made a new firmware and patched my router it would give me confidence in D-Link's attention to detail and would gladly make my next router a D-Link product, (something to think about D-Link people)
Politics is Treachery, Religion is Brainwashing
If you are able to 'tweak' routers - it should be trivial for you to set up SSH/VPN etc. People who don't have that level of ability should not be bother to modify their router at all, since they'll do more damage in balance, for example, by enabling WAN access allowing others to hack their router...
I basically just use an old Dell and threw OpenBSD on it. I have something that is really functional and secure.
Tweaking the router remotely for your elderly parents or other friends is a valid use-case.
Nope. It's actually invalid since such tweaking inevitably leads to them to further exposure, so it's actually more dumb to do it that way.
You are really a good salesman for Russia, you should go back there.
And this is why I finished with commercial router firmware.
First Tomato, then dd-wrt, now pfSense on custom hardware.
Russia didn't want this guy and told him to go and peddle his salesmen scams to the united states of asssuckery who will buy anything as long as they can make a donkey off of it.
you should crawl back to the hole you came out of and die in front of it.
...where the backdoor has not been found yet?
More open ports == more open holes.
I have exactly one port open, 22, running ssh, but not on port 22 on the WAN side, but its port-knocked, geo-blocked, and other small security provisions.
If I need to access the router, that's what sshuttle, or ssh -D dynamic forwarding is for.
Also, if a router doesn't have a CLI, it's nothing more than a toy.
I'd like to replace my vendor supplied router with one running open software.
I'm just not sure which is considered the most current, or the pros and cons of the various distros.
* DD-WRT
* OpenWRT
* Lede
* Tomato (is that even still around)?
etc...
Suggestions? (Maybe I should make this an Ask Slashdot?)
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
How hard can it be to not just link to idiot's favourite website bleepingcomputer but to link to the actual "research"?
Awesome, so the ZERO of these that are actually still in service should be upgraded right away...
*sigh*
If I were to help my parents out with their router, I'd simply remote in to one of their computers and proceed. There is absolutely no way I'd ever expose critical infrastructure to the wild wild web.
And what is your suggestion for the case mentioned by the GP "for your elderly parents or other friends"? As somebody suggested earlier "just use an old Dell and threw OpenBSD on it"? Let them have a full computer just so you can tunnel through the router to it and then access from it the router interface? There's always a compromise between security and convenience and really in this case it isn't the worst compromise possible to just let the router interface available. I bet there are out there many more ancient windows boxes that haven't been patched for many years, fully exposed to internet than these routers.
Cheaper than possible developers at work. They think this is the thing to do for easy debugging and, since nobody will ever find that password (right?), it can just be left in. Yes, morons on that level do not only exist, there are a lot of them in the industry.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
ArchieBunker demanded:
Have you done an audit of the code yourself? Are you sure anyone else has? Would you know what to look for?
I use DD-WRT exclusively on all my routers.
It's 100% open source, and there are several people who are still actively developing it. In addition, there's a lot of security-savvy users who closely examine and pen-test each release.
In 2008, a pair of backdoor IP addresses were discovered in the code (placed there by one of the developers, at a customer's request). Both were accessible only from the NAT side of the router, and both were removed within an hour of being reported ...
Check out my novel.
Yes, but most of those ancient windows systems are behind routers and firewalls which prevents them from being readily accessed from the internet. However, having the firewall/router accessible from the internet just exposed all those systems behind it...
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
"The only way to protect devices from getting hacked is to avoid having the router expose its admin panel on the WAN interface"
Why would you willingly expose even the most secure login page to the net if you didn't have to? Between bruteforce, backdoor accounts, overflow errors, URL manipulation, and yes, even the dreaded default password,
tl;dr: Why do you have your admin panel WAN-accessible in the first place? -_-
They are too good at finding US backdoors in US products.
So, you are fine exposing "one of their computers" to the "wild wild web", but not the router itself?.. Because routers are somehow uniquely exploitable?
In Soviet Washington the swamp drains you.
Most of those "fully exposed to internet" systems are "behind routers and firewalls"?
So like Comcast in the US deploying crappy hole ridden hardware also happens with Russian ISP's and D Link. So tin foil hat people, begin your conspiracy about companies deploying equipment that can be access by anyone including governments. Seriously I would not trust Comcast or any Russian ISP not to do this.
it's the truth
as a firewall for years. Yes OpenBSD is probably more secure, but Linux is what I know.
Does everything I want with nice fine-grained filtering if that's what I need. Plus you can
ssh in and take a look at the external traffic for fun. The wireless router is just an access point,
I guess I have to trust that.
Kaspersky is a shill of the Russian government right?
We don't trust anything they say!
I was expecting this level of paranoia. A 30-minute session in a program I won't mention because neckbeards annoy me, problem solved, and program closed, is better than exposing a router 24/7.
The DNC called. They want their Russia shtick back.
I happen to have an old DIR 620 Router of which I'm locked out ....
Whatever program you are using, neckbeard, talking to whatever computer, if you want to tweak a device without moving your dimply behind into very close physical proximity of the device in question, you must allow remote access of some sort — that is, as you put it, expose something to the "wild wild web". That's a given and unavoidable risk inherent in the requirement.
The entire conversation is about mitigating this risk — such as by using a more secure protocol or a more reliable device.
My preference is ssh-ing into a FreeBSD computer behind the router — because I trust ssh and FreeBSD more than I trust router-makers. Most people, yourself included by all appearances, use Windows at home, and I struggle trying to understand, why you'd prefer trusting Windows over the router firmware...
Whatever your personal preference, the use-case I described remains valid.
In Soviet Washington the swamp drains you.
Holy Messiah, it's not complicated. Mum connects to a hosted service, I connect to same hosted service. The security of this hosted service is orders of magnitude beyond what I could do on my own. And, again, 30 minutes later we're DISCONNECTED.
It is also a magnet for hackers and subpoenas... It also costs you money, or privacy, or both.
It is perfectly legitimate to not want any third parties involved...
Finally, if you are willing to have your mom involved in the tweaking process at all, instead of training her to use this 3rd-party, you can teach her to enable the WAN-access feature of the router — and disable it 30 minutes later.
In Soviet Washington the swamp drains you.
Fuck off. And while you're fucking off, shave that stupid neck.
Seldom is one's online-debate victory quite as complete, as this one is today... You made it adversarial, and then lost.
Not only are you bad at anything IT, you are, evidently, a bad person as well.
In Soviet Washington the swamp drains you.
Wow, you managed to make mi look coherent and not a loon. Please don't post this kind of stuff again, it's obnoxious and shitty.