Slashdot Mirror
Backdoor Account Found in D-Link DIR-620 Routers (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: Security researchers have found a backdoor account in the firmware of D-Link DIR-620 routers that allows hackers to take over any device reachable via the Internet. Discovered by Kaspersky Lab researchers, this backdoor grants an attacker access to the device's web panel, and there's no way in which device owners can disable this secret account. The only way to protect devices from getting hacked is to avoid having the router expose its admin panel on the WAN interface, and hence, reachable from anywhere on the Internet.
This is why I will never buy or recommend any router that cannot be flashed/used with OpenWRT/LEDE.
https://www.youtube.com/watch?v=s1A4B9AzFNU#t=1m26s
I don't know how many people actually enable WAN access to begin with. And it's off by default.
But, regardless, that's probably not the major problem. The major problem comes if your own network is compromised, say, by an IoT device. Then it potentially has a password to your router.
That seems to me to be likely a much bigger problem.
You are not alone. This is not normal. None of this is normal.
Tweaking the router remotely for your elderly parents or other friends is a valid use-case... Yes, you can — and I do — achieve that by ssh-ing into a Unix computer behind the router, and then use a tunnel to talk to the router's LAN interface. But that may be too complex for most people, wouldn't you agree?
In Soviet Washington the swamp drains you.
Cannot be flashed with third party firmware. I use OpenWRT and DD-WRT and I *refuse* to buy any consumer router that doesn't have at least a porting effort to one of these third party firmware packages.
It's not a perfect solution, but it's one heck of a lot better than just trusting the manufacturer to do the right thing and fix their security issues in a timely manner.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Why would anyone still buy anything from D-Link or e.g. Cisco?
With their stuff, backdoors are not the exception but mandatory feature for every device they sell. 2013, 2016, now.
https://www.theregister.co.uk/... DIR-100, DI-524, DI-524UP, DI-604S, DI-604UP, DI-604+ and TM-G5240" maybe more.
https://thehackernews.com/2016... DWR-932 B
So, sure once maybe it's an error or oversight. But the number of backdoors with pretty much all router manufacturers, from low end cheapo consumer D-Link to usurious Cisco plated with gold stuff, shows it's not an oversight but pretty much deliberate. Both manufacturers are only examples here. All of them have similar holes several times over the last few years, repeatedly. Or they are too incompetent to be allowed to design and then sell anything to the public.
Too complex for most people - yes
Too complex for someone who can be trusted to remotely tweak a router - no
At this point, I think it's fair to say that it was a backdoor that also had a router. Indeed I suspect the router was probably found left on the backdoor.
Some drink at the fountain of knowledge. Others just gargle.
they rather you go buy a new D-Link Router, if i had one of these routers i would be sure to buy another brand, but if D-Link quickly made a new firmware and patched my router it would give me confidence in D-Link's attention to detail and would gladly make my next router a D-Link product, (something to think about D-Link people)
Politics is Treachery, Religion is Brainwashing
I basically just use an old Dell and threw OpenBSD on it. I have something that is really functional and secure.
And this is why I finished with commercial router firmware.
First Tomato, then dd-wrt, now pfSense on custom hardware.
I'd like to replace my vendor supplied router with one running open software.
I'm just not sure which is considered the most current, or the pros and cons of the various distros.
* DD-WRT
* OpenWRT
* Lede
* Tomato (is that even still around)?
etc...
Suggestions? (Maybe I should make this an Ask Slashdot?)
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
If I were to help my parents out with their router, I'd simply remote in to one of their computers and proceed. There is absolutely no way I'd ever expose critical infrastructure to the wild wild web.
And what is your suggestion for the case mentioned by the GP "for your elderly parents or other friends"? As somebody suggested earlier "just use an old Dell and threw OpenBSD on it"? Let them have a full computer just so you can tunnel through the router to it and then access from it the router interface? There's always a compromise between security and convenience and really in this case it isn't the worst compromise possible to just let the router interface available. I bet there are out there many more ancient windows boxes that haven't been patched for many years, fully exposed to internet than these routers.
I knew a guy who was running one 2 years ago. Far bigger problem than any built in account was that he had the WiFi set up to use WEP, since that was the standard back when he first configured it.
Cheaper than possible developers at work. They think this is the thing to do for easy debugging and, since nobody will ever find that password (right?), it can just be left in. Yes, morons on that level do not only exist, there are a lot of them in the industry.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
ArchieBunker demanded:
Have you done an audit of the code yourself? Are you sure anyone else has? Would you know what to look for?
I use DD-WRT exclusively on all my routers.
It's 100% open source, and there are several people who are still actively developing it. In addition, there's a lot of security-savvy users who closely examine and pen-test each release.
In 2008, a pair of backdoor IP addresses were discovered in the code (placed there by one of the developers, at a customer's request). Both were accessible only from the NAT side of the router, and both were removed within an hour of being reported ...
Check out my novel.
Yes, but most of those ancient windows systems are behind routers and firewalls which prevents them from being readily accessed from the internet. However, having the firewall/router accessible from the internet just exposed all those systems behind it...
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
"The only way to protect devices from getting hacked is to avoid having the router expose its admin panel on the WAN interface"
Why would you willingly expose even the most secure login page to the net if you didn't have to? Between bruteforce, backdoor accounts, overflow errors, URL manipulation, and yes, even the dreaded default password,
tl;dr: Why do you have your admin panel WAN-accessible in the first place? -_-
They are too good at finding US backdoors in US products.
So, you are fine exposing "one of their computers" to the "wild wild web", but not the router itself?.. Because routers are somehow uniquely exploitable?
In Soviet Washington the swamp drains you.
Most of those "fully exposed to internet" systems are "behind routers and firewalls"?
He wasn't in a rural area; he was in a heavily populated city. From his house I could pick up more than 20 other APs.
There are numerous known weaknesses in WPA, but it's nowhere near as insecure as WEP. I've never seen a WEP AP which couldn't be broken into in a matter of minutes. The amount of time it would take with WPA can vary wildly depending on numerous factors but will typically be much longer.
Kaspersky is a shill of the Russian government right?
We don't trust anything they say!
I was expecting this level of paranoia. A 30-minute session in a program I won't mention because neckbeards annoy me, problem solved, and program closed, is better than exposing a router 24/7.
I happen to have an old DIR 620 Router of which I'm locked out ....
Whatever program you are using, neckbeard, talking to whatever computer, if you want to tweak a device without moving your dimply behind into very close physical proximity of the device in question, you must allow remote access of some sort — that is, as you put it, expose something to the "wild wild web". That's a given and unavoidable risk inherent in the requirement.
The entire conversation is about mitigating this risk — such as by using a more secure protocol or a more reliable device.
My preference is ssh-ing into a FreeBSD computer behind the router — because I trust ssh and FreeBSD more than I trust router-makers. Most people, yourself included by all appearances, use Windows at home, and I struggle trying to understand, why you'd prefer trusting Windows over the router firmware...
Whatever your personal preference, the use-case I described remains valid.
In Soviet Washington the swamp drains you.
Holy Messiah, it's not complicated. Mum connects to a hosted service, I connect to same hosted service. The security of this hosted service is orders of magnitude beyond what I could do on my own. And, again, 30 minutes later we're DISCONNECTED.
It is also a magnet for hackers and subpoenas... It also costs you money, or privacy, or both.
It is perfectly legitimate to not want any third parties involved...
Finally, if you are willing to have your mom involved in the tweaking process at all, instead of training her to use this 3rd-party, you can teach her to enable the WAN-access feature of the router — and disable it 30 minutes later.
In Soviet Washington the swamp drains you.
Fuck off. And while you're fucking off, shave that stupid neck.
Seldom is one's online-debate victory quite as complete, as this one is today... You made it adversarial, and then lost.
Not only are you bad at anything IT, you are, evidently, a bad person as well.
In Soviet Washington the swamp drains you.