Slashdot Mirror
Backdoor Account Found in D-Link DIR-620 Routers (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: Security researchers have found a backdoor account in the firmware of D-Link DIR-620 routers that allows hackers to take over any device reachable via the Internet. Discovered by Kaspersky Lab researchers, this backdoor grants an attacker access to the device's web panel, and there's no way in which device owners can disable this secret account. The only way to protect devices from getting hacked is to avoid having the router expose its admin panel on the WAN interface, and hence, reachable from anywhere on the Internet.
This is why I will never buy or recommend any router that cannot be flashed/used with OpenWRT/LEDE.
https://www.youtube.com/watch?v=s1A4B9AzFNU#t=1m26s
I don't know how many people actually enable WAN access to begin with. And it's off by default.
But, regardless, that's probably not the major problem. The major problem comes if your own network is compromised, say, by an IoT device. Then it potentially has a password to your router.
That seems to me to be likely a much bigger problem.
You are not alone. This is not normal. None of this is normal.
Cannot be flashed with third party firmware. I use OpenWRT and DD-WRT and I *refuse* to buy any consumer router that doesn't have at least a porting effort to one of these third party firmware packages.
It's not a perfect solution, but it's one heck of a lot better than just trusting the manufacturer to do the right thing and fix their security issues in a timely manner.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Why would anyone still buy anything from D-Link or e.g. Cisco?
With their stuff, backdoors are not the exception but mandatory feature for every device they sell. 2013, 2016, now.
https://www.theregister.co.uk/... DIR-100, DI-524, DI-524UP, DI-604S, DI-604UP, DI-604+ and TM-G5240" maybe more.
https://thehackernews.com/2016... DWR-932 B
So, sure once maybe it's an error or oversight. But the number of backdoors with pretty much all router manufacturers, from low end cheapo consumer D-Link to usurious Cisco plated with gold stuff, shows it's not an oversight but pretty much deliberate. Both manufacturers are only examples here. All of them have similar holes several times over the last few years, repeatedly. Or they are too incompetent to be allowed to design and then sell anything to the public.
Too complex for most people - yes
Too complex for someone who can be trusted to remotely tweak a router - no
At this point, I think it's fair to say that it was a backdoor that also had a router. Indeed I suspect the router was probably found left on the backdoor.
Some drink at the fountain of knowledge. Others just gargle.
ArchieBunker demanded:
Have you done an audit of the code yourself? Are you sure anyone else has? Would you know what to look for?
I use DD-WRT exclusively on all my routers.
It's 100% open source, and there are several people who are still actively developing it. In addition, there's a lot of security-savvy users who closely examine and pen-test each release.
In 2008, a pair of backdoor IP addresses were discovered in the code (placed there by one of the developers, at a customer's request). Both were accessible only from the NAT side of the router, and both were removed within an hour of being reported ...
Check out my novel.
Merlin works well if your running an Asus device.
Cheap storage VM.