DECEMBER 2016
Scam Android apps attack routers with default passwords
Switcher: Android joins the attack-the-router club
by Nikita Buchka of Kaspersky Labs December 28, 2016
As router attacks go, this is small potatoes. Victims have to install the scam Android apps manually, they are not in the Play store. And, it only impacts TP-Link routers with default passwords. The malware, dubbed Trojan.AndroidOS.Switcher changes the DNS servers in the router, something that can be detected, even though the author of this report fails to point this out (see the Tests page). Its only newsworthy as the first Android apps to attack routers. Still, it has infected 1,280 Wi-Fi networks in China.
Flaws in three ZyXEL routers are not being fixed
ZyXEL and Netgear Fail to Patch Seven Security Flaws Affecting Their Routers
by Catalin Cimpanu of BleepingComputer.com December 26, 2016
SecuriTeam documented four security flaws affecting three routers manufactured by ZyXEL. Don't think you have a ZyXEL router? Look again, many companies put their own label on ZyXEL hardware. TrueOnline, a major ISP in Thailand providies ZyXEL routers to customers as do other ISPs. The known bad models are the P660HN-T v1, P660HN-T v2, and Billion 5200W-T. The routers are vulnerable to command injection on their web interface, which can be exploited by an unauthenticated attackers. Bad guys can thus take control of a router by issuing maliciously-crafted HTTP requests. It's not clear if the vulnerability is on the LAN side, WAN side or both. In addition, the routers come with hard coded backdoor credentials. Ugh. ZyXEL was notified of the problems in July 2016 and chose to stonewall. Thus, there is no workaround or fix.
Bug in the NETGEAR WNR2000
Stack buffer overflow vulnerability in NETGEAR WNR2000 router
by Pedro Ribeiro of Agile Information Security December 20, 2016
The Netgear WNR2000 router dates back to 2008. It does Wi-Fi "N" on the 2.4GHz band, period. It now sells for about $30.
It has a remote code execution flaw that is exploitable over the LAN by default or over the WAN if remote administration is enabled. According to Shodan, about 10.000 of these routers have remote admin turned on. Ribeiro reverse engineered the internal uhttpd web server and found that function apply_noauth.cgi allows an unauthenticated user to perform admin functions. Some of the functions, such as rebooting the router, can be exploited straight away by an unauthenticated attacker. Other functions, such as changing Internet, WLAN settings or retrieving the administrative password, require the attacker to send a "timestamp" variable. But Ribeiro reverse engineered the timestamp generating function due to a flaw in its random number generation. Combining this flaw with some other information leakage, it is possible to recover the administrator password. A stack buffer overflow was also discovered. Bottom line: an unauthenticated attacker can take full control of the device. Ribeiro tried to contact Netgear three times (Sept 26th, Oct 28th and Nov. 29th) and never got a response. However, now that this got some coverage in the press, Netgear has responded and will fix the problems.
DNS changing attack against MANY routers
Home Routers Under Attack via Malvertising on Windows, Android Devices
by Kafeine of Proofpoint December 13, 2016
Wow, this is bad. And made worse by being hard to detect and defend. Viewing a web page is all it takes to have a router attacked. The main goal of the malware is to change the DNS servers in the router. These server assignments normally propagate to all devices on a network. In some cases the malware also opens ports on the WAN side of the router leaving it vulnerable to other attacks. This malware was first seen 2015 when it exploited 55 known router flaws. This new improved version can exploit 166 known flaws, some of which work against several router models. If the malware can't find a known bug for a router, it tries to logon to the router with default credentials.
You do not have to visit a "bad" website, "the attack chain ensnares victim networks though legitimate web sites hosting malicious advertisements unknowingly distributed via legitimate ad agencies." Which routers are vulnerable? The article says "It is not possible to provide a definitive list of affected routers." That said, some routers were pointed out for being newly vulnerable: D-Link DSL-2740R, COMTREND ADSL Router CT-5367 C01_R12,
NetGear WNDR3400v3 (and likely other models in this series), Pirelli ADSL2/2+ Wireless Router P.DGA4001N and Netgear R6200.
Reading through the article, it's obvious that the malware is very sophisticated. What to do? "Unfortunately, there is no simple way to protect against these attacks." In a Dec. 19th update, Proofpoint wrote "At this time, a minimum of 56,000 routers have been compromised, but we expect that number is considerably higher."
Netgear router flaw affects 11 models
CERT
Warns Users to Stop Using Two Netgear Router Models Due to Security Flaw
by Catalin Cimpanu of Bleeping Computer
December 10, 2016
At least two Netgear routers, the R6400 and R7000 are vulnerable to a command injection flaw that is easy
to exploit and could lead to total takeover of the routers. There has, as yet, been no response from Netgear. CERT has gone so far as to say
"Users who have the option of doing so should strongly consider discontinuing use of affected devices until a fix is made available."
The documentation released so far does not make it clear if the devices are vulnerable on the LAN side only, WAN side only or both.
NOVEMBER 2016
TR-064 protocol abused in new attack
Port 7547 SOAP Remote Code Execution Attack Against DSL Modems
by Johannes Ullrich of Sans November 28, 2016
Port 7547 is used by a remote management protocol known as either TR-069 or CWMP. It has been trouble before and I already suggest testing for it on the Tester Page. A ton of mistakes involved here. There was a TR-064 server available to the Internet at large on port 7547 which is two mistakes right there. TR-064 suffers from information disclosure issues. On some routers at least, its also buggy letting attackers run commands and totally take over the router. Finally, some routers hang when dealing with too many incoming connections which is what the malware did to spread. So even routers that were not infected, were knocked off-line. Oh, and the malare is a new variant of Mirai. According to Shodan, about 41 Million devices have port 7547 open. This attack is confirmation of my position to not use a router provided by your ISP.
TP-Link ignores notification of router flaw
TP-LINK TDDP Multiple Vulnerabilities
by Core Security November 21, 2016
There are two flaws in the TP-Link WA5210g. Other TP-Link devices may also be vulnerable, only this one device was tested. The description of the flaws is,
itself, buggy. Core Security says the flaws are remotely exploitable, yet the problem is attacked via an open port on the LAN side. One flaw results in code execution. Another leaks the web interface configuration file, which includes the web login credentials. The flaws are in a debugging protocol (TDDP) that listens on LAN side UDP port 1040.
The timeline shows how little TP-Link cares about router security. They were initially notified Oct. 4th. Then again, Oct. 7th. Then again Oct. 31st and finally on Nov. 9th. There was no response to any of these contacts. Is that what you want from your router vendor? TDDP was again found to be buggy in March 2019, see the Router News page for more.
Yet another HNAP bug in D-Link routers
Turn off remote admin, SOHOpeless D-Link owners
by Richard Chirgwin of The Register November 8, 2016
Carnegie-Mellon Computer Emergency Response Team (CERT) reports a buffer overflow flaw in the HNAP service running on at least 8 D-Link routers. There is no fix from D-Link. The flaw can be exploited on the LAN side over port 80. The documentation is inconsistent as to whether it can also be exploited remotely. Known vulnerable models
are the: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L and DIR-868L. However, D-Link markets these routers using alternate names such as the AC5300 Ultra Wi-Fi Router so you may need to map the external name to the internal model number. The flaw was discovered by Pedro Ribeiro of Agile Information Security back in July 2016. It's not clear why it got no publicity until Nov. 7, 2016. D-link has a long history of vulnerabilities in their implementation of the HNAP protocol. CERT initially had no practical solution to this problem. On Nov. 10th, just days after this got publicity, D-Link issued the first round of patched firmware.
OCTOBER 2016
Still more attacks are changing DNS servers in routers
Cybercriminals target Brazilian routers with default credentials
by ESET October 21, 2016
Quoting: "Households and small businesses that use consumer-grade internet routers may fall victim to attacks that are currently targeting mainly Brazilian users, but may be easily localized to any other country. These attacks have been around since 2012, but the risks they carry are rising sharply ... we are closely monitoring these attacks in order to keep pace with recent developments in the attackers' techniques. It seems likely that there are different groups conducting these attacks ... The main objectives of these attacks are to change the DNS configuration, allow remote management of the router by accessing it with its public IP, and to set a predefined password - often the router's default password - for potential easy access for the perpetrators at a later time."
These attacks can be defended against by not using the default router password and not using the default router IP address. Also, check your current DNS servers using dnsleaktest.com and/or whoer.net.
TheMoon malware version 2 adds attacks on more routers
TheMoon Botnet Still Alive and Well After Two Years
by Catalin Cimpanu October 20, 2016
TheMoon worm was discovered in early 2014 attacking vulnerable Linksys routers. In response, Linksys issued a firmware update. In response, the bad guy added an attack on vulnerable Asus routers. Sending malicious UDP data lets a bad guy execute malware on vulnerable Asus routers. And, the malware adds firewall rules to protect an infected router from other malware. One of these rules protects D-Link routers from an HNAP SOAP flaw so it is assumed the malware also targets D-Link routers.
Two stories about routers with default passwords
At least 15% of home routers are unsecured
by Peter Stancik of ESET October 19, 2016
ESET tested more than 12,000 home routers and found that 15% used weak passwords. It's a matter of opinion as to whether this is good or bad
news. They also found, not surprisingly, that "admin" was the userid in most cases. As for bugs, they found that 7% had
"vulnerabilities of high or medium severity" and that 20% had Telnet open on the LAN side.
The very same day that ESET released its report, Brian Krebs wrote about a July 2015
conversation with someone who scanned the Internet for routers using default passwords, found over 250,000 of them and uploaded "some
kind software to each vulnerable system."
Bad guys frequently scan for router flaws
Home Routers - New Favorite of Cybercriminals in 2016
by Bing Liu of Fortinet October 12, 2016
Fortinet has been monitoring the outbreak of attacks targeting home routers. More and more scans are looking for known bugs in routers from D-Link, Asus and Netis. Back in August 2014, it was revealed that Netis routers have a hard coded password backdoor. Fortinet started looking for hacking attempts against this backdoor in July and there are many of them. A vulnerability that allowed Unauthenticated Remote Command Execution was discovered in D-Link routers back in 2013. Fortinet initially found very few bad guys trying to abuse this flaw, until this past summer when the hacking attempts went way up (two million in the last 30 days).
The Asus flaw is puzzling. It was disclosed in Jan. 2015
and has to do with the infosvr service listening on UDP port 9999. The bug lets an unauthenticated LAN side device execute commands in the router as the root user. What's puzzling is that the flaw was not supposed to be exploitable from the Internet. Yet, starting this past June, they saw a
"surge in activity" trying to exploit it.
SEPTEMBER 2016
A D-Link router has miserable security and D-Link is slow to respond
D-Link DWR-932 B owner? Trash it, says security bug-hunter
by Richard Chirgwin of The Register September 29, 2016
The router has more than 20 vulnerabilities. Yikes. "Following the consumer broadband industry's consistently lackadaisical attitude to security, the device suffers from everything from backdoor accounts to default credentials, leaky credentials, firmware upgrade vulns and insecure UPnP." The bugs were found by Pierre Kim, who has found other router bugs previously. The D-Link box is based on a Quanta LTE device which is the true source for some of the bugs. Five bugs are in the qmiweb webserver from Quanta. Examples: SSH and telnet are enabled by default, with two backdoor accounts (admin:admin, and root:1234). Most important points: it would be trivial to hack this router and add it to a botnet, and, D-Link blew Kim off when he tried to tell them about these problems.
IoT insecurities - stick them in an isolated network
Hackers found 47 new vulnerabilities in 23 IoT devices at DEF CON
by Lucian Constantin of IDG News Service September 13, 2016
That IoT devices have poor security is not news. Only one of the 23 devices was a router. My take-away from this story is that IoT devices should be isolated as much as possible. We don't want a compromised device to be able to do anything to any other device. For more on this see the Guest Network topic in my description of the Pepwave Surf SOHO router.
Inteno refuses to fix their buggy routers
ABBA-solutely crapulous! Swedish router-maker won't patch gaping hole
by Iain Thomson of The Register September 2, 2016
Harry Sintonen of F-Secure found a vulnerability in some Inteno routers that lets a bad guy install their own firmware. The routers are managed by the ISP using a protocol called both TR-069 and CWMP (CPE WAN Management Protocol). Routers using this protocol phone home to an Auto Configuration Server (ACS) operated by the ISP. While the Inteno routers do use HTTPS, they do not validate the certificate they get from the ACS server. That means a bad guy, who can man-in-the-middle the connection, can feed the router hacked firmware.
Inteno could care less, they blew the whole thing off. The good news is that since the ACS server should be in the internal network of the ISP, the flaw is hard to exploit. An attacker would need a privileged position on the ISP network.
AUGUST 2016
Multiple D-Link routers have a buffer overflow processing cookies
Vulnerability Note VU#332115 D-Link routers contain buffer overflow
vulnerability
by CERT August 11, 2016
Quoting:
"D-Link DIR routers contain a stack-based buffer overflow vulnerability, which may allow a remote attack to execute arbitrary code."
The overflow is in a function that validates the session cookie, it did not verify the length of the cookie properly. The flaw was first reported on May 31, 2016 and the first fixes were released Aug. 11, 2016. Some of the affected routers are the DIR-850L, DIR-890L, DIR-880L, DIR-868L and the
DIR-818L. The bug can be exploited both locally and remotely. The worst of this, to me, is that the router exposes port 8181 on the Internet.
A router should never need to leave ports open on the WAN side.
BHU Networks router is terribly insecure
MULTIPLE
VULNERABILITIES IDENTIFIED IN 'UTTERLY BROKEN' BHU ROUTERS
by Chris Brook of Kaspersky Threatpost
August 19, 2016
Tao Sauvage, a Security Consultant with IOActive Labs, purchased BHU WiFi router on a recent trip to China that could easily be exploited to do
pretty much anything. There are three different ways to gain administrative access to the
router's web interface. The router accepts any session ID cookie, which lets anyone be an authenticated user. And, he found it easy
to elevate privileges from admin to root. The router is also accessible from the Internet side and it enables SSH at startup and has a hardcoded
root password. What's left? It injects suspicious looking third party JavaScript into HTTP traffic. Yikes. The manufacturer, BHU Networks Technology
is based in Beijing.
Another high end vendor, Ruckus, found vulnerable
Ruckus Raucous: Finding Security Flaws in Enterprise-Class Hardware
by Craig Young of Tripwire August 3, 2016
I started this page to highlight bugs in consumer routers, yet the big boys are buggy too. At first, Young tested a Ruckus ZoneFlex. Quoting: "Within a few minutes of setting up the device, I found a command injection, which is exploitable through a forged request due to a general lack of CSRF tokens. As with many of the consumer routers I had tested, the ZoneFlex offers ... a simple ping test, with apparently no input sanitization." Consumer routers commonly have all processes running as root. Same with Ruckus. Young also found an Authentication Bypass: "All requests containing a particular string received '200 OK' responses. By creatively adding this string to other requests, I was able to get response data intended only for authenticated queries. This is a behavior I have observed in routers from NETGEAR, TrendNET and Asus." And, two other flaws: a Denial of Service and an Information Disclosure (the serial number is exposed). To me, the worst issue was that Young could not get in touch with Ruckus. This is a disgrace. My favorite router vendor, Peplink, has an online Forum where experts respond to questions and problems.
JULY 2016
120 D-Link devices may be buggy, including routers
D-Link Wi-Fi Camera Flaw Extends to 120 Products
by Michael Mimoso of Kaspersky Threatpost July 7, 2016
"A software component that exposed D-Link Wi-Fi cameras to remote attacks is also used in more than 120 other products sold by the company. Researchers at Senrio, who found the original vulnerability, disclosed today additional details of product vulnerabilities related to the component after collaborating with D-Link. Senrio said the flaw also puts D-Link Connected Home products at risk, including other cameras, routers, models and storage devices." There are no patches, yet. There are three flaws. The most severe is an unbounded/unchecked string copy that can be exploited to cause remote code execution.
TP-LINK lets domain lapse
TP-Link routers exposed to potential security flaw after domain registration lapses
by Boyd Chan Neowin July 4, 2016
One way that hardware vendors try to make the initial configuration of a router easier is by telling users to browse to a domain name rather than an IP address. TP-LINK uses both tplinklogin.net and tplinkwifi.net and they forgot to renew their ownership of tplinklogin.net. Its now owned by someone outside of the company and TP-LINK has, so far, refused to buy it back. This was discovered by Amitay Dan who also claims that TP-LINK is updating their documentation. I checked the TP-LINK website and found one item that says to use either an IP address or the domain they still own (tplinkwifi.net) and another item that says to use tplinklogin.net. Dan claimed that TP-LINK stopped talking to him after he brought this to their attention. If true, its a rare chance to see how much a company really cares about security. I blogged about this and did some testing. It is not a security issue for owners of TP-LINK routers. They intercept requests to tplinklogin.net and direct them to the router rather than the Internet. However, it could well be a problem for everyone else. I also found another domain that TP-LINK lost control of.
JUNE 2016
Apple routers are buggy and Apple offers no details at all
Apple
fixes serious flaw in AirPort wireless routers
by Lucian Constantin in PC World June 21, 2016
Apple has released firmware updates for its AirPort routers to fix a memory corruption bug stemming from DNS data parsing. Yet again, Apple deals with security problems by saying nothing. This tells me they can't be trusted.
Quoting: "As is typical for Apple security announcements, the company did not release details about possible exploitation scenarios and did not assign a severity rating for the flaw ... What is not clear is whether the data parsing issue is in the DNS server or DNS client functionality.... If the error is in the parsing of queries received from LAN computers, it would limit the attack to the local network. Whereas, if the flaw is in the parsing of DNS responses, it could be exploited remotely... Another unknown is the privilege with which attackers would execute malicious code if this flaw is successfully exploited. If the code is executed under the root account, it could lead to a full device compromise."
It appears the bug was first known about back in September 2015. Pretty slow response. Apple routers do not self-update, installing the new firmware requires you to use either AirPort Utility 6.3.1 or later on OS X or AirPort Utility 1.3.1 or later on iOS. This means customers may have to update the AirPort utility before they can update the router.
Don't hold your breath waiting for Cisco bug fixes
Cisco Won't Patch Critical RV Wireless Router Vulnerability Until Q3
by Michael Mimoso of Kaspersky Threatpost June 16, 2016
The Cisco RV series of wireless VPN firewalls and routers have flaws in their web interface that allow for remote code execution. Workarounds are not available, yet Cisco plans on fixing this in the third quarter of 2016. To exploit the bug, just send the device a malicious HTTP request. If remote management is enabled, this can be exploited remotely. Effected models are the RV110W Wi-Fi VPN Firewall, RV130W Wi-Fi VPN Router and the RV215W Wi-Fi VPN Router. Not buggy enough? There are also cross-site scripting and buffer overflow bugs in the same devices.
MyD-Link devices are vulnerable
D-LINK patches weak crypto in MYD-LINK devices
by Michael Mimoso of Kaspersky Threatpost June 14, 2016
A couple flaws were found in My-DLink devices such as the DIR-810L cloud router. Other vulnerable devices include IP Cameras and home routers. One flaw is not verifying certificates after making an SSL connection, the other is using SSL v2 and SSL v3, both of which are known to haver security flaws. The flaws were found by Firmalyzer and D-Link released updated firmware. However, I looked for DIR-810L firmware on the D-Link website and could not find anything. The articles did not link to it either.
Update: a reader emailed me to point out that updated firmware is available for the B model of DIR-810L but not for the A model (see link below). The firmware is dated June 13th and marked as BETA.
Netgear issues bug fixes
Netgear router update removes hardcoded
crypto keys
by Michael Mimoso of Kaspersky Threatpost June 11, 2016
Netgear has released firmware updates for two of its router products lines, patching vulnerabilities that were reported in January. Models D6000 and D3600 are known to be vulnerable, but other models and firmware versions could also be susceptible to the same issues. One issue is an authentication bypass vulnerability, the other is a hard-coded cryptographic key. The devices are vulnerable to attack on the LAN side and remotely, if remote management is enabled. Abusing the flaws, an attacker can gain administrator access. A remote attacker able to access the /cgi-bin/passrec.asp password recovery page may be able to view the administrator password in clear text by examining the source code of the page. Two things are required to work around the problem: the password recovery feature must be enabled and
remote management must be disabled. Netgear says "The potential for password exposure remains if you do not complete both steps. NETGEAR is not responsible for any consequences that could have been avoided by following the recommendations in this notification .. NETGEAR is working on a firmware fix and will email the download information to all registered users when the firmware becomes available. To register your product, visit https://my.netgear.com/register/ "
IPv6 Ping of Death hits Cisco and Junipter
Cisco warns IPv6 ping-of-death vuln is everyone's problem
by Shaun Nichols of The Register June 2, 2016
Cisco devices running IOS XR, Cisco IOS, Cisco IOS XE and Cisco NX-OS software have a flaw in their processing of IPv6 Neighbor Discovery (ND) packets. Exploitation of this bug could cause high CPU usage, the suspension of processing all IPv6 traffic or the temporary loss of services for traffic that terminates on the device, in addition to IPv6 traffic. Cisco is working on fixes, but there is no timetable. Juniper has three bugs with IPv6 Neighbor Discovery processing in Junos OS.
MAY 2016
Industrial company Moxa has buggy routers
Serious
Vulnerabilities Found in Moxa Industrial Secure Routers
by Eduard Kovacs of Security Week May 19, 2016
Frankly, I had never heard of Moxa. The article calls them an "Industrial networking, computing and automation solutions provider" and
says that their EDR-G903 series is an industrial router used in the United States, Europe and South America.
Multiple high severity flaws, that can be exploited remotely, were discovered in January by Maxim Rupp.
Configuration files store passwords in plain text. Both configuration and log files can be accessed with a specific URL by an
unauthenticated attacker. A remote attacker can also cause the device to enter a DoS condition by sending it malicious requests.
Patches have been issued, but they have not yet been verified to work.
Another business class company, Ubiquiti, has bugs
Worm
infects unpatched Ubiquiti wireless devices
by Lucian Constantin of IDG News May 20, 2016
Quoting: "Routers and other wireless devices made by Ubiquiti Networks have recently been infected by a worm that exploits a year-old remote unauthorized access vulnerability. The attack highlights one of the major issues with router security: the fact that the vast majority of them do not have an auto update mechanism and that their owners hardly ever update them manually." The bug has been fixed, but devices were not updated with patched firmware. The Resources page of this site lists routers that can self-update. Affected devices include the airMAX M Series, AirMAX AC, airOS 802.11G, ToughSwitch, airGateway and airFiber. The bug was easy to exploit. The
latest worm creates a backdoor account, then adds a firewall rule that blocks legitimate administrators from accessing the Web-based management interface.
26 bugs in Aruba Networks devices
Aruba fixes networking device flaws
by Lucian Constantin of IDG News Service May 9, 2016
The interesting part of this story is that all the bugs were found by Google. The last time I was in a Google office, I noticed that they use Aruba for their Wi-Fi. The vulnerabilities affect ArubaOS, Aruba's AirWave Management Platform (AMP) and Aruba Instant (IAP). There 26 different issues range from privileged remote code execution to information disclosure, insecure updating mechanism and insecure storage of credentials and private keys. Under certain circumstances, attackers can compromise devices. There are also design flaws in an Aruba proprietary management and control protocol dubbed PAPI.
APRIL 2016
Malware changes router DNS settings
Mobile Devices Used to Execute DNS Malware Against Home Routers
by Chisato Rokumiya of Trend Micro April 11,2016
Trend Micro discovered a JavaScript based router attack that originated in December 2015. For whatever reason the malicious code only runs from
websites loaded by mobile devices. The malware targets routers from D-Link, TP-LINK, ZTE and perhaps others as the code is constantly changing.
There are two infection vectors. The first is brute force, the malware tries 1,400 combinations of popular or default userids/passwords. It also targets
"a specific vulnerability that currently exists in ZTE-based routers." The malware has been seen world-wide with the top countries being Taiwan, Japan, China, the United States, and France. This type of brute force attack is to be expected. It is why, on the home page of this site, changing the router password
is the first suggestion. And, it is why I also suggest changing the userid used to logon to the router, when possible.
Quanta routers have every bug ever made
Multiple vulnerabilities found in Quanta LTE routers
by Pierre Kim April 4, 2016
Quoting: "Quanta Computer Incorporated is a Taiwan-based manufacturer of electronic hardware. It is the largest manufacturer of notebook computers in the world. The Quanta LTE QDH Router device is a LTE router / access point overall badly designed with a lot of vulnerabilities. It's available in a number of countries to provide Internet with a LTE network." Some of the bugs that Kim found: Hardcoded SSH Server key, Backdoor accounts, Router DoS, WebInterface Information Leak, two remote code execution flaws, two Backdoors, two flaws with WPS, Remote Firmware Over The Air, arbitrary file browsing and reading, etc. The buggy firmware seems to be used in many routers. My favorite part was Mr. Kims opinion: "... at best, the vulnerabilites are due to incompetence; at worst, it is a deliberate act of security sabotage from the vendor." The company will not fix any of these bugs. As I say elsewhere on this site, avoid all consumer routers.
Arris cable modem issue
ARRIS (Motorola) SURFboard modem unauthenticated reboot flaw
by David Longenecker April 1, 2016
In a poor design decision, the Arris SB6141 cable modem can be rebooted and reset without requiring a password. This, combined with its having a dedicated IP address means that a malicious web page can knock you off-line, for a bit. This is not a bug or a flaw, that's the way it was designed. The same flaw existed in the older SURFboard 5100 model at least as early as 2008 and it also exists in the 6121 model. Longenecker first reported the problem to Arris in January 2016 and he was ignored, until this got widely picked up in the press. When they were shamed into it, Arris changed the design. But, anyone with an effected modem is at the mercy of their ISP to install the update. It has been two months since Arris released new firmware, as I am writing this, and Time Warner has not yet rolled out the update. In fact, I was told by a Time Warner rep on the phone that its not their job to do so.
MARCH 2016
Telnet being abused by Remaiten bot
Your Linux-based home router could succumb to a new Telnet worm, Remaiten
by Lucian Constantin of IDG News Service March 31, 2016
Remaiten is a a new worm, discovered by ESET, that infects routers and other devices by taking advantage of weak Telnet passwords. The page on this site that lists services many/most people should turn off on their routers, includes Telnet. The software, also called KTN-Remastered, connects to random IP addresses on port 23. When a Telnet server is found, the software tries to login with assorted common passwords. The bot supports a variety of denial-of-service attacks. The Test Your Router page on this site links to assorted firewall testers that can tell you if your router has exposed a Telnet server.
Netgear router password flaw
Optus cable routers let anyone change passwords, says tech
by Darren Pauli of The Register March 17, 2016
There is a password flaw in the web interface of Netgear CG3000v2 gateways (combo router/modem/telephone adapter) provided by Australian ISP Optus. Specifically, the
SetPassword.asp page, which prompts for the old and new password, ignores the old password and changes the password to the new one all the time. The flaw was
discovered by Paul Szabo of the University of Sydney. When he informed both Netgear and Optus, they ignored him. Back in April 2014, this same Netgear box was the
subject of another security flaw, it had both Telnet and SSH active with the same default password on every box. See Default password leaves
tens of thousands of Optus cable subscribers at risk. Yet more proof not to use hardware provided by an ISP.
Modems can be buggy too
Cisco
patches serious flaws in cable modems and home gateways
by Lucian Constantin of IDG News Service March 10, 2016
Quoting: "Cisco Systems has patched high-impact vulnerabilities in several of its cable modem and residential gateway devices ... The embedded Web server in the Cisco Cable Modem with Digital Voice models DPC2203 and EPC2203 contains a buffer overflow vulnerability that can be exploited remotely without authentication ... [the] Cisco DPC3941 Wireless Residential Gateway with Digital Voice and Cisco DPC3939B Wireless Residential Voice Gateway are affected by a vulnerability that could lead to information disclosure [by] an unauthenticated, remote attacker ... The Cisco Model DPQ3925 8x4 DOCSIS 3.0 Wireless Residential Gateway with EDVA is affected by a separate vulnerability ... that could lead to a denial-of-service condition."
FEBRUARY 2016
A ton of new router flaws discovered
New firmware analysis framework finds serious flaws in Netgear and D-Link devices
by Lucian Constantin of IDG News Service
Feb 29, 2016
Been there done that. Once again, a group of researchers looked at many router firmwares and found a ton of bugs.
The bug hunting was done with a framework called FIRMADYNE built by Daming Chen, Maverick Woo and David Brumley from Carnegie Mellon University and Manuel Egele from Boston University. They found 887 firmware images that were vulnerable to at least one of 74 known exploits. They also found 14 previously unknown vulnerabilities in 69 firmware images used by 12 products. The Web management interface of six Netgear devices (WN604, WN802Tv2, WNAP210, WNAP320, WNDAP350 and WNDAP360) contain several pages that can be accessed without authentication and could allow attackers to pass input directly to the command line. In addition, the Netgear WN604, WNAP210, WNAP320, WND930, WNDAP350 and WNDAP360 also include Web pages that can be accessed without authentication and they expose the WPS PIN code. WPS bad. As for D-Link, the web server used in the D-Link DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2660, DAP-2690 and DAP-2695 have a buffer overflow vulnerability that can be triggered when processing a cookie. And, more. Six other devices (the D-Link DAP-1353, DAP-2553 and DAP-3520 and the Netgear WNAP320, WNDAP350 and WNDAP360) expose wireless passwords and admin credentials over SNMP. Perhaps the most important issue here is that D-Link never responded to the researchers reporting these bugs. Netgear will have fixes out by mid March.
FTC goes after ASUS routers for bad security
ASUS Settles
FTC Charges That Insecure Home Routers and "Cloud" Services Put Consumers' Privacy At Risk
by the FTC February 23, 2016
The security of ASUS routers was flawed in many ways. What seems to have brought the U.S. Government down on them were the flaws with the security
of storage devices plugged into a USB port in the router. The two features are called AiCloud and AiDisk. The bugs are listed on the bugs page of this site.
The password protection was easy to bypass, so much so, that good guys would leave messages for people warning that their router was easily hacked. All this while ASUS was
bragging about how secure this was. Manuals suggested that users all use the same userid and password. The FTC claims that ASUS did not take reasonable steps to secure the software on their routers. Then too, the usual behavior from consumer router companies: ignoring reports of bad security for months on end and even when updated
firmware is finally made available, the router incorrectly reports that there is no available update. ASUS agreed to pay a fine and to security audits every two years.
In summary, more proof to my argument that all consumer routers should be avoided.
A warning about configuring Asus routers
Poor UX leads to poorly secured SoHo
routers
by David Longenecker blogging at Security For Real People Feb. 7, 2016
Asus routers with an RT in the model name suffer from a user interface design flaw. If the firewall is disabled, remote administration (which Asus calls "Web Access from WAN") is enabled, even if remote administration is specifically disabled by the user. That is, the firewall setting over-rides the remote admin setting and nothing about this is
externalized to the end user. Longenecker stumbled across this by accident while checking his public IP address in Shodan. He found over 135,000 Asus wireless routers that
can be logged into from the Internet. I take this as yet another reason to always change the remote admin port number, even if you have disabled remote administration.
Two issues in Cambium Networks ePMP1000 router
CARISIRT: Defaulting on our Passwords (pt.2): Attacker-Friendly Security
by Zachary Wikholm of CARI.net Feb. 5, 2016
SNMP is enabled by default and the default configuration has community strings "public" and "private" for read and write respectively. This allows a remote attacker to potentially reboot the device using the SNMP write community. There are also multiple default userids and passwords and SSH is enabled by default. Default user/pswd admin/admin is allowed unrestricted access via SSH. Three additional userid/password pairs are installer/installer (an admin),
home/home (readonly) and read-only/read-only (also readonly).
Two issues in Ubiquiti AirOS and EdgeMax routers
CARISIRT: Defaulting on our Passwords (pt.2): Attacker-Friendly Security
by Zachary Wikholm of CARI.net Feb. 5, 2016
Mostly quoting: All current products have the default userid/password of ubnt/ubnt and have SSH enabled by default. The ubnt user also has sudo access via sudo -s. This gives remote attackers the ability to make changes ... This is very well known to attackers, and Ubiquiti devices make for a great target as they can support SOCKS proxying, and a wide variety of malware.
Mostly quoting: When an AirOS device switches back to factory defaults, it copies the /usr/etc/system.cfg to /tmp/system.cfg; saves and then reboots. An attacker ... can thus make changes to this default configuration to maintain persistence on a device ... current versions of the EdgeMax EdgeOS store the factory default configuration as
well as other configurations in /opt/vyatta/etc/. An attacker can modify these configs, thus maintaining persistence across factory resets. Also, it would very easy for a remote attacker to reset the device to defaults.
Mikrotik RouterOS default passwords
CARISIRT: Defaulting on our Passwords (pt.2): Attacker-Friendly Security
by Zachary Wikholm of CARI.net Feb. 5, 2016
Mostly quoting: A long standing problem in the Mikrotik RouterOS is the default username and password. All versions including the 6.34 release have default user of
"admin" with no password ... many devices are compromised within the first few hours of being put on line. During our tests, a device with the username
"admin" and no password was compromised within 15 minutes and had 9 unique pieces of malware running within 20 minutes ... also allows SSH access without
a password.
Netgear FTP password design flaw
Netgear: Add a password or risk losing your data
by Sean Sposito of SFGate February 5, 2016
The article says the flaw stems from the promise of convenience: "An owner can plug in a flash drive or a hard drive into a home router and access the data remotely. Turning a USB stick into a private cloud is an enticing perk - and one that’s becoming expected as people grow accustomed to accessing their information from anywhere ... When people attempt to remotely access their data, they are prompted to enter a user name and password. If customers have not established their own unique log-ins, Netgear routers grant access without requiring a password at all." Netgear's point of view was that users are responsible for preventing this. They should change the FTP password as the manual says. The article also says that Netgear did not respond to questions about the specific devices affected by the design flaw.
The vulnerability lets an attacker remotely execute commands and gain access to the root directory of the router via FTP.
UPDATE July 12, 2018: This flaw was exploited to leak military documents. My summary of this is on the Router News page under July 2018. In one of the articles about the hack, Kevin Poulsen was told by a Netgear spokesperson that the firmware update added a password by default. What password? How is it derived? None of our business. Clearly Netgear is not forthcoming with security information.
JANUARY 2016
Default TP-LINK router password needs only 70 guesses
The Wi-Fi router with a
password that takes just 70 guesses
by Paul Ducklin of Sophos January 27, 2016
Some TP-LINK routers have unique default passwords. But the passwords require, at most, 70 guesses. Most of the password is based on the publicly advertised
MAC address of the router. The remaining byte has, in theory, 256 possible values, but some detective work showed where this byte comes from and it has only
70 possible values. Not the first time something like has happened. Never use the default router password.
Another attack on the HNAP protocol
Threat Group Uses
Dating Sites to Build a Botnet of Vulnerable Home Routers
by Catalin Cimpanu of Softpedia Jan. 21, 2016
Some dating websites are spreading a worm to their visitors, infecting their routers and adding it to a botnet. The worm is a new variant of TheMoon, which was first discovered
in February 2014. It takes advantage of weaknesses in the Home Network Administration Protocol (HNAP). An iframe checks to see if the router supports HNAP. If so, it calls
home, informing its creators of the good news. Then a second URL delivers the worm, which is a Linux ELF binary. The worm prevents users from using some inbound ports,
and opens outbound ports through which it spreads to other routers. If you take the advice offered here, you would be safe from this because it only looks for the usual
suspects regarding the routers IP address.
Asus routers may never log you off
Administrator logout flaw in ASUS wireless routers
by David Longenecker blogging at Security for Real Peple January 19, 2016
One item on my router security checklist is that a router should log you off after a certain period of time. Prior to April 2014, Asus did not offer this feature. Now they do, however, they do it wrong. Longennecker found that ASUS routers, up to and including firmware from Dec 29, 2015, rely on JavaScript in the browser to enforce the auto-logout function. This means if you close the browser window without logging off, the router will keep you logged in forever (really until the router reboots). The same holds if JavaScript is blocked
in the browser. If you have an ASUS router be sure to always log yourself off. Furthering my argument to avoid consumer routers, is the fact that Longenecker first reported this to ASUS in December 2014 and they never bothered fixing it.
A hard coded SSH password found in Fortinet devices
Et tu, Fortinet?
Hard-coded password raises new backdoor eavesdropping fears
by Dan Goodin of Ars Technica Jan 12, 2016
The hard coded SSH password was FGTAbc11*xy+Qqz27 and it was active in 2013 and 2014. Fortinet says it is not a backdoor writing: "This issue was resolved and
a patch was made available in July 2014 as part of Fortinets commitment to ensuring the quality and integrity of our codebase. This was not a 'backdoor' vulnerability issue
but rather a management authentication issue." In response, the top promoted comment at Ars says: "So they're saying there was no malice, just an astounding level of incompetence in the area in which they are supposed to be experts?". Fortinet said nothing to their customers when they disabled the
password in 2014. And, it appears they never removed it. Ars was told by a researcher that the password is still in the firmware.
FRITZ!Box vulnerable on the LAN side but fixes are available
FRITZ!Box home broadband routers' security
FRITZed
by Richard Chirgwin of The Register Jan. 12, 2016
FRITZ!Box routers are popular in Germany and Australia. German security company RedTeam Pentesting found that program dsl_control listens for commands on TCP port 8080 on the LAN side. They then found that with the right SOAP request the program offers up a list of the commands that it supports, and, that it will execute these commands without authorization. Come and get it, open to all. Perhaps technically, this is not remotely exploitable, but LAN side attacks can be executed from malicious web pages loaded by a LAN side device. The flaw lets a bad guy gain root access. The bug was found in Feb. 2015 but was not made public to give the vendor time to create and distribute a fix. FRITZ!Box routers can self-update and new firmware is available. All told, well handled by everyone involved.