Forgot your password?
typodupeerror
Security Wireless Networking

D-Link Router Backdoor Vulnerability Allows Full Access To Settings 228

Posted by samzenpus
from the protect-ya-neck dept.
StealthHunter writes "It turned out that just by setting a browsers user-agent to 'xmlset_roodkcableoj28840ybtide' anyone can remotely bypass all authentication on D-Link routers. It seems that thttpd was modified by Alphanetworks who inserted the backdoor. Unfortunately, vulnerable routers can be easily identified by services like shodanHQ. At least these models may have vulnerable firmware: DIR-100, DI-524, DI-524UP, DI-604S, DI-604UP, DI-604+, TM-G5240."
This discussion has been archived. No new comments can be posted.

D-Link Router Backdoor Vulnerability Allows Full Access To Settings

Comments Filter:
  • by gweihir (88907) on Sunday October 13, 2013 @11:13PM (#45118107)

    Are these people too stupid to know that eventually, somebody _will_ analyze their firmware and find this? I think it is time to make them liable for a bit more than the device when things like these get found. Say, 10x the new value of the device to any customer that wants to give it back.

    • by DigitAl56K (805623) on Sunday October 13, 2013 @11:22PM (#45118167)

      Well, as an ex D-Link customer, I'm glad to see someone is analyzing their firmware.

    • by Anonymous Coward on Sunday October 13, 2013 @11:35PM (#45118223)

      How about a Prison Sentence. These ego maniacs are putting people's bank account at risk. It is no different from writing a virus. In fact it is worse.

      • by AlphaWolf_HK (692722) on Monday October 14, 2013 @01:25AM (#45118681)

        Who are you going to put in prison, exactly? It's possible only a small team of engineers was aware of this. Hell, may have even just been one rogue developer who nobody gave permission to put it there.

        • by Samantha Wright (1324923) on Monday October 14, 2013 @01:36AM (#45118725) Homepage Journal
          I might propose targeting the software review board that didn't catch the flaws, or perhaps the management who decided such a review board was unnecessary. Security-critical hardware should have at least some QC and/or validation at the firmware code level, y'know?
          • Idiot pruf (Score:4, Insightful)

            by TiggertheMad (556308) on Monday October 14, 2013 @03:45AM (#45119181) Homepage Journal
            As a software engineer who has worked on some larger projects, I can tell you that you are in fantasy land if you think that every line of code can be vetted without spending a small fortune on code review. Those costs might be justifiable for a project like a space shuttle guidance system, where the cost of failure is billions of dollars and multiple lives, but nobody is going to shell out that kind of budget for a sub $100 consumer router.
            • Re: (Score:2, Insightful)

              by Anonymous Coward

              nobody is going to shell out that kind of budget for a sub $100 consumer router.

              except such routers are the first line of defense, in many cases, of such things as a space shuttle guidance system....

              (don't blame me for what nasa engineers have running at home...)

            • Re:Idiot pruf (Score:5, Interesting)

              by L4t3r4lu5 (1216702) on Monday October 14, 2013 @04:36AM (#45119333)
              That only applies if you think of the firmware as being worth the sale of only one router. The models listed are all consumer grade, but I'm willing to bet that because they're cheap they're also popular. Your $100 router all of a sudden is $10m in sales if 100k are sold, across those six (so far identified ) ranges. Not so hard to imagine? Now think of those who work from home over networks served by that hardware, or the SMB with only a couple of clients on the network and no need for professional switching equipment. Now it's business loss to consider, even if only downtime to fix the breach is the only loss experienced.

              I can easily see something like this having the potential to cause losses not dissimilar to your "shuttle crash" scenario. It's "keys to the kingdom" external access to what should be a private network.

              Finally, there's no chance in hell of even 1% of these devices receiving a firmware update. Nobody (outside of us) upgrades the firmware on their home router; They run it from factory until death, then buy another one. These devices will be vulnerable for the foreseeable future.
              • by drinkypoo (153816)

                Forcing code vetting would change the economics of the industry. Companies would produce less models of router (for example) and they would produce a single model for longer. This would be good for everyone but the shareholders.

                • by Obfuscant (592200)

                  This would be good for everyone but the shareholders.

                  Good for the shareholders, too. It costs money to design and produce new versions of product with each new set of bells and whistles.

                  An issue that most companies seem to forget is brand loyalty. Even when such loyalty is as simple as "I had brand X model Y for several years and now it has failed. I need a new one. I'd buy the same thing because I am used to it and know how it works, but I can't because the company doesn't make it anymore." There are uncounted times I've gone through this process, having t

            • by gl4ss (559668)

              100 bucks*10 million installations = 1 000 000 000 bucks.

              just saying. anyhow, this isn't apparently open from the wan by default at least. so the people most fucked by this potentially are cafes etc semi public ap's. easiest damage scenario to come up with is just someone changing the cafes networks password. more damaging scenarios would be stuff like forwarding all the connections through somewhere else(and potential session hijinxes from that).

            • by Bengie (1121981)
              You don't need to vet every line of code, you just don't need idiot programmers. Most security issues you see are because of a lazy or uneducated programmer that skipped freshman programming. Programmers need to become security conscience and understand how their code fits into entire systems, or in this case, some @#$%ing common sense.
            • Re:Idiot pruf (Score:4, Informative)

              by JohnFen (1641097) on Monday October 14, 2013 @12:04PM (#45122405)

              As a software engineer working on a large consumer product, I can attest that every single line of code coming from our team goes through code review. It does increase short term costs a bit (but not prohibitively), but results in great net savings over the long haul as most defects are found before shipping, when code fixes are cheap. Finding and fixing the same defects after shipping is horrendously expensive and results in angry customers.

          • by AmiMoJo (196126) * <mojo@NOspaM.world3.net> on Monday October 14, 2013 @07:51AM (#45120139) Homepage

            It sounds more like the backdoor was put in deliberately, probably to aid support staff who were fed of up trying to explain how to type "192.168.1.1" into the address box instead of Bing. This way they can just find your IP address and then go in via the backdoor to sort any problems out, about 90% of which will be wifi congestion on the default channel (11).

        • If you create a faulty product that causes property loss or death, heads must fall. In China, they just shoot the CEO in cases like this.
          For that huge income they should at least pick the people who pick the people who do the quality control.

          • I suppose I'd get into trouble if I suggested forming an angry mob, storming the corporate HQ with torches and pitchforks and cleansing the evil with fire ...
            • WIth proper corporate liability, there wouldn't be need for any angry mob. I didn't suggest any lynching, i suggest proper laws.

              • I didn't suggest any lynching

                Didn't intend to suggest that you did. Shooting CEOs in the head outside of the rule of law is a bad thing. I think we can safely agree on that.

                i suggest proper laws.

                In all seriousness, that's always a better solution than mob violence. I just sometimes worry that mob violence is going to happen faster than proper laws.

        • by cripkd (709136)
          So what's wrong with prosecuting whoever is found to be guilty? A manager that ordered this, one or more developers who introduced this, etc. It's possible you cannot properly identify the individual(s) but that doesn't mean that the law shouldn't be applied and that the usual measures cannot be taken.
        • by TapeCutter (624760) on Monday October 14, 2013 @06:03AM (#45119641) Journal

          Hell, may have even just been one rogue developer who nobody gave permission to put it there.

          It's a safe bet their law team already have that at the top of the whiteboard.

          • Then you better have some way to prove it. Else, I still want the head of your boss. Because he is in the end responsible for what's happening in his company.

            He who makes the decisions shall be held responsible for them.

        • The CEO. If you don't know what's going on in your company, you're criminally negligent anyway.

          Maybe that would make them at least interested in knowing just what their company makes. I somehow have the feeling D-Link's CEO's response would be "Firmware? What firmware, I thought we're making hardware here!"

          • by thelexx (237096)

            "The CEO. If you don't know what's going on in your company, you're criminally negligent anyway."

            Unless you're Jon Corzine.

          • by kestasjk (933987) *
            From d-link.com executive team page: "Born in 1952, Roger Kao graduated from Tamkang University with a degree in Electrical Engineering. He went on to earn his Master’s Degree in Electrical Engineering and Computer Science from National Chiao Tung University where he also served as an Associate Professor."

            Really though if you don't know whether third party software embedded in a few of your huge range of products contains a hidden backdoor when a rarely used feature is activated what kind of CEO ar
      • by sirlark (1676276) on Monday October 14, 2013 @02:46AM (#45118969)
        Actually, this makes a twisted form of sense. The DMCA and earlier wire tapping and computer fraud laws state two things iirc 1) Attempting to access a system which you do not have permission to access is illegal, and 2) subverting a security mechanism to provide unintended access is illegal. Now (1) only applies if someone uses the back door to gain access to your system, but (2) applies just because the back door exists. The stated intent is that these routers are secure (read the advertising gumph), which means the existence of the back door was a subversion of the intent for security. Someone, somewhere did this, and should be held liable. Considering the "OMFG it's on a computer" factor and the peculiarly zealous manner in which violations are normally prosecuted, I don't see why this shouldn't carry jail time, and a lot of it, as a sentence. I make this argument in support of consistency. What's good for goose is good for the gander. I don't actually agree with the sentences recommended/allowed by those acts.
      • Re: (Score:3, Insightful)

        How about a Prison Sentence. These ego maniacs are putting people's bank account at risk. It is no different from writing a virus. In fact it is worse.

        Sorry man, but this isn't an ego maniac. It's worse than that. 04882 is an oblique reference to the product ID used by Revell. Revell produces hobby scale models of various things. In this case... of the USS Enterprise, as seen in the worst trek movie ever -- Star Trek: Into Darkness. Which means, we're not dealing with an ego maniac: We're dealing with a guy who is utterly devoid of ego. This particular model probably sits on his desk in his cube, providing both inspiration to one 'Joel' in D-Link's softwa

        • In other news, this incident is excellent fodder for security researchers to use as a case in point for how knowledge of a person's habits and hobbies can provide valuable insight into potential password selections, and also that the password selection is so strongly correlated with these things, that knowing the password alone can be sufficient to uniquely identify the user!

        • by Kythe (4779)
          The DI-524 is, what, 8 years old? The firmware for it hasn't been updated since 2006. How, then is it listed as vulnerable?
          • by girlintraining (1395911) on Monday October 14, 2013 @03:34AM (#45119141)

            The DI-524 is, what, 8 years old? The firmware for it hasn't been updated since 2006. How, then is it listed as vulnerable?

            This is some guy on a blog. It's a mixture of fact and wild speculation. This isn't an official security notification on something like Bugtraq or CERT, etc. He tested the DI-100 firmware, v1.13. The FTP link he provided lists the timestamp for the file as "02/19/2013 11:09AM", not 2006.

            He doesn't even have a DI-100, he just downloaded it at random. He thinks, based on "the source code of the HTML pages and some Shodan search results", that the devices listed are affected. There was no actual testing, it's just rampant speculation based on Sir Bloggy McBlogs google-fu. Now, that said, I have been doing some additional research and the company Revell is based out of Germany -- which is also where D-Link's software development team is. Revell's website indicates the model went on sale about the same time as the movie release -- May 2013. The timestamp is February. It's not enough to bust my theory that 04882 is a reference to the model... it's just possible the website is wrong, or he got one early from a friend who works at said company. It does happen; Maybe they handed them out at special screenings.

            Such is the nature of speculating on these things; it's interesting, but it's nearly impossible to get positive verification of a theory.

        • by cripkd (709136)
          Then it all makes sense! Leave it there or we will be doomed!
          Kirk traveled into the past at some point and planted this, it will most likely save the ship and its crew. They need our help!
    • I'm always amazed to read about things like this because most engineers are not morons. Why would they do it? How could they not know it would be discovered?

      The Black Hats have probably known about this for a long time...

      • by AHuxley (892839)
        What must the self excuse list be like?
        It was a rushed job.
        It was another department.
        It was outsourced.
        So many product lines. So much work.
        The supervisor wants features for a global market, other product lines are for security.....
      • by Tanktalus (794810)

        If "most engineers are not morons" then we wouldn't need Bobby Tables [bobby-tables.com] as an example when explaining simple security issues to them.

        • At first glance it looks like an interesting link.
          • Not sure how this is a troll. Telling people the link looks like it could be interesting. I guess whoever it was doesn't speak English.
        • Most engineers are not morons.

          Sadly, not everyone writing code is an engineer. You get a fair lot of people considering themselves "programmers" these days because they can slap together a few objects in a RAD tool (without having the foggiest clue what happens behind those shiny icons they click on), copy/paste some code from various example pages and finally run whatever mess that creates through the compiler often enough 'til it finally compiles. Add some shotgun debugging and you know why code is in the

    • by johndoe42 (179131) on Sunday October 13, 2013 @11:46PM (#45118277)
      A class action lawsuit for gross negligence might do the trick.

      Sometimes I think that things like this should be felonies, though. Criminal offense or not, in a sensible world this would put alphanetworks out of business.

    • 10x the new value of the device to any customer that wants to give it back

      Silly idea, make them liable for costs. Then the device manufacturers will be supporting the [cough] on-line content industry [cough],

    • Are you talking about DLink or the NSA, or is the just DLinks way of complying?

      Just wondering....

    • by moteyalpha (1228680) on Monday October 14, 2013 @02:33AM (#45118939) Homepage Journal
      The problem that I have observed is that there is no effective oversight to complex systems. The people who can deal with the complexity and create things like this work in a sort of isolation. Sometimes this happens when contractors are asked to create a system and then get paid. If they don't get paid, they leave the back door. I can guarantee that this is not the last one that is found and some are much worse than this. I was looking at the javascript linked in an earlier article and it reminded me of the "never attribute to malice ...." . When you add the possibility that espionage or criminality could be involved it gets even more complicated. I help relatives with computer problems on a daily basis and most people have trouble just figuring out how to use the damn things. They are completely vulnerable to even the simplest tech attack or SE.
      I also have my own site and I see many things. I know that every day there are people knocking on doors or ports. It is another world that most people only understand as some kind of stuff done by technically afflicted people.
  • by no-body (127863)
    Can the manufacturer be made liable for damages? Not sure what the are smoking there...
  • That the consumer is always so proactive with updates that they'll upgrade their router the instant a fix is released.......NOT.
    • Re:Thank Goodness... (Score:5, Interesting)

      by fuzzyfuzzyfungus (1223518) on Sunday October 13, 2013 @11:20PM (#45118153) Journal

      That the consumer is always so proactive with updates that they'll upgrade their router the instant a fix is released.......NOT.

      "A quick Google for the “xmlset_roodkcableoj28840ybtide” string turns up only a single Russian forum post from a few years ago, which notes that this is an “interesting line” inside the /bin/webs binary. I’d have to agree."

      Even if they do, it sounds like they'll be almost four years late.

      • by Anonymous Coward on Sunday October 13, 2013 @11:25PM (#45118189)

        And the post points out (in 2010) that if you reverse the string it was "edit by 04882 Joel Backdoor" so it was clearly a backdoor.

        The big scandal here is how can a backdoor be known since 2010 and not revealed??!!!

        • Re: (Score:2, Insightful)

          by ibsteve2u (1184603)

          And the post points out (in 2010) that if you reverse the string it was "edit by 04882 Joel Backdoor" so it was clearly a backdoor.

          The big scandal here is how can a backdoor be known since 2010 and not revealed??!!!

          Somebody found it profitable enough to make an effort to stifle the spread of knowledge about the backdoor?

          "Profit" can be anything of value, of course.

        • by Anonymous Coward on Monday October 14, 2013 @12:19AM (#45118419)

          The big scandal here is how can a backdoor be known since 2010 and not revealed??!!!

          Seriously? That's not a scandal, that's the way the world works. People that LOOK for stuff like that want to keep those exploits to themselves because they want to USE THEM. If you reveal the damn thing, it'll get patched.

          Not many people want to do all the work of looking through binaries figuring out obscure shit like this just for fun.

      • So it looks like this was a deliberate addition so that the router's internal tools could use http requests to change config. Why didn't they just check for incoming requests from localhost? Surely that would have been simple and safe enough? So instead they create something that they *know* is a backdoor.
  • by austerestyle (3396553) on Sunday October 13, 2013 @11:31PM (#45118211)
    Read backwards it reads the same as the comment subject. Is this the guy behind it? http://www.joesdata.com/executive/Joel_Liu_421313008.html [joesdata.com] Assuming good will, it seems like debugging code left in the final firmware release.
    • by jamesh (87723) on Monday October 14, 2013 @02:41AM (#45118955)
      All this time we were running around blaming the NSA, when it was Joel all along!
    • by girlintraining (1395911) on Monday October 14, 2013 @03:17AM (#45119093)

      s this the guy behind it? http://www.joesdata.com/executive/Joel_Liu_421313008.html [joesdata.com] Assuming good will, it seems like debugging code left in the final firmware release.

      Regardless of how strong the evidence may be, uniquely identifying someone on the internet is dangerous and may even expose you to a slander/libel/defamation case. You may recall not long ago the witch hunt on reddit for the Boston Bomber. Over a dozen 'suspects' were named and shamed on the forums, none of whom turned out to be the actual person. Those people's lives crumbled into dust after, and police had to devote valuable resources at the time to protecting those individuals from vigilantes. Don't go the extra step of naming someone -- no matter how confident you are, the odds are very high that you're wrong. I know you think you're being edgy, smart, whatever and showing off your google-fu here, but you've actually rather accomplished the reverse -- you've demonstrated a reckless abandon and an inability to consider the consequences of your actions, or at least favoring momentary glory and recognition at the expense of another. Neither scores high marks in internet ethics.

      On the internet, a loaded finger is a bigger threat than a loaded gun.

  • by DigitAl56K (805623) on Sunday October 13, 2013 @11:36PM (#45118235)

    PDF link, published earlier this year, shows how many manufacturers use a stack with a UPnP vuln that gives root, even from the WAN side:

    http://www.defensecode.com/public/DefenseCode_Broadcom_Security_Advisory.pdf [defensecode.com]

    Point is, you probably weren't as safe as you thought you were, even before this new disclosure.

    I think a huge problem with consumer-grade wifi routers today is that as manufacturers race to support new models with new wifi standards and new competitive feature sets, older models quickly become abandonware. There's very little guarantee around firmware updates for critical vulnerabilities, and end users are mostly oblivious to being at risk. By the time you pick up that $80 model from the store it's probably borderline EOL already.

    • by wvmarle (1070040)

      It seems like they have about as many remote vulnerabilities as your run-of-the-mill Windows installation.

      Maybe we should follow the same advice as is given to protect Windows from remote attackers: don't connect it directly to the Internet; put it behind a hardware firewall, opening only the ports you need. Like http port 80.

      Oh, wait...

  • How to bury your company's reputation with one password.

    • by Frosty Piss (770223) * on Sunday October 13, 2013 @11:48PM (#45118283)

      How to bury your company's reputation with one password.

      D-link's rep was buried long ago.

    • Yes they did, TAO (Score:4, Insightful)

      by Anonymous Coward on Monday October 14, 2013 @01:42AM (#45118757)

      Read it and weep:
      http://www.washingtonpost.com/world/national-security/us-spy-agencies-mounted-231-offensive-cyber-operations-in-2011-documents-show/2013/08/30/d090a6ae-119e-11e3-b4cb-fd7ce041d814_story_1.html

      "Much more often, an implant is coded entirely in software by an NSA group called Tailored Access Operations (TAO). As its name suggests, TAO builds attack tools that are custom-fitted to their targets. "

      "Tailored Access Operations has software templates to break into common brands and models of “routers, switches and firewalls from multiple product vendor lines,” according to one document describing its work."

      So on the one hand they're supposed to defend US networks from attack, while on the other hand they have detailed knowledge of these backdoors and use them for their own use while keeping them secret.

      So yes, the NSA did have a hand in it, at the minimum it kept it secret while exploiting it.

      • by mcgrew (92797) *

        You guys find a backdoor in a Chinese product and say it's the NSA?? If these were Cisco routers I'd agree, but I don't see the NSA putting back doors in Chinese firmware. I'd say it's so the Chinese government can spy on their citizens. You don't really think the USA is alone in building a surveillance state, do you?

  • by seifried (12921) on Monday October 14, 2013 @12:05AM (#45118357) Homepage

    Because friends don't let friends run crappy firmware with back doors/known problems.

    http://www.linuxpromagazine.com/Issues/2010/119/Security-Lessons-Linux-WAP/(tagID)/337 [linuxpromagazine.com]

  • by Alsee (515537) on Monday October 14, 2013 @12:17AM (#45118411) Homepage

    Heay!
    That's the combination on my luggage!

    -

  • by mtaht (603670) on Monday October 14, 2013 @12:31AM (#45118463) Homepage
    It's not just simple backdoors like the dlink one that are a problem.

    There is a systemic complete and total regard for basic tenets of security in nearly the entire home router/cpe market.

    Start with crypto - no hwrng and a known "less than ideal" version of /dev/random to feed your "secure" wpa and ssh sessions.

    Worse:

    There is no privilege separation in most routers, which was ok when they were single function devices - BUT: not ok, when vulnerability via services like samba can be used to root most of the top 10 current home routers:

    http://securityevaluators.com/content/case-studies/routers/soho_service_hacks.jsp [securityevaluators.com]

    Once an attacker p0wns your home gateway they can change your dns to malicious sites, as dnschanger did:

    http://www.dcwg.org/ [dcwg.org]

    or have it participate in botnets, or inflict further attacks on unsuspecting devices both inside and outside your firewall, or sniff your traffic - there is no security when your front door is left wide open.

    What nearly every home router and cpe manufacturer is shipping is **rotware**, running 4-7 year old kernels with known CVEs, and 10 year old versions of critical services like dnsmasq. You'd think that new 802.11ac devices available for this christmas might have some modern software on it, but just to pick out a recent example - the "new" netgear nighthawk router runs Linux 2.6.36.4 and dnsmasq 2.15, according to their R7000 gpl code drop -

    http://kb.netgear.com/app/answers/detail/a_id/2649 [netgear.com]

    Brand new hardware - 4+ and 10 year old software respectively.

    It's unfair of me to pick on Netgear, every router I've looked at this christmas season has some major issues.

    Right now, the only current hope for decent security in home routers is in open, modern, and maintained firmware. And I wish the manufacturers (and ISPs, AND users, and governments) understood that, and there was (in particular) a sustainable model for continuous updates and upgrades as effective as android's in this market. I don't care if it came from taxation, isp fees, or built into the price of the device - would you willingly leave your networks' front door open if you understood the consequences?

    Rotten routers with closed source code, and no maintenance, are a huge security risk, and they are holding back the ipv6 transition, (and nearly all current models have bufferbloat, besides)

    How can the dysfunctional edge of the Internet be fixed?

    • Re: (Score:3, Interesting)

      by Anonymous Coward

      "Right now, the only current hope for decent security in home routers is in open, modern, and maintained firmware"

      Nah. The only lonely hope fer descentified home security routers is to build sum yerself. It aren't that hard. What hillbilly don't got a beige box layin' about and a spare NIC? Need juz... uh... count 'em: | | <- Dis manny Etherport whatsits to build a maximam security gateway. I tighted two screws (righty tighty, leftie loosie), got dem dere PCI card hooked up. Putted in a CD, wot axed a few questimations, and done.

      Oh, but dis is dat dere big brained slashamadoodle folks. Fergiven ma pardon. Ai

    • by fnj (64210)

      the "new" netgear nighthawk router runs Linux 2.6.36.4

      And every DOD approved server is running RHEL6 which is 2.6.32. The kernel version doesn't tell you shit unless you know what patches have been added.

    • by wvmarle (1070040)

      My router is about 10 years old now, still working. Supports WPA-PSK, so it has all the features I need it to have.

      However afaik no way to update the firmware. Which of course is >10 years old now. And even if I could... well it's hanging on a wall, and it's doing its job - it's a device, and not something that's high on my priority list to check for vulnerabilities.

      I guess my best chance to keep safe is the fact that's so old and some obscure brand it's not a known target for would-be attackers.

  • A big problem (Score:4, Insightful)

    by AndrewStephens (815287) on Monday October 14, 2013 @12:44AM (#45118513) Homepage

    This is NOT a small, obscure problem for users of DLINK routers. Although it does not open up Wifi access or anything like that, having access to the configuration panel of your router is bad news even from inside the network. I can't think of anyway to automatically exploit it via a browser (XSS-style) but a small executable (or trusted Java applet, for instance) could do it.

    Additionally, I wonder how many small establishments are offering free wifi using DLINK equipment. Those networks are now vulnerable.

    If I was a bad(er) guy, the first thing I would change would be the DNS settings. Forcing all computers behind the router to use a DNS I control opens up all sorts of interesting ways to mess with people.

    • Re:A big problem (Score:5, Informative)

      by viperidaenz (2515578) on Monday October 14, 2013 @01:00AM (#45118587)

      Apparently IE might let you change the user agent
      http://stackoverflow.com/questions/6995311/how-can-i-spoof-the-user-agent-of-a-javascript-get-request [stackoverflow.com]
      You'd just need to work in some cross domain exploit somehow... or have a subdomain of your website resolve to 192.168.1.1

      • ... or have a subdomain of your website resolve to 192.168.1.1

        I never thought of this, that's pretty sneaky.

    • by elp (45629)
      This is not the first time D-Link have been caught doing stuff like this, and the DNS attack is exactly what happens when the bad guys find out.
      This was a big issue here in South Africa a few months ago. Telkom (the local state owned incompetent telco) were selling approved DLink modems with helpful extra admin accounts (username: support password: support was one I saw) which suddenly started redirecting traffic to interesting locations [mybroadband.co.za].
    • Re:A big problem (Score:5, Interesting)

      by SethJohnson (112166) on Monday October 14, 2013 @02:32AM (#45118929) Homepage Journal
      Certainly, DNS would be a pretty quick way to abuse all devices on the other side of the router. It might be detected when the owner verifies the settings themselves or watches their own network traffic and observes the DNS lookups hitting the wrong destination. It's likely that this would have set off red flags before now. Many anti-malware packages check for DNS redirections, for example.

      Being able to manipulate the router's config interface would allow an external entity the ability to upload a new firmware to the router. The new firmware would offer the attacker switches to flip at will that would enable packet sniffing of all traffic and man-in-the-middle SSL attacks. Organized crime / NSA (redundant to mention both, I know) seek no deeper capabilities than this.

      You bring up a great point of smaller establishments running WiFi on D-Link equipment. Perhaps their SSID's should be modified to read, "HACKED BY NSA - DO NOT USE!"
  • by muecksteiner (102093) on Monday October 14, 2013 @01:53AM (#45118799)

    In most of the companies that do such gear, the chap(s) in charge of actually developing and making them are treated as disposable cost factors. Who are under constant threat of being outsourced to some third world country. And the products they develop are basically abandoned once the next release hits the shelves, otherwise the incentives to buy new stuff would not be as high.

    All the while the Cxx who "supervise" them (and who in a lot of cases couldn't even configure the products the company makes, let alone really care) walk away with more or less obscene bonuses. You know, just to show the little guys who is boss, and so.

    Not a big surprise, then, that the developers apparently don't put their entire energy in making the best possible product. Would you, in their stead?

  • D-Link should update their firmware: Joel left the company a long time ago. And you should never hard-code usernames in a firmware, only group names. This is basic stuff.
  • by Bert64 (520050) <bert@sl[ ]dot.fi ... m ['ash' in gap]> on Monday October 14, 2013 @05:38AM (#45119547) Homepage

    Why do all these router vendors even bother producing their own nonstandard firmware?
    Most of the hardware is based around a small set of common chipsets anyway, so why not use an existing firmware such as dd-wrt or openwrt.

    • by wvmarle (1070040)

      Branding. Same reason Samsung has all but forked Android. If they don't, there is no difference any more between various devices.

      • by Bert64 (520050)

        Which is in most cases just stupid...
        Most of the branded versions of android (and other similar systems) that i've seen have been considerably worse than the stock version, especially the carrier branded versions.
        OEM versions of windows are just as bad too.

        By creating a branded version you are differentiating yourself as being inferior, thats not a good "difference" at all as in many cases people will actively seek out devices which don't have the branded software versions.

  • Apple's AirPort line of routers is one of the few consumer grade families of network gear that are not abandonware -- updates are provided fairly regularly. I believe that under the covers they're running VxWorks with a custom IP stack from Apple. As far as I know, there are no back-doors or security problems with them. (I would not be at all surprised to find out that the NSA has infiltrated one -- they are designed and the firware is written in the USA.) I've been using them for years -- they're very rel
  • Many folks are installing pfSense etc on thin clients (plentiful on Ebay and dirt cheap). Choose whatever distro you like then have at it. Rolling your own goes back to floppy-based Linux routers and is old news.

At work, the authority of a person is inversely proportional to the number of pens that person is carrying.

Working...