Follow Slashdot stories on Twitter


Forgot your password?
Networking Security Technology

Millions of Home Routers Are Hackable 179

Julie188 writes "Craig Heffner, a researcher with Maryland-based security consultancy Seismic, plans to release a software tool at the Black Hat conference later this month that he says could be used on about half the existing models of home routers, including most Linksys, Dell, and Verizon FiOS or DSL versions. The tool apparently exploits the routers through DNS rebinding. While this technique has been discussed for 15 years or more, Heffner says, 'It just hasn't been put together like this before.'" has a list of routers tested and some advice on securing vulnerable routers.
This discussion has been archived. No new comments can be posted.

Millions of Home Routers Are Hackable

Comments Filter:
  • by hawks5999 ( 588198 ) on Friday July 16, 2010 @08:50AM (#32924988)
    to log in.
    • by Anonymous Coward on Friday July 16, 2010 @08:55AM (#32925014)

      The tool apparently exploits the routers through DNS rebinding. Wjhile this technique has been discussed for 15 years or more, Heffner says 'It just hasn't been put together like this before.'"

      Ha Ha! I changed my default username to "adjminstrator" and password to "passjword"! Good luck hjackers!

    • it seems that changing the password would render this hack fairly useless. also many routers are only accessible through a private IP, so even changing the router's IP would work unless the script tries all the addresses on the local network and then tries to brute force the router, but that would take years since I would assume its written in JavaShit
      • by Suki I ( 1546431 )
        That is just the thing that I find so annoying with many exploit announcements. The buzz and cloud of publicity abounds, the MSM gets all panicky over what? Something that is not really a threat at all.
  • The "list of routers affected" at is just a picture (.png) of a few rows of a spreadsheet. I would like the full list, please, even if just posted in a comment.
    • by Slippery Pete ( 941650 ) on Friday July 16, 2010 @09:03AM (#32925078)
      The Forbes article [] has a Google spreadsheet of the routers.
      • by Cato ( 8296 ) on Friday July 16, 2010 @09:18AM (#32925186)

        Here's a direct link to the spreadsheet of routers, without the IFRAME so it's easier to read: []

        • Wow, the Linksys WRT-54G series is in there as well. That makes for a HUGE amount of routers, because this baby is still going strong after eight years, even if it's not the complete WRT-54G series that's vulnerable.

        • by mzs ( 595629 )

          Thanks, this is what bugs me:

          OpenWRT N/A N/A Kamikaze r16206 YES

          Now how to thwart the new dns prebinding attack part? (I've a strong pass.)

      • by L4t3r4lu5 ( 1216702 ) on Friday July 16, 2010 @09:25AM (#32925252)
        From the article:

        "One comfort for users may be that Heffner's method still requires the attacker to compromise the victim's router after gaining access to his or her network."

        So, this is a problem if you've left your router with its default admin password, or there's a vulnerability in the firmware which can be exploited. The same as every other possible exploit of consumer^h^h^h^h^h^h^h^hall hardware.

        Who published this article? Oh, hey kdawson. Glad to see you're still on form. Seriously, let me filter this shit out of the RSS feed.
        • by mcgrew ( 92797 ) *

          My problem with it is that it was published in Greedhead Magazine, AKA "Forbes". I would rather have read an article from a tech publication.

          So, this is a problem if you've left your router with its default admin password, or there's a vulnerability in the firmware which can be exploited.

          It's still of interest, though. This would allow you to use the router to gain access to the PC, circumventing the PC's software firewall (even though I would trust a hardware firewall before I trusted a software firewall)

          • My problem with it is that it was published in Greedhead Magazine, AKA "Forbes".

            If the information is accurate, then what's the problem? Would you have the same objections if it was published in Mother Jones or The Nation?

        • So, this is a problem if you've left your router with its default admin password, or there's a vulnerability in the firmware which can be exploited. The same as every other possible exploit of consumer^h^h^h^h^h^h^h^hall hardware.

          All the routers I've seen in the past couple of years have a sticker at the bottom which displays the default password. It's usually a randomly generated set of letters and numbers - such as "rt2ey67dh6qg8".

          In other words, a router left with the default admin password is pretty sec

          • by mzs ( 595629 )

            Unfortunately every now and then there are security flaws found in the CGI or AJAX scripts that run on the router. (Think admin pages that don not properly sanitize input.) And if you're running such an affected version, then even with a random default password an attacker can be malicious.

        • by 0123456 ( 636235 )

          So, this is a problem if you've left your router with its default admin password, or there's a vulnerability in the firmware which can be exploited. The same as every other possible exploit of consumer^h^h^h^h^h^h^h^hall hardware.

          Fortunately there aren't millions of routers out there with known vulnerabilities allowing you to reprogram them without a password, often just using a simple URL you can put in an image tag. Oh, hang on, there are: the router my ISP ships was exploited a year or two back in some Central American country to reprogram its DNS server to redirect banking accesses to a phishing site.

          But I agree, I don't really see what this attack adds over just using an image tag going to http://router/powned [router].

    • Here ya go:

      Vendor Model H/W Version F/W Version Successful
      ActionTec MI424-WR Rev. C YES
      ActionTec MI424-WR Rev. D YES
      ActionTec GT704-WG N/A YES
      ActionTec GT701-WG E YES
      Asus WL-520gU N/A N/A YES
      Belkin F5D7230-4 2000 4.05.03 YES
      Belkin F5D7230-4 6000 N/A NO
      Belkin F5D7234-4 N/A 5.00.12 NO
      Belkin F5D8233-4v3 3000 3.01.10 NO
      Belkin F5D6231-4 1 2.00.002 NO
      D-Link DI-524 C1 3.23 NO
      D-Link DI-624 N/A 2.50DDM NO
      D-Link DIR-628 A2 1.22NA NO
      D-Link DIR-320 A1 1 NO
      D-Link DIR-655 A1 1.30EA NO
      DD-WRT N/A N/A v24 YES
      Dell TrueMobile 2300 N/A YES
      Linksys BEFW11S4 1 1.37.2 YES
      Linksys BEFSR41 4.3 2.00.02 YES
      Linksys WRT54G3G-ST N/A N/A YES
      Linksys WRT54G2 N/A N/A NO
      Linksys WRT160N 1.1 1.02.2 YES
      Linksys WRT54G 3 3.03.9 YES
      Linksys WRT54G 5 1.00.4 NO
      Linksys WRT54GL N/A N/A YES
      Netgear WGR614 9 N/A NO
      Netgear WNR834B 2 2.1.13_2.1.13NA NO
      OpenWRT N/A N/A Kamikaze r16206 YES
      PFSense N/A N/A 1.2.3-RC3 YES
      Thomson ST585 6sl YES

      • This is a list of routers that allowed their script to run within the network. You then need to actually launch an attack on the router which... they don't have.
        • by Hatta ( 162192 )

          If you can run a script within the network, you don't need to compromise the router. There's a bunch of unprotected windows boxes inside that network you can easily compromise.

      • So informative, thank you Sir! Do you have a list of IP's that match said routers? :-)

      • by Ksevio ( 865461 )
        If you count an exploit something where you have access to the network and can login to the router to change things, I imagine there could be a lot more routers that this exploit works on. Nothing's stopping a sys admin from setting his default root account on his linux router to "root::admin".
  • I can believe it... (Score:5, Interesting)

    by fuzzyfuzzyfungus ( 1223518 ) on Friday July 16, 2010 @09:05AM (#32925086) Journal
    At one point, just out of morbid curiosity, I cranked up a copy of OpenVAS(the OSS fork of nessus) and told it to just hit everything on my home network with all "safe" tests(the program offers the option of either including or excluding tests that are likely to crash/DOS the target, rather than simply confirm/deny the presence of a vulnerability).

    When the run was finished, all the real computers in the house had passed, with the exception of a few informational messages(Hey! this computer is running an SSH server, did you do that or should you be freaking out right now?). On the other hand, I had to physically reset over half of the assorted little-bitty-embedded-plastic-boxes-of-various-network-functions to get them working again.

    And that was with the "safe" tests.

    Based on the version and vulnerability information being reported(for devices that I do, in fact, update vendor firmwares on, when those are available) the state of consumer embedded devices is absolutely fucking pathetic. Blatantly outdated and known-vulnerable services listening merrily away in the latest vendor firmwares for products less than a year old...
    • Hmm, I like the looks of OpenVAS, I'll have to try it out. Thanks for the tip!

    • Re: (Score:3, Insightful)

      You should see the state of commercial routers... it's almost as bad.
    • by Manip ( 656104 ) on Friday July 16, 2010 @09:19AM (#32925196)

      Indeed. I found a bug in a D-Link DIR-655 and was completely unable to report it to them. I couldn't even log into their support system because according to them I don't own my own router (serial already in use) and couldn't find a more technical or security contact at the company.

      The product still contains the bug - it is also using the latest firmware.

    • by GooberToo ( 74388 ) on Friday July 16, 2010 @11:48AM (#32927012)

      And yet to be topical, the article is complete bullshit.

      In order to be compromised, you must first be compromised! Well, no shit! The author then goes on to explain that this is easy because most people don't change their router's password.

      So to summarize the story, if your system is easily compromised, expect to be further compromised. If your system is not compromised, then nothing has changed. In other words, people who don't lock their door in high crime areas experience higher rates of property theft. News at 11.

      I personally don't find this interesting, let alone news worthy.

      • As I understand it, the interesting thing about the exploit this article discusses is that it allows you to hit the router from the LAN side if the user visits a maliciously crafted web page.

        Yes, it still needs to be coupled with an actual exploit; but it is something of a big deal because, while the WAN side security of routers is at least OKish(your vendor has to be really crap to be running the web interface, telnet, or anything of that nature on the outside), the LAN side security is somewhere betwee
        • but it is something of a big deal because

          Its actually not. If you already have access to the router, which absolutely is required, you can already do pretty much anything you want. For example, you could redirect all DNS requests to the "hacker's" DNS server and achieve exactly the same result. Or hell, you could install your own custom router firmware which forwards all LAN side http and ssh requests (transparent proxy) to the "hacker's" own proxies.

          Basically, by the time this hack ever becomes relevant, you've likely already been seriously compr

      • "In order to be compromised, you must first be compromised! Well, no shit! The author then goes on to explain that this is easy because most people don't change their router's password."

        Maybe I'm missing something here, but is the researcher saying that this kind of attack can bypass a router even it if has WAN-side admin access disabled? Is he remotely hijacking the browser, and then attempting to access the router from the inside via a standard address (usually

        If that's the case then this is

    • by mzs ( 595629 )
      I work in industrial controls. You should see what a nessus scan does to EPLCs and vxworks.
  • by osgeek ( 239988 ) on Friday July 16, 2010 @09:08AM (#32925114) Homepage Journal

    Just trying to understand this...

    But a site can have multiple IP addresses, a flexibility in the system designed to let sites balance traffic among multiple servers or provide backup options.

    Heffner's trick is to create a site that lists a visitor's own IP address as one of those options. When a visitor comes to his booby-trapped site, a script runs that switches to its alternate IP address--in reality the user's own IP address--and accesses the visitor's home network, potentially hijacking their browser and gaining access to their router settings.

    How does your DNS stack pick up a new IP address for a host name once it's already been resolved? I don't understand the mechanism for this part of the exploit. Anyone?

    Okay, so let's say the attacker can pull this part off without a problem...

    One comfort for users may be that Heffner's method still requires the attacker to compromise the victim's router after gaining access to his or her network. But that can be accomplished by using a vulnerability in the device's software or by simply trying the default login password. Only a tiny fraction of users actually change their router's login settings, says Heffner.

    So, then the hacker has to rely no the browser running some javascript in the victim's browser that will actually break the security of the victim's gateway router?

    Definitely your vulnerability goes up once an attacker can approach your gateway from the inside, but this isn't a free pass through everyone's home system. Seems like just changing your default password is a great first step to prevent any shenanigans.

    • You just need to resolve the address twice. Seems rather simple. Change their passwords? Most routers default to having NO password at all. And even if you set one up, and change it, most users have their browser remembering the login.
      • by AHuxley ( 892839 ) [] might help with a default list.
      • Re: (Score:3, Interesting)

        by galaad2 ( 847861 )

        no password at all? try "impossible to even set a password"

        on December 19th 2008 i bought a Sweex LW300 wireless router ( [] ) only to discover that the damn telnet service would not require a password AT ALL if you connected from the inside network.

        Even if i set a password for the web admin interface, cycled power two or three times, it was all for nothing. The telnet service was left wide open for anyone on the internal network (including wireless). Not even the passwd command was worki

        • Re: (Score:3, Insightful)

          by Magic5Ball ( 188725 )

          > in total about 10 thousand euros of lost sales for Cisco/Linksys because of that one crap router they saddled me with for Christmas 2008

          So their filter against non-profitable clients has worked as expected.

          Each time a human at Linksys touches a customer, the company incurs at least 5 euro in costs. Since Linksys relies on retail volume and not consultation for their consumer sales, it's to their financial advantage to never hear from customers once the sale has been made, and especially to their advant

    • by Zocalo ( 252965 ) on Friday July 16, 2010 @09:38AM (#32925350) Homepage
      As I understand it, it generally works like this: You set a ridiculously short TTL on the server hosting the exploit. When a victim connects you grab their IP address, add it and any other likely target IPs to the list of A records for the server and reload the zone. Your attack code just needs to wait for the TTL to expire, DNS to refresh and then try and connect to the target, which now appears to come from an attack on a trusted network.

      Going to be interesting to see what this talk is going to add to the mix though... Either way, now would be a really good time to change any easy to remember, alpha-numeric only device passwords, if you've got any.
    • by L4t3r4lu5 ( 1216702 ) on Friday July 16, 2010 @09:46AM (#32925452)
      It is the first step. In fact, apart from a firmware vulnerability or some REALLY shocking DMZ setup, you're going to leave this attack with nowhere to go just by changing from the default password. There might be a second exploit in the form of a dictionary attack tacked on to the end, but that's not what the article is about.

      It's not that big a deal. It's a headline of the type you're likely to find in the Daily Mail; Sensationalist and inaccurate. There might be more info in the future which justifies the grandeur of the statement, but right now (pre-Black Hat) it's just bullshit sensationalist speculation from Slashdot's specialist on the matter.

      (Yeah, i'm getting a chip on my shoulder about this guy.)
      • Re: (Score:3, Insightful)

        by DrgnDancer ( 137700 )

        A dictionary attack using JavaScript in your own browser? Even assuming there is no lockout time for login attempts built into the router that would take fricking forever, and it would be interrupted the moment you closed your browser. This seems like it would be a vector for a firmware bug attack or for an attempt at obvious default passwords. Otherwise it would almost certainly fail.

        • Re: (Score:3, Funny)

          by L4t3r4lu5 ( 1216702 )
          Excellent! So, I was correct in labelling this whole shitty story as another inflammatory chod-fest at the hands of Slashdot's very own version of the Daily Mail, kdawson.

          Will he never cease to amaze me?!
    • by Bengie ( 1121981 )

      My router didn't allow internet access until you changed the admin password. After that, you could change it back *if* you wanted, but it was just that way for the first time setup.

      Same for the wireless. The AP on my router came disabled and required an AP password entered before it would enable. After enabling it with a password for the first time, you could remove the password and make it insecure/open.

      Now I just need DD-WRT to stabilize for my router so I can use the IPv6 my ISP has.. :-|

    • by BZ ( 40346 ) on Friday July 16, 2010 @12:19PM (#32927474)

      > How does your DNS stack pick up a new IP address for a host name once it's already been
      > resolved?

      It doesn't. The way you do this is to return a list of two IP addresses for the hostname when it's first resolved; the first IP is your server and the second is the user's router.

      Then you serve stuff up as normal. When you want to carry out an attack, you point the browser to a url that has your hostname (probably in an iframe that's part of your page) and have your server refuse the connection. When that happens the browser will fall back to the next IP in the list and try it (that's how round-robin DNS works), and load a page from the router; if you pick the path part of your url right, this would be the login page. Now the key here is that web browser security policies are based on hostnames, not IP addresses. So the router's login page is now same-origin with yours and you can run script that does things to it. Like filling in the default admin username/password and submitting the form, for example. Or direct XMLHttpRequest access with the right Cookie headers, whatever.

      Changing the default password definitely helps.

      Some browsers are working on changes that would deny attempts to connect from a public IP to one on the local network, no matter what the hostnames are. That would stop this cold.

  • Browser Issue (Score:3, Informative)

    by Manip ( 656104 ) on Friday July 16, 2010 @09:10AM (#32925124)

    First things first, you can block most of these attacks by setting a new router password and or changing the router's default IP. Secondly browsers could very easily solve this by disallowing mixed local (192.*, 10.*, 0.*, 127.*) and remote IP addresses from a single site. If it is a local server it won't be load balancing with something on the Internet and the reverse is equally true.

    • Re: (Score:2, Informative)

      by Grandim ( 1390511 ) You missed some privates and you had some legitimate publics listed has private.
    • by BZ ( 40346 )

      Its not very easy to do the IP address thing. For one thing, often the browser has no idea what IP addresses are involved (e.g. if it uses a third-party networking library; something that's common with browsers that are the default on their OS, since they just use the OS-default network library). For another, even if you technically know surfacing that information can be ... difficult. Firefox has this issue, for example; they're working on a patch along the lines you describe, and it requires adding a w

    • by Sigma 7 ( 266129 )

      Secondly browsers could very easily solve this by disallowing mixed local (192.*, 10.*, 0.*, 127.*) and remote IP addresses from a single site.

      There's sometimes a valid reason to have mixed local and remote content, even if such uses are niche. In particular, Greasemonkey-style scripts are local and act on remote pages. You may also have a local framing system that allows you to more quickly navigate through a system, and some links through the frames may eventually lead to a remote site. And also, NetVampire (now obsolete) can easily be configured to run from the local hard drive.

      Also, most exploits (beside the DoS link to "c:\con\con") were cr

  • default configs on routers are a joke. Last I checked, linksys routers still tended towards unsecured wireless networks and default passwords. While extremely convenient, most users will abruptly drop the setup process once they can connect to the internet on their laptop. What the router firmware needs to do is force the user to set up a password and a security protocol before allowing direct access to the internet.

    Before this step is taken, every other "security" exploit is a joke in comparison.
  • by digitalsushi ( 137809 ) <> on Friday July 16, 2010 @09:24AM (#32925248) Journal

    The issue is that the web servers on these little CPEs, and also lots of just general intranet websites, is that they do not inspect the Host: header of the incoming HTTP request. So when someone DNS rebinds your initial request to, your browser sends this host to the CPE, and the CPE ignores it. Unfortunately, there's no good way to match a host header on a CPE management page because who assigns DNS for their internal networks? Geeks, that's who. No one else. So when you connect by IP address to your gateway, the host isn't even set at all.

    This is one of those things that SSL certificates can solve. I learned two weeks ago here on slashdot, thanks to another poster, that you can get free level 1 SSL certificates signed by I got mine returned in about 2 hours, and had it working with 10 minutes of work. Granted, I am not going to be able to reprogram the proprietary CPE with an SSL certificate, but hopefully a few of you find this link useful and can get your hobby website running with SSL, like I was able to do.

    Even though you can change the credentials of your website (CPE, wiki, accounting system with web interface), it's still very possible for someone to brute force these credentials. Anything that can be realized with javascript is possible.

    The best solution is DNS pinning... your browser locks the website to the initial IP of a round-robin A record response. This is horrible for the general health of the Internet, but not a bad solution for people who wish to avoid these styles of attacks. Me, I'll take my chances with the attacks...

  • Here's the secret fix: change the default password on your home router.

    Phew! Black hats thwarted again!

    • > Phew! Black hats thwarted again!

      By you and a few thousand other geeks. Hundreds of millions of "consumers" remain vulnerable.

      This could have been prevented by the vendors taking the obvious step of making the router serial number the default password.

  • by davidwr ( 791652 ) on Friday July 16, 2010 @09:34AM (#32925318) Homepage Journal

    Odds are the good guys haven't found all the vulnerable ones.

    Oh, if you count routers left in their default configuration + human vulnerability to social engineering attacks, the number would be well over 50% even without any actual design flaws. This assumes having a common default login isn't itself a design flaw - which I think it is.

    On that note, 2-Wire does it right: They have random-looking default management passwords printed on the bottom of most of their modem-routers. There is no universal "default login" you can look up on the Interwebs.

    • Agreed. I think 2-Wire does a lot of things right. Initial connection to a factory default router automatically initiates a setup process, which IIRC, will not give you internet access until completed. This process also forces you to change the default password, and, again IIRC, has the default wireless security set as WEP. Though, it has been a very long time since I set one up (they tend to last quite a long time, too); I may not be remembering things quite right.

      They also tend to be smart enough to "n
  • by netsavior ( 627338 ) on Friday July 16, 2010 @09:35AM (#32925322)
    This is only a problem when a geek looks at it, the average consumer doesn't really care, and they are right to not care.
  • This attack is just a redirect. It redirects an attack to inside your network to hopefully exploit a second vulnerability in your router. It relies on a second attack to actually compromise the router itself, either a firmware vulnerability or weak security settings. This isn't a single attack which will root your home networking devices by itself. It's just a way of directing an attack to run from inside your network (where security might be weaker) and doesn't allow any access in and of itself to your rou
    • by afabbro ( 33948 )


      As further evidenced by the recommendations in the article:

      • Choose a strong admin password
      • Make sure your firmware is up to date
      • "Be careful which web sites you visit."

      I learned nothing new here today.

  • by udippel ( 562132 ) on Friday July 16, 2010 @10:18AM (#32925788)

    Everyone knows this; and one way or another in these sicko days of ours, one simply has to make the headlines to grab attention; followed by get-rich-quick.
    Fine. Let them try. I wished, though, some clever chap in Slashdot would have vetted the whole lot sufficiently, to dump it where it belongs: into the trash-bin.

    Here is why: Because it actually is an attack. An attack that works for dumbos only. For people, who ought not legally be allowed to buy an access point or whatnot.

    Here is the attack: assume router XYZ by default comes with username 'root' and password '12345'. The same router, as default or after reset, offers dhcp in, with as gateway address. Then, following the trick, some becomes available on the outside (WAN). So when you blindly send 'root' and '12345' to (to the box), from the outside, you're in.
    As I said, yes, it is an attack. But for any sane setup it will fail miserably, because you have changed the internal network; and most of all, you changed at least the password.
    I dunno, and haven't tried - because I have better things to do with my time - if any of those spoofing-filters that simply drop RFC1918-compliant addresses on the WAN-side would also fail the proposed attack, despite of default network, username and default password.

    Shakespeare would probably have called this 'much ado about peanuts'. And as far as I am concerned, anyone who actually is vulnerable, should be slapped with a court order restricting him or her from touching, buying, setting up or administrating any network equipment until further notice, including home networks.

  • now a few thousand admins from around the globe have just logged into their home boxes to "double check on everything"
  • We made changes to pfSense 2.0-BETAS that prevents the DNS rebinding attacks thanks to Craig's help.
    • yay open source! I was shocked to see pfsense on that list in the first place!

      now if only the newer builds after 1.2 booted on my p3 450 :( i could possibly upgrade.

  • How about against 3rd party firmware, ala Tomato [] for Buffalo / Linksys?

    Didn't see any mention of it in the article.

  • Who cares about your router when I can just own your modem? []
  • by Passman ( 6129 ) on Friday July 16, 2010 @11:17AM (#32926522) Homepage Journal

    As someone pointed out a comment on the Forbes story, this exploit can only affect you if you are getting DNS through the router.

    Simply using a static IP & DNS for your computer on your local network would make you immune to this. In situations where using a static IP is not possible (a friend's house, public wifi, etc.) just set your DNS servers statically and you should be fine.

  • by X.25 ( 255792 ) on Friday July 16, 2010 @11:27AM (#32926642)

    I really miss the good old days, where presentations done on security seminars were revolutionary and technical.

    How the hell a mediocre presentation (more related to statistics than security) can make it into Blackhat?

    Oh, I forgot that Blackhat hasn't been a conference but a business, for a long time now.

A consultant is a person who borrows your watch, tells you what time it is, pockets the watch, and sends you a bill for it.