Researchers Hack Over a Dozen Home Routers 109
An anonymous reader writes "Security researchers at Independent Security Evaluators have published a report demonstrating that a slew of home and small office (SOHO) routers are vulnerable to previously undisclosed vulnerabilities. The report asserts that at least thirteen popular routers can be compromised by a remote attacker, and a number of them do not require knowledge of credentials or active management sessions. Some of the routers are not listed as they work with vendors to fix them, but there are 17 vulnerabilities disclosed, with another 21 pending release. An article on CNET includes an interview with some of the researchers."
Use a FreeBSD box as your firewall (Score:4, Insightful)
Re: (Score:3, Insightful)
Except for power and space. Sorry, but I want something that I can tuck away on the wall or on top of a shelf, and the average older computer isn't very suitable for that.
Even a mini-ITX build is still using more power than I'd prefer.
Re:Use a FreeBSD box as your firewall (Score:5, Informative)
pfSense and others like m0n0wall will work on Netgate's ALIX Kits: http://store.netgate.com/ALIX-Kits-C86.aspx
They're small and actually look like a router.
Re: (Score:2, Interesting)
This. We build these for clients and run pfSense on them. Low power, no heat, supports a backup WAN connection with it's three ethernet interfaces. And you can add two more with USB Ethernet adapters.
Re: (Score:1)
Re: (Score:2)
I will NOT sell my riding mower! (Score:1)
screw you!
Re: (Score:2)
Except for power and space. Sorry, but I want something that I can tuck away on the wall or on top of a shelf, and the average older computer isn't very suitable for that.
Even a mini-ITX build is still using more power than I'd prefer.
What about a Raspberry Pi?
Re: (Score:2)
The onboard ethernet is actually connected via USB, and a second network port would have to be connected the same way. It's doable, but not really optimal. Fine for those on low-bandwidth connections, but many internet services now would easily overwhelm it. It's only a 100mbit port at best, and the processor might be a limitation before you reach that point.
Re: (Score:1)
Re: (Score:2)
My Atom mini-ITX router was running happily at 14W.
Re: (Score:2)
Except for power and space. Sorry, but I want something that I can tuck away on the wall or on top of a shelf, and the average older computer isn't very suitable for that.
Even a mini-ITX build is still using more power than I'd prefer.
How about a Raspberry Pi like device with two ethernet ports and FreeBSD on it?
Re: (Score:2)
Exactly. Using an older computer as a router is a massive waste of power (and space). Get something that's designed specifically for the purpose: a modern router like a typical Linksys unit uses a tiny amount of power and is very small. And the software side isn't a problem: just install DD-WRT on it.
Re:Use a FreeBSD box as your firewall (Score:5, Informative)
No he isn't doing that. You'll get the same security benefit of having a roll your own box if you loaded your own custom firmware that was better tested, like say tomato or openwrt (I'm not a fan of dd-wrt myself, but it seems secure enough.)
Re:Use a FreeBSD box as your firewall (Score:5, Funny)
so you would sacrifice security for convenience? Then, you deserve neither*.
You're right. He should block all traffic and whitelist every single IP address as he needs to. Actually, he should manually inspect every packet he receives. Actually, he should have all his packets printed at a remote location and FedEx'd to him for examination and re-input.
Re: (Score:3)
Re: (Score:3)
OpenWRT. Linux interface, router package and power consumption. Easy.
of if that is too intimidating, DD-WRT or Tomato.
Re: (Score:2)
No wireless AP though.
Re: (Score:2)
So add the WRT54GL to it running Tomato, OpenWRT, or DDWRT.
$50 from NewEgg
http://www.newegg.com/Product/Product.aspx?Item=33-124-190 [newegg.com]
Re: (Score:2)
Older router, slower processor, G only. Buffalo has some nicer routers with DD-WRT per-installed. Really though, I was just saying that for most people, a wireless access point is their primary concern, not a hardened router.
Re: (Score:3, Informative)
Re: (Score:2)
I find the default software on my RT-N66U to be pretty solid. It's a fine router too, easy to configure, hasn't even needed rebooting since I bought it.
Why not? (Score:2)
I've got one of these [jetwaycomputer.com] running debian wheezy. It acts as firewall/router/wifi-hotspot/OpenVPN gateway, and even allows me to have a *real* DMZ, unlike most home routers.
Re:Use a FreeBSD box as your firewall (Score:5, Insightful)
I like these embedded devices because they are low power (save you money on an ongoing basis) and do the job. Many even offer some nice things like switch management (e.g. creating vlans) if you use custom firmware. That said, if you do switch to a custom firmware, chances are good that you are immune to these vulnerabilities.
These security researchers don't really count on the later though. They advocate requiring these devices to require signed firmware. That means no custom firmwares, so if your manufacturer ever abandons the device, and security vulnerabilities are later found, you really can't do anything about it. I like custom firmware for not only that reason (e.g. it uses software that is generally better tested against threats) but because it ads features that most OEMs require you to pay a LOT extra for.
I hope none of these vendors take the signed firmware advice, or at least allow you to sign your own. But many here already know how that goes. I think Netgear is the only one that might set itself apart in that regard as they carry certain models that are explicitly advertised to the customer as being able to use your own firmware.
Don't forget Buffalo (Score:3, Informative)
The Buffalo Nx00 series (mine is an N900 I think) also uses DD-WRT and actively advertises it. In basic mode, it is a Buffalo branded implementation but there is a variable to set which puts it in advanced DD-WRT Mode. It was the primary driver in my decision to purchase said router. My knowledge at the time was that Buffalo only did backup solutions & SANs but went out on a limb and bought it anyway. I have never been more happy. Buy one today!
Re: (Score:2)
If I didn't have a Cisco/Linksys E1000 running DD-WRT, I'd definitely be getting a Buffalo just for their support of DD-WRT.
Re: (Score:3)
Probem with Pi is that its network throughput is kinda bad. I have a 50mbit pipe, and pi seems to top out at 35. Kind of problematic for XBMC use for me as well in that playing blu-rays results in buffering for me for the high bitrate ones (add nfs/smb overhead and you dip down to 30mbit - some of my blu-rays peak at 39mbit.) Still trying to figure out of the problem is just me (I only got the pi a week ago) or if everybody with high bitrate ripped bd's has this problem. And no, I don't want to transcode th
Re: (Score:3)
That's because the Pi chip doesn't have ethernet at all. Instead the ethernet port is connected via USB internally. It was the only way to meet the low-cost requirement, but comes with a performance cost: USB takes considerable processor time for bulk data transfers.
Re: (Score:2)
Re: (Score:2)
Warning: $1 a day for some "older computers" (Score:5, Insightful)
BTW - anyone with an old VCR or DVD player you REALLY don't use... about $18 year just to keep it plugged in (flashing 12:00 or not). I tossed 2 units in the Goodwill bin a couple of years ago and haven't missed them.
Won't help you (Score:3)
Using a firewall box behind the router your ISP mandates you use, will not help you against a number of threats. Basically, they take over your router, put a sniffer on it and they can sniff all your internet traffic. The extra firewall may or may not prevent them gaining access to your computers behind the IPV4-NAT your router usually does. That's the only protection an extra firewall might give you. I'm saying might, since slight misconfiguration or access to a hackable service behind the firewall will ne
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Basically, they take over your router, put a sniffer on it and they can sniff all your internet traffic.
I'm sure all of the encrypted SSL traffic between me and 80% of my web browsing will be incredibly useful to these malicious attackers.
Re: (Score:2)
Oh, your router can't act as a vpn client? Guess you should check out pfsense.
Re: (Score:2)
Of course it can. Why would I need pfsense when I have a cheap efficient dedicated device with gig ethernet and twin 450Mbps wifi links?
Re: (Score:2)
For people who have an old working computer around and a place to set it up, know how to install FreeBSD (and cope with any driver issues, etc.), and how to configure it. That's a very small segment of the population.
It would be really nice to have the vast majority of the population immune from being hacked into, and that's just not going to happen with FreeBSD installations. Most people are going to buy whatever router they're told, and leave it in whatever configuration it's in when installed (or af
ISP Provided? (Score:1, Interesting)
Re:ISP Provided? (Score:5, Insightful)
Yours for either A. having your credit card information on the network in an unencrypted state, B. transmitting it without making sure the HTTPS lock is present, and/or C. not having adequate deskop security.
It takes more than just an accessible router to get to sensitive information... if an unauthorized party is able to access that information, 9 times out of 10 it'll be a user's fault.
Re: (Score:2)
Yours for either A. having your credit card information on the network in an unencrypted state, B. transmitting it without making sure the HTTPS lock is present, and/or C. not having adequate deskop security.
It takes more than just an accessible router to get to sensitive information... if an unauthorized party is able to access that information, 9 times out of 10 it'll be a user's fault.
Most people use dynamic addressing and delegate the DNS lookup to the router. This means Https or any of the other things you mentioned are useless as security measures.
Re: (Score:2)
Simply falsifying DNS won't do it - you can't impersonate an https site without a cert. Easiest way I see would be to intercept logins to non-https sites, and rely on the user reusing passwords.
Re: (Score:2)
you can't impersonate an https site without a cert.
Maybe. The recent browser releases have taken a step to improve the situation by remembering if they used https for a host before and doing it by default the next time but its not 100%.
Consider:
You type thinkgeek.com in your url bar. You don't specify the protocol because only those of us slashdot readers understand the risks inherent in not doing so bother and your browser decides to use plain http. An important omission was made but no typo. I intercept your clear text 80 traffic and rather than th
Re: (Score:2)
In an ideal world software vendors wouldn't put users in a position of choosing between trusting their internet connection and not getting the software. Certification authorities would make damn sure they were issuing certificates to the right entity. Credit card companies would move away from a system where the dominent way of making an online payment is to give the vendor a code that lets them take unlimited money from your account. Users would directly enter the https url or at least carefully check the
Re: (Score:2)
In an ideal world software vendors wouldn't put users in a position of choosing between trusting their internet connection and not getting the software.
Most of the majors have a system for buying game cards in a physical store. If the user prefers convenience, that's on them.
Credit card companies would move away from a system where the dominent way of making an online payment is to give the vendor a code that lets them take unlimited money from your account
Credit card companies used to do this via one-time virtual card numbers. For the most part, the user found it inconvenient and didn't use it.
Re: (Score:3, Insightful)
the people responsible are the ones who committed the crimes, not the people who coulda-shoulda-woulda been in positions to prevent it if they had done X more.
Re: (Score:3)
Re: (Score:2)
It's the fault of the person who stole your information...or at least it should be. Today's over litigious society probably disagrees.
Fault? (Score:2)
Re: (Score:2)
Somebody alert NASA (Score:3)
Yes I did go to the actual article, but got bored after reading the headline.
This time I'm intrigued... (Score:4, Interesting)
Comprosing cheap routers is a topic that has been covered on Slashdot many times before. In every previous article, they've required that remote administration be enabled on the router, which is generally never a default setting. This report states, "tested with out-of-the-box configuration settings". Really? Yikes.
Easy to mitigate. (Score:5, Insightful)
They're pretty much all CSRF vulnerabilities. Don't save your password to your router or don't use a common router IP address like 192.168.1.1
Re: (Score:3, Interesting)
They're pretty much all CSRF vulnerabilities. Don't save your password to your router or don't use a common router IP address like 192.168.1.1
I'm scratching my head here - why would an address like 192.168.1.1 be a problem? It's only an internal IP address. An attack from the outside would come through the external IP address. Once they've breached the router, surely it'd be simple to find internal addresses anyway?
(Really hoping I don't have to re-address my stuff!)
Re: (Score:2)
They're not running code on your browser. They're just making the browser perform a request. You need to know the routers local IP for that to work.
Browsers block cross-domain code execution, so you can't read any data that comes from another domain via Javascript. All you can do is blindly fire off requests.
Re:Easy to mitigate. (Score:5, Insightful)
Because its cross-site-request-forgery.
If you're logged in to your router and you go to another website that has an image tag with a url of "http://192.168.1.1/admin/enable-remote-login" or submits a form using javascript off to 192.168.1.1 then they've effectively made that request from inside your local network via your browser.
If there is an exploit that enables remote admin then not only has the attacker now enabled remote admin on your router but they have your external IP address to exploit because you made the request...
I'm disappointed in the Slashdot moderators for giving this +4 Insightful. It was a good question though.
Re: (Score:1)
I am a moderator who gave him a +1 for that question. It will be undone, of course, because I posted in this thread. It was a good question that I wanted an answer to. Now that it got up to +4, someone answered it. If it was still sitting at Score:1 where it was before I gave it mod points, would anyone have bothered to answer?
I'm disappointed in the parent poster for dissing the moderation system because it worked as intended.
Re: (Score:2)
I'm disappointed in the parent poster for dissing the moderation system because it worked as intended.
Perhaps the OP meant that "interesting" would be a better fit than "insightful".
Reference: http://slashdot.org/faq/metamod.shtml [slashdot.org]
Re: (Score:2)
I answered it because it's a reply to my post. Nothing to do with how many points it got.
Re: (Score:1)
DD-WRT (Score:2)
Re: (Score:1)
I wonder how DD-WRT stacks up.
It bothers me that the "Latest stable release" on DD-WRT's website still refers to a version (10020) which is vulnerable to a remote code execution discovered in 2009. You must be running a version marked as "development" to be secure from the bug, which is bad marketing.
pfsense (Score:2)
dont fuck around
Re: (Score:1)
Confirmed case here (Score:5, Interesting)
My parents' ISP issued router came down with a case of malware. The ISP kept putting them into walled-garden claiming botnet activity, and after months and months of this, I intervened. upon my investigation (which also took months) and thanks to their reluctant but cooperative security team, we determined it was not the only connected device that had the malware, but the router itself. And only because I "hacked" into it at some point and observed the malware in action, and reported my results back to the ISP. I thought my method (though it required some circumvention) was an intentional feature of the router. I didn't realize it was a vulnerability. Not at the time. I mean how do they remotely configure your router while on call or live chat with them? How can they expect me to think I can't do the same thing myself?
Re: (Score:2)
Re: (Score:2)
Schhhhht! (Score:1)
Use Endian firewall and an old desktop computer. (Score:1)
Only idiot, moron, democrat, socialist, communist, (Score:1)
Victim Must Have Active Management Session... (Score:1)
Look at the summary chart in the article. [securityevaluators.com]
With the exception of two Belkin routers, the victim must have an active management session open at the time of attack and the victim must be tricked into clicking a malicious link that leverages the open management session. This renders this "vulnerability" as highly unlikely. Most people do not open management sessions after initial router setup.
Not surprisingly, this article is full of hyperbole and the likelihood of actual router takeover is minimal to infinitesi