D-Link Apologizes For Router Security 107
Mark Wilson writes D-Link has issued an apology to its customers for an on-going security issue with many of its routers. A problem with the Home Network Administration Protocol (HNAP) means that it is possible to bypass authorization and run commands with escalated privileges. The list of routers affected by the issue is fairly lengthy, and D-Link has already issued one patch. But rather than fixing the problem, last week's update left routers wide open to exactly the same problem. As it stands at the moment, a firmware patch is still being produced for a total of 17 routers. In the meantime, all D-Link has to offer is an apology. While unhelpful patches have already been issued, D-Link is currently working away on replacement firmware updates. The release dates for these patches is not yet set in stone, but some are due today (20 April), some tomorrow (21 April) and the remainder on 24 April.
Words without actions are meaningless (Score:5, Insightful)
Re:Words without actions are meaningless (Score:5, Insightful)
Depends on how we define "mean anything".
"We're sorry we have sold you shitty products but won't fix it" is just PR.
"We're sorry we've solve you shitty products but will replace it at our expense" is actually doing something.
I suspect this is one of those corporate apologies designed to say "fuck you, but thanks for playing, hopefully we've minimized the fallout of writing shitty products by issuing a half-assed apology".
I'm hoping the absence of my DIR-615 isn't "we're sorry to tell you we made a shitty product and forgot to check if it was vulnerable".
I keep saying, corporations should have some liability for implementing terrible security. Especially for a product whose job it is to be a firewall.
Re:Words without actions are meaningless (Score:4, Insightful)
"We're sorry we've solve you shitty products but will replace it at our expense" is actually doing something.
The ideal response in my mind would be: "We're sorry - so here's how to unlock the boot-loader and here are third-party open source firmware providers that we tested for you."
Re: (Score:1)
I keep saying, corporations should have some liability for implementing terrible security. Especially for a product whose job it is to be a firewall.
It's not a firewall. It's a router.
I'm not defending D-Link in any way. But it is extremely important to know the difference. These devices do not offer much in the way of security.. NAT is not a security measure.
Re: (Score:3)
NAT provides implicit security, even if it is not explicit. Being on an unroutable subnet means theres really nothing an intruder can do to get to your PC short of static port mappings.
Re:Words without actions are meaningless (Score:4, Informative)
I understand these things quite well, as I wouldnt be in the field if I didnt. NAT provides some degree of security in the sense that if you are on an IPv4 network (99% of home users) on an RFC 1918 network (99% of home users) with NAT enabled, it is impossible for anyone to send an unsolicited datagram to your computer behind the NAT.
There are technologies which punch holes in this (like uPnP), but that does not change the implicit security.
NAT in a typical Linux based router does not prevent someone on the external interface from talking to any port and any host on the internal network
Then you have a static port mapping. Generally to get through the NAT you need to know the public IP and port (out of 65536) you want to connect to, which is dynamically assigned. Then you need to deal with the fact that anything you send is going to be pinned to a specific client port not of your choosing, and you will not know the correct source port to get the client to accept your unsolicited datagram (whch will thence be dropped).
I never said it was perfect security, but it prevents folks from accessing listening ports (like 135-139) as a listener port wont have a dynamic mapping-- only outbound traffic gets those.
But you seem to think Im wrong, so educate me. Lets set up a scenario.
Gateway Public: 1.2.1.1
Gateway private: 192.168.50.1
Windows XP box: 192.168.50.5
No firewalls, NAT on the gateway, Windows XP listening on port 135-139.
What Layer3/4 headers are you going to use thats gonna get a packet delivered to one of those 4 ports on that XP box?
Re:Words without actions are meaningless (Score:5, Informative)
For starters, I have read up on it, and many many vendors agree that it IS security.
Sources:
Cisco (Top 2 paragraphs of intro) [cisco.com]
http://www.cisco.com/web/about... [cisco.com]
SANS institute (Page 5, 2nd paragraph) [sans.org]
And so on.
As to your solution, it has a massive issue. Route tables must use next hops as their gateway; you could not enter a command like that targetting my WAN, and have it work, because my WAN IP would not be a next hop for your computer. The only thing your route table can do is instruct your computer which IP on your broadcast domain will be willing to handle your datagrams. At that point, it is up to that router to figure out the next hops.
You will note I asked you what the L3 / L4 headers would be on your packet; this was specifically to demonstrate why such attacks would fail. You would have a source address of 9.9.9.9, and a destination of 192.168.50.5, and you would instruct your computer to pass that datagram off to a router at ethernet address 99:99:99:99:99:99 (your router), and he would promptly vomit and say "what the hell I cant route an RFC1918". Add the route on your router, and you've shoved the issue back to your ISP, whose router would either fail to find a route for that subnet, or (more likely) outright reject it as a violation of RFC.
The only scenario in which this attack makes sense is when the attacker IS the next hop, that is your ISP. And for 99.999% of users, this is not a realistic threat model they will face, and NAT will be "acceptable" security.
No one argues that a stateful firewall is BETTER (as it prevents attacks like you mentioned), but to say that NAT adds no security whatsoever is being silly; major infrastructure vendors disagree with you.
Re:Words without actions are meaningless (Score:4, Insightful)
The "security" you attribute to NAT does not come from NAT, it comes from using "private" addresses.
Im pretty sure thats what I said, and no one is arguing that point. You're just insisting on being pedantic and condescending.
Your original statement was that NAT is not security. This post of yours agrees that it is security in some shape. If we're agreeing there, then I dont think theres any reason to keep arguing. If youre disagreeing with that, Id ask you to take it up with the links I provided and with stackexchange. I dont have the time to try to make Cisco and SANS' cases on their behalf, if you are unwilling to take their word on it.\
. Besides, why do you trust your ISP not to snoop around on your network?
Because it is an unusual attack scenario, and it would be illegal. It does happen, sure, and defending against a malicious ISP is far beyond the scope of most home security. Luckily for us every consumer OS made in the last 10 years has a stateful firewall, and every consumer router built in the last 10 years has a firewall, so its not an issue.
I mean good grief, 99% of home users are using the ISP provided DNS, and you're worried about probing through NAT in violation of the RFCs? DNS snooping is something that actually happens, and is actually legal. Risk assessment 101: focus on the probable threats.
Without mentioning the need to filter incoming packets, that tutorial concludes: "A computer located in the internet is not able to establish a connection to a local computer, all he can do is address (a port of) the router and hope the best."
Wrong, and leaves anyone who follows the tutorial vulnerable.
As mentioned already, it is impossible in the absence of a published route to your network for someone to reliably send packets directly into a dynamically natted network. The fact that someone could splice onto your cable network is irrelevant, because at that level of effort they could probably climb in through your window and just steal all of your equipment. You're talking about extremely esoteric attacks.
You're really doing people a disservice by perpetuating the myth that NAT adds security.
Im perpetuating the stance of major infrastructure vendors. Argue with them. I imagine you could contact support@cisco.com and explain why their statement that NAT fulfills a security role is incorrect.
In the meantime I would suggest you cut the condescending attitude.
Re: (Score:2)
3 points.
1) Security measures are measures which mitigate vulnerabilities. Mitigations can involve avoiding an issue, or reducing risk. When you take the potential pool of attackers from "the entire internet" and reduce it to "People with direct access to the link between me and my ISP", you have reduced risk. This is Security 101 stuff, its called "risk assessment".
2) No one is suggesting NAT is the best security ever-- just that it provides some degree of security by way of mitigating some threats. Ot
Re: (Score:2)
Then go get a job at cisco or SANS as their chief security engineer, because you clearly know better than them.
I mean, hey, what would Cisco know. Theyre just the folks behind the PIX, the first device to support NAT.
Re: (Score:2)
I can tell you that if my memory serves me correctly NAT works by changing the last two digits of the mac address on the packets going out so that when they come back in the box knows which port to traffic to.
Thats not really what it does, though its sort of close.
NAT covers a large number of different scenarios; the specific one we are discussing is known as Source NAT, or dynamic NAT (or PAT, in the Cisco world).
In this scenario you have a range of private IP addresses that are not publicly routable, and a single publicly routable WAN IP address to be shared among those private hosts. Each IP packet sent will have a source IP, source port, destination IP, and destination port. The router takes each outbound
Re: (Score:2)
If you want to run a test, I will turn off my stateful firewall and give you my current WAN address, and the private IP of a host running a web server; the test would be to see whether you are able to determine what the text of that webserver is.
You wont be able to, however, because as we all know no ISP in the world is going to route your packet because the destination address will be RFC1918-- not because theyre good guy ISPs, but because they cant. This proves the point: The use of NAT-- even in the ab
Re: (Score:2)
I do know that it will prevent unsolicited traffic from the wan port into the lan section as long as the connection was not already open from the lan side.
This is not entirely correct, and is his entire point. Someone who is directly connected to the WAN of your router COULD access a port on the inside by manually supplying a route to your private network.
The security value of NAT is that WAN hosts do not generally have a way of routing traffic to your internal private subnet. However, if an attacker had control of every router between them and you, they could manually set up a route into your network.
In that sense he is correct: NAT doesnt provide any gua
Re: (Score:2)
Well, if it's running linux, it's probably using netfilter so it probably does have a firewall..at least a drop policy with dynamically opened ports for established/related connections. NAT's security is from the fact that the rfc1918 hosts' addresses are not directly routable, but that's about it. It does not replace a firewall.
Re: (Score:1)
NAT adds security the same way that the two sets of doors into a shopping mall add security -- an extra layer people have to get through while on their way in/out. They both actually stop absolutely nothing, but they provide another point of defense, and a bit more clarity if something odd is going on.
Of course, that's pretty much meaningless if you don't have a security guard *inside* your NAT. Don't expect some random shopper to report the shoplifter/vandal. And the fact that they're a shoplifter/vanda
Re: (Score:2)
http://www.devttys0.com/wp-con... [devttys0.com]
I don't know if that is the same issue or ont.
Re: (Score:3)
Re: (Score:3)
I worked for D-Link for over 7 years. The major issue have always been software, same as most low cost product. The competitors were also plagued with some of these issues because they used the same H/W and software with a different plastic case and different looking web interface. So chances are that not just D-Link has these issues but possibly Retail+, SOHO, and many of the other off brands you see at Wal-Mart, Best Buy and Staples.
When I worked there, the biggest issue was competitor launching products
you don't want their actions. (Score:5, Interesting)
Keep in mind this is a company that has a history of doing malicious things; willful violation of GPL that was resolved only when they're drag into the court and lost, hard coding default time server IP address in firmware (imagine hundreds of thousands of them all attempting to sync at the same time daily) It demonstrated a culture of (sociopathical) disregard for others, that alone is reason enough to not buy any of their products.
Re: (Score:2)
A complete disregard for the customers because there is ZERO penalty for producing a shitty product.
Do you purchase their products? Will you in the future? Will you be recommending their products to any people or businesses that you know? Will you be praising or condemning them in venues like this?
What penalty did you have mind beyond them losing sales?
Should we criminalize imperfect software? Let's see some of your code.
Re: (Score:2)
Actual enforced consumer laws should be sufficient. In particular, if the device (which *IS* advertised as having a security function) is unfit for purpose (that is, it has serious security flaws), they should be forced to fix it, replace it, or refund it (and if they want it back, they'll need to send out pre-paid packaging for it).
If they choose to replace it, they should ship the replacements out at their cost and again, include pre-paid packaging if they want the old one back. If they can fix it in firm
Re:Friends (Score:4, Funny)
(hand holds egg) This is your home network. (breaks egg into frying pan). This is your home network on D-Link. Any questions?
Re: (Score:2)
Fried eggs taste better than raw eggs.
Re: (Score:2)
if we're going with Bad Egg Analogies, then my retort would be "can't make a custard pie with fried eggs"
Re:Automated Testing (Score:4, Insightful)
Re:Automated Testing (Score:4, Interesting)
What he wants is automated regression testing. They did know about the bug before they tried to fix it.
Re: (Score:3)
Yes there is. In fact many types compliance audits, like PCI Level I, require it.
Look up "vulnerability scanner"
Re: (Score:2)
Re: (Score:2)
Almost all problems that cause actual loss for business are caused by *known* vulnerabilities.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Automated Testing really only works for making sure things work the way they're supposed to work. There really is no such thing as automated Penetration Testing.
But you can automatically try to find known issues using common attack vectors and avoid shipping the known ones. You can also automatically try randomly generated kinds of potential exploits and see what happens to your software. It's called fuzz testing. And it can expose *possible* exploits, especially if you know something about how your software works. For instance, you can detect that some random packet got passed by the TCP stack and was sent to an application which did something unexpected like lo
Comment removed (Score:3)
Re: (Score:3)
The NO CARRIER jokes were funny when triggered by +++ATH0+++
Good security (Score:5, Interesting)
Re: (Score:1)
This has also been my experience. My internal wireless segment is currently running on an old WAP54G specifically because the D-Link that was purchased to replace it became flaky and fried itself within six months.
Re: (Score:1)
Ya, I agree! DLink always has been garbage, and always will! I have owned Linksys (aka crappy Cisco) which is moderately better than DLink, but have had better luck with NetGear. That being said, with any home/small office network device, if possible, I always remove the crappy factory firmware and install DDWRT on it.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I have a couple of DIR-825s in my house, and they've been rock solid. Of course, the very first thing I did with them was flash them with DD-WRT. One acts as a router, the other as a WDS station to improve signal coverage throughout the house.
gee thanks (Score:2)
Our customers won't know (Score:4, Insightful)
Re: (Score:2, Insightful)
The majority of our customers have no idea how routers work, let alone that they can update its firmware. When we explain that a router is a mini-computer that offers a high level of control to them, some of their eyes glaze over as they think a port is what you plug a cable into. When told that firmware can be updated using DD-WRT or the latest OEM version to patch vulnerabilities, only a few understand how to do this, even when we explain it to them. We do offer to perform the work for them, but most don't care unless their router is acting wonky. Unless D-Link sends letters, not an email that would likely be perceived as spam, to registered owners with simple instructions on how to update firmware. very few of their routers will be patched in the real world.
Yes, this is absolutely true.
But, more importantly, consumers SHOULDN'T HAVE TO patch the firmware in their routers. No software is perfect, but this is just getting ridiculous. It's not just D-Link, even though they may be among the worst of the worst, there is now a complete disregard, industry wide, for even the most basic standards of quality.
Re: (Score:2)
My experience with firmware updates on most devices of the same caliber is that they often reset your configuration which means an auto update would not be advisable. As the devices receive more memory more update options will become available. We probably aren't too far from seeing these types of devices auto update.
Re: (Score:1)
Their letters will also likely be rejected as junk mail.
I've done that with more than a few "legal notifications" that I've gotten.
Some of them were, others were perhaps conceivably legitimate.
Re: (Score:2)
The majority of our customers have no idea how routers work, let alone that they can update its firmware. When we explain that a router is a mini-computer that offers a high level of control to them, some of their eyes glaze over as they think a port is what you plug a cable into. When told that firmware can be updated using DD-WRT or the latest OEM version to patch vulnerabilities, only a few understand how to do this, even when we explain it to them. We do offer to perform the work for them, but most don't care unless their router is acting wonky. Unless D-Link sends letters, not an email that would likely be perceived as spam, to registered owners with simple instructions on how to update firmware. very few of their routers will be patched in the real world.
Yes, this is absolutely true.
But, more importantly, consumers SHOULDN'T HAVE TO patch the firmware in their routers. No software is perfect, but this is just getting ridiculous. It's not just D-Link, even though they may be among the worst of the worst, there is now a complete disregard, industry wide, for even the most basic standards of quality.
And yet one quality standard of mine is the old mantra that if it is not broken, don't fix it, which runs in direct conflict against the idea of vendors pushing automated updates, especially to devices that can and will destroy the LAN and WAN connections.
I'm wondering where this conversation would be if TFA was titled "D-Link new automated update service pushes out patch, bricks 100,000 routers at once."
Basic standards of quality would be assuming the vendor is more than willing to support that 2-year old
Qwality (Score:2)
>> The release dates for these patches is not yet set in stone, but some are due today (20 April), some tomorrow (21 April) and the remainder on 24 April.
Da qwality goes in befo da name goes on, right?
OpenWRT Anyone? (Score:1)
I'm surprised no one has mentioned alternative firmwares... D-Link should issue a patch that upgrades their routers to openwrt.
Problem solved.
Re: (Score:2)
DIR 868L (Score:2)
I have a DIR-868L, it was cheap(-ish) and reviews suggested it had good (unobstructed) wireless speeds. That may well be the case, but unfortunately it has a more serious flaw, only being able to handle about 350 Mbps of my gigabit connection. I'm pretty sure the hardware is capable, but the firmware is crippled. I've already RMA'd one and got another back with the same symptoms. Apparently D-link engineers are trying to reproduce this issue, but I don't really expect them to do anything about it.
So, I'm lo
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I also had a problem, while on Comcast, where my computer waking up from hibernation would not be able to resolve DNS for several minutes. I'd be able to ping numeric IP addresses including Google's DNS servers, which I'd set the machine to use. But it would be
Re: (Score:2)
Ironically, the 868L is listed as having the second-highest throughput on the page you linked. It's very strange that mine isn't working correctly. Maybe alternate firmware will help things. The desktop and the ISP-supplied Actiontec get 890 Mbps on speedtest.net, and it's not like PPPoE is computationally expensive. Thanks for the link, it was informative, depressing, and hope-inspiring all at the same time.
They said their router would work with DD-WRT... (Score:2)
... It didn't. It installed sort of but it didn't work. The firmware was all screwed up and half the features had to be manually tweaked by modifying files using the terminal. Seriously pissed because the only reason I bought the damn thing was because they said it was DD-WRT compatible. Fuckers.
I'm burned on D-link for a good long time because of that.
OpenWRT (Score:5, Informative)
Now this story highlights another issue which is that the manufacturers are trying to add features to their routers. This is antithetical to security. The best thing for security is to keep it simple. HNAP, the basis of the vulnerability in this story, is just such a feature which I don't need or want. I think this all adds up to a situation where you want to avoid manufacturer supplied firmware if at all possible.
It's a good start. (Score:2)
No apologise for D-link router hardware quality.
Sue them out of existence (Score:2)
Speaking as one who is tired of sorting through consumer grade routers every few years, I'd love it if 90% of these "smart router" crapware products just went away. Someone said that the best technology is that which disappears from the user's consciousness, but somehow router manufacturers think that their best play is to worm their way into your attention like an insecure child "Hey, look what I can do! Look at me me me!
Yeah, I'm DLink and look what I can do. Real smooth.
Do I need to access an app st
Glad I use ASUS now (Score:1)
Re: (Score:2)
Re: (Score:2)
That's only good for a small percentage of the population. I'm highly technical and I wouldn't bother with doing my own custom firmware installation unless it's straight forward. To me a router is like a hard drive. I just want to put it in and have it do what is expected of it. Doing updates is obviously a non issue.
FYI, there are a lot of custom firmware available for D-Link products so it's not just Netgear. Also, note that many of the low cost brands you see out there are spin offs from D-Link or Netgea
Re: (Score:2)
OpenWRT is pretty much brain dead simple with the default load if you have reasonable hardware and use LuCi. Usually the load of the firmware is exactly like what the factory firmware does. Yea, LuCi is a bit more compex than your average home router product, but it's still easy enough that I was able to figure it out with very little help. Armed with the FAQ and or WiKi it's really easy and takes you about 3 steps.. 1. set the root password, 2. configure your internet connection and 3. turn on the wireles
Re: (Score:2)
You do understand that most users don't even have the guts to upgrade the firmware on a extremely simple device let alone replace the firmware on an existing router.
There's a reason Apple was the king of smart phones early on. They provided a turn key solution that required little to no knowledge of IT to use.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
ASUS is in the same boat. Their motherboard often come with very broken software that requires updates. I've purchased over 60 motherboards from Asus and of that probably 7 different models total. Even their latest Z97 required a BIOS update due to critical issues found in the 3rd version released. I'm not very familiar with the quality of software of Asus network products but like most network products, security issues aren't noticeable until you get broken into or someone tells you about it.
I'm not critic
This is quite old... (Score:1)
[Mon Apr 13 14:44:22 2015] [error] [client 104.abc.def.18] File does not exist: