Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Networking

New SOHO Router Security Audit Uncovers Over 60 Flaws In 22 Models 66

Posted by Soulskill from the my-god,-it's-full-of-flaws dept.
Home and small-office routers have become a hotbed for security research lately, with vulnerabilities and poor security practices becoming the rule, rather than the exception. A new security audit by researchers from Universidad Europea de Madrid only adds to that list, finding 60 distinct flaws in 22 different device models. They posted details of their research on the Full Disclosure mailing list, and the affected brands include D-Link, Belkin, Linksys, Huawei, and others. Many of the models they examined had been distributed to internet customers across Spain by their ISPs. About half of the flaws involve Cross Site Scripting and Cross Site Request Forgery capabilities, though there is at least one backdoor with a hard-coded password. Several routers allow external attackers to delete files on USB storage devices, and others facilitate DDoS attacks.
This discussion has been archived. No new comments can be posted.

New SOHO Router Security Audit Uncovers Over 60 Flaws In 22 Models More

New SOHO Router Security Audit Uncovers Over 60 Flaws In 22 Models

Comments Filter:

  • What? Again? (Score:1)

    by Anonymous Coward

    How can this be? I pays good money for good stuffs. Dlink is goods?

  • They are missing a few. (Score:4, Interesting)

    by Anonymous Coward on Tuesday June 02, 2015 @07:15PM (#49826993)

    Netgear has some major security flaws they they've refused to address for a long time. Mainly direct remote access. I'm not sure if this is by design via the NSA or because they are horrifically lazy, but I stopped caring what they thought and installed Linux on my router. Openwrt and dd-wrt work better than the original in most cases, except in the realm of tx power modification. That seems to have sucked since people started frying their antenna's and the dev's stopped pursuing it.

  • With 22 different models of crap home routers I would have expected the pen-testing equivalent of clotted rivers of gore pouring through heaps of smouldering rubble and pooling around the skull pyramids that seem to rise higher than the walls that once offered the false promise of shelter. Not merely 60 serious vulnerabilities.

    • Re: (Score:1)

      by koan ( 80826 )

      That would imply they were at least a bit organized.

    • At this rate, it'll be easier (and perhaps more useful to consumers) to list the routers without known unpatched vulnerabilities.

  • "Video Bytes"? (Score:4, Insightful)

    by Anonymous Coward on Tuesday June 02, 2015 @07:30PM (#49827071)
    Fuck off with these horseshit "features" that nobody wants.

  • OK (Score:5, Insightful)

    by koan ( 80826 ) on Tuesday June 02, 2015 @07:44PM (#49827135)

    Most of you /.'ers that have read my comments know that I like to dis Apple, can't stand the fucking fanbois, but I have yet to see the Airport listed in any of these articles.
    If you have point it out to me, it seems they are fairly sound devices.

    • Re: (Score:1)

      by Anonymous Coward

      Yea, Apple makes itself known as selling a rather expensive Airport Extreme router. But they do work harder at firmware and issues. But they are not without problems only the Apple stuff is not nearly as popular as Netgear, Linksys, or some others.

      • Re: (Score:1)

        by Gr8Apes ( 679165 )
        It is expensive, until you need a reliable wireless connection. Then, compared to Cisco and other business class routers, the APE is an absolute bargain. Yes, you don't get enterprisey management, but all I want or need is a reliable wireless connection. Linksys, D-link, TrendNet, Buffalo, etc have all failed at this basic requirement for a wireless router. I used to get a new router every 3-6 months or so as the current one went flaky. Tallied up the costs in a year and decided to buy an APE. 5 years late

    • Re:OK (Score:5, Insightful)

      by NoMaster ( 142776 ) on Tuesday June 02, 2015 @09:31PM (#49827559) Homepage Journal

      Oh, they've had a few (Secunia's down for me at the moment, but there's a reasonably up-to-date list here [packetstormsecurity.com]), so they're not perfect - but yes, they seem on the whole to have their act together.

      Sure, they're not as configurable as a cheap Linksys (although they can be pushed to do anything you'd reasonably* expect a home/SOHO router to do), you can't shoehorn Linux onto them, and the lack of a CLI or web interface (a OSX / Win only config utility) is shitty - but they're solid, robust, & pretty secure devices which are almost perfect for the average home or SOHO user.

      Oh, and the AC who said "Cannot configure them via a wired port, only wireless (wtf?)" is either a troll or an idiot...

      (* running a server, packet inspection, or doing heavily customised routing is not a reasonable expectation for a home/SOHO router - that sort of thing belongs on a separate machine that doesn't have one testicle dangling out on the WAN...)

      • the lack of a CLI or web interface (a OSX / Win only config utility) is shitty

        ..is a total non-starter for me. I broadly speaking like Apple, but they do some really stupid things sometimes and this is most definitely one of them.

  • Then you will see headlines like this "New audit of devices from Internet of Things category uncovers 65 000 flaws in 8 000 different devices, 240 million of this devices are in use today globally". Just think about those botnets...

    • Re: (Score:3, Funny)

      by Chewy509 ( 1178715 )

      Due to the number of growing exploits against SOHO routers, SmartTVs, UEFI firmware, etc... we at work now tend to refer to IoT as BoT... aka Internet of Things == BotNet of Things...

      And it's a simple case of not if, but when this will happen...

  • Stuff is crap anymore (Score:1)

    by Anonymous Coward

    Let's face it, manufactures make stuff for pennies and sell it for as much as they can with as little support and warranty as they can. Notice how you can hardly talk to anyone about a issue without handing over a credit card. Firmware is as flimsy as the antenna these routers use. Nothing about a router seems well built, they skimp on heat sinks and shielding and wonder why their is so much interference? Throw the FCC a few bucks and they pretty much pass anything. Even then the FCC cares so little about s

  • Only concerns ISP-specific models (Score:3, Insightful)

    by American Patent Guy ( 653432 ) on Tuesday June 02, 2015 @08:01PM (#49827229) Homepage

    Past research has shown that the security of ISP-provided routers is often worse than that of off-the-shelf ones. Many such devices are configured for remote administration to allow ISPs to remotely update their settings or troubleshoot connection problems. This exposes the routers’ management interfaces along with any vulnerabilities in them to the Internet, increasing the risk of exploitation.

    So, in other words, these models were specifically made for and distributed by an ISP, and were not off-the-shelf models. The backdoors were there for the ISP managers. For 99% of network users out there, these vulnerabilities are of no practical concern.

    • Re:Only concerns ISP-specific models (Score:4, Informative)

      by gstoddart ( 321705 ) on Tuesday June 02, 2015 @11:34PM (#49827927) Homepage

      So, in other words, these models were specifically made for and distributed by an ISP, and were not off-the-shelf models. The backdoors were there for the ISP managers.

      Well, I trust my ISPs router ... well, not at all, actually.

      Because I assume my ISP is either incompetent or dishonest, I don't really care which, I simply don't trust them. And I sure as fuck don't trust them with access to my actual network. I want a layer of security between me and their shit, because I assume their stuff is trivially hacked.

      My wife and I each have our offices set up where our own router is getting DHCP from the ISPs router, and then firewalling everything from it. We each have our own locked down wifi, and entirely separate networks. I'm pondering a third router to provide the guest wifi.

      Other than disabling the ISPs wifi and using our own, I wouldn't even know the SSID or the password for the ISPs crap. I assume they haven't turned it on without asking, but I never check -- come to think of it, I'd have to find out how.

      My parents and my in-laws have routers we've bought them to sit behind the crap the ISP provides. Because I know for a fact that in both cases the ISP provides a router with default wifi SSID and passwords which are published in the docs they give you.

      Because it's printed in the "how to" for every damned subscriber, and you can't change it, you can pretty much imagine that if you find an SSID of the right name you can connect to it, and probably have management access to it.

      For 99% of network users out there, these vulnerabilities are of no practical concern.

      But the problem is so many households trust that the wide open, back doored, well known remote-admin credentialed, shitty routers they've been provided with give them any form of security.

      Which means for the overwhelming majority of home users who aren't tech savvy and paranoid, these vulnerabilities are absolutely of practical concern ... because their PCs are directly plugged into the ISPs router, or they're using wifi from the ISPs router.

      I'm betting a lot of home users figure they have the router from the ISP, so they don't need anything else.

      That these are ISP models doesn't diminish the number of people who could be impacted ... it greatly magnifies it. Because most people who don't know better (and a few who do) connect their PC directly to the ISPs router.

      Honestly, go talk to a random neighbor .. see if they have anything between them and their ISPs router. My best is they don't.

      • Re: (Score:2)

        by dbIII ( 701233 )
        I suppose I'm lucky to have an ISP that not only is happy for clients to bring their own modem but had docs for how to setup close to a dozen popular models.
    • FTA: ASUS AC68U ASUS RTN56U & ASUS RTN10P & ASUS-RTN66U & ASUS-RT56-66-10-12 ASUS-RTG32 BELK-PHILIPS (?) BELKIN F5D7230-4 BELKIN F5D8236-4V2 BELKIN F9k1105V2 BELKIN-F5D7231-4 BELKIN-F5D7234-4 D'LINK DIR-600 D'LINK DIR-604 D'LINK DIR-645 D'LINK DIR-810L & DIR-826L & DIR-615 & DIR-651 & DIR-601 & WBR1310 & D2760 D'LINK DSLG604T D'LINK-DIR-2740R EDIMAX BR6208AC LINKSYS BEFW11S4 V4 LINKSYS L120 LINKSYS WRT54GSV7 LINKSYS-BEFW11S4 V4 LINKSYS-LWRT54GLV4 LINKSYS-WRT54GV8 LINKSYS

  • bad info on D-Link DSL-2750B? (Score:1)

    by Anonymous Coward

    described attack and info URL doesn't work on my unit

  • ... expecting all models to be flawless.

    • Not at all. I'm completely open to security flaws in products. But only if the company supports the products fixes the flaws and provides continuous updates for older gear.

      I am for instance very tolerant of Windows or Linux based security flaws, I am tolerant for flaws in iOS too. But I expect my Android devices and my home router to be flawless considering the manufactures provide bugger all support after their sale.

  • Minimum standards (Score:4, Insightful)

    by Peter H.S. ( 38077 ) on Tuesday June 02, 2015 @08:30PM (#49827333) Homepage

    Really, there ought to be some sensible minimum standards for commercial products that can be connected to the internet. This could include that the company had a decent policy for security fixes and a published contact point for people reporting such problems.

    And how about a pre-published, minimum security support length, so that people buying a smartphone/router/etc. will know in advance how many years it will be supported with security fixes. There are "use by" dates on food, why not on all internet connected devices.

    • Re: (Score:2)

      by dbIII ( 701233 )
      Travelling down that road can mean that you have to be a member of lobby group X before your devices are allowed, and that group will have a cost of entry designed to squeeze out linux users, bsd users, radio hobby types and anyone else who doe not have a commercial stake. See the broadcasting sector for examples.

      • Not necessarily. The alternative to no laws isn't bad laws.

        As it is now companies can spew out insecure products with impunity and even silently drop any security support for devices consumers have just bought, not forgetting the classic tactic of not acknowledging security problems and just plain ignoring them. This can't go on.

        • Re: (Score:2)

          by dbIII ( 701233 )
          Maybe I'm too cynical but that's how I'd see it going - a sensible minimum standard hijacked and turned into a barrier to new players entering the market with collatoral damage of linux, freebsd etc. Such a thing could be avoided if the general public can get in on the rule drafting process.
    • Router support period -0.25 years.....we stopped supporting it before it was sold.

  • Yeah, but can you stop the NSA (Score:3)

    by gizmo2199 ( 458329 ) on Tuesday June 02, 2015 @08:42PM (#49827393) Homepage

    Does anyone know of a SOHO package that can keep out the three letter agencies? I'm pretty sure even if these SOHO routers had stellar security does anyone believe they could keep out the NSA or a determined attacker from compromising your network? Even the best models basically just have a linux distro running iptables.

    • Re: (Score:3, Informative)

      by aXis100 ( 690904 )

      Linux "just running iptables" is perfectly secure.

      In general you cant just hack firewall software directly. What you do is find a protocol that is allowed through the firewall and then exploit some vulnerability on that protocol. Examples would be default passwords or SQL injection in a web management interface, buffer overflows in a DNS response, weak encryption in a VPN etc.

      • You can't escape hardware based exploits/backdoors. There's a lot of silicon in these things to hide in.

        • Re: (Score:2)

          by jopsen ( 885607 )

          You can't escape hardware based exploits/backdoors. There's a lot of silicon in these things to hide in.

          Hmm, it would be fun to build an arduino based router. I suspect someone already did... But I think this would be the only way to reduce the amount of silicon.
          Hiding a generic backdoor in an atmega chip that plays well with a generic backdoor in say an ethernet and/or wifi processing chip would be an accomplishment.

      • Re: (Score:2)

        by mcrbids ( 148650 )

        Just to be fair "perfectly secure" is probably overstating things considerably. It would pass "no known exploits" pretty well, certainly "commercially viable".

        The only "perfectly secure" computer is off, unplugged from the Internet, and encased in 50 feet of reinforced concrete. And even then, there *are* ways to exploit it using *ahem* brute force...

    • Re: (Score:1)

      by Anonymous Coward

      You won't keep out the NSA. Defeating a state actor with funding and technical competence that exceeds your own in ways that you can't imagine is not a realistic goal, especially when they have allied state actors (FBI/local law enforcement) who can infiltrate/burgle your premises and gain physical access to your boxen. If they want you, they will have you, and if you make it hard for them, they'll find a charge to have your stuff picked up for inspection and you thrown in detention long enough to break

    • Forget it, they have exploits for every programmable machine you can possibly imagine.

  • Some of these flaws (maybe all) can be accessed by default logins. As soon as you have passed that, you have full control. To help prevent that you can change the device's IP and give it unique login credentials. It won't stop someone determined who wants access as all it needs is brute force to find the device's IP login page. In other words some of the vulnerabilities aren't device issues but user responsibilities. That pretty much goes for non-isp supplied routers.
    A few ISP supplied routers do have backd

  • Assuming somebody does sell a secure SoHo router product, or is our only option to install something like DD-WRT and be vigilant when it comes to security updates?
  • Seems to be most/all browser vulnerabilities. Which begs the wisdom of embedding a mini web server on your security devices. For example, the UPnP protocol, putting convenience over security.

Slashdot Top Deals

Think of it! With VLSI we can pack 100 ENIACs in 1 sq. cm.!

Close