Home Wi-Fi Routers Are Easily Hackable

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
How secure is your router? If it is on this list, you might want to think about additional security measures.

ISE researchers have discovered critical security vulnerabilities in numerous small office/home office (SOHO) routers and wireless access points. We define a critical security vulnerability in a router as one that allows a remote attacker to take full control of the router's configuration settings, or one that allows a local attacker to bypass authentication and take control. This control allows an attacker to intercept and modify network traffic as it enters and leaves the network.
  • All 13 routers evaluated can be taken over from the local network
  • 4 of these attacks require no active management session.
  • 11 of 13 routers evaluated can be taken over from the WAN
  • 2 of these attacks require no active management session.
Click to expand...
 
Authenticated attack basically is them knowing the default password, which is pretty common sense to change anyway. Since it's on the router itself.
 
4 of these attacks require no active management session.
2 of these attacks require no active management session.
????????????????
 
Glad Unify is not on that list. :D

What exactly are they doing though? I understand they may not want to share too much details but the article seems way too broad. Is it certain packets sent that can make it do things it was not suppose to or something?
 
Red Squirrel said:
Glad Unify is not on that list. :D

What exactly are they doing though? I understand they may not want to share too much details but the article seems way too broad. Is it certain packets sent that can make it do things it was not suppose to or something?
Click to expand...

Wtf is Unify?
 
Am I missing something or is one of their 'attacks' actually using the correct login info and if the router accepted that it was a fail?
 
Don't see the DIR-655 on the list, but since there is another D-Link router on there, it's making me wonder......
 
For what I can tell, this article is stupid. Just like others have mentioned, the perp needs my log in info. Which in my case is not the default login/password. I changed that minutes after setting it up.
 
This sounds a lot worse than it is... I mean it's bad if your router is setup in a dumb way, but not otherwise.

It's primarily cross-site scripting and cross-site request forgery type stuff using the http interface. Neither of which are really issues if the router doesn't allow administration via the WAN port or guest/open networks. You aren't going to cross site script yourself and hopefully your family isn't going to hack your home's router. UPnP can be an issue internally if people are compromised.

This is I guess more of an issue for default configs and if you're using a SOHO router in a business setting where an employee or someone on a public wifi could get in and f with the router.



Interestingly... pretty much every time we did an internal security audit of a small-medium sized business we had domain admin within a couple days so usually people have more important things to worry about than their router internally. Printers have a ton of vulnerabilities too.
 
brycejones said:
Am I missing something or is one of their 'attacks' actually using the correct login info and if the router accepted that it was a fail?
Click to expand...

Which is why I went and ripped out all the USB ports on my routers. You can't hack my network if you can't plug in your keyboard. It makes sense if you don't think about it. :cool:
 
I see reading comprehension is still on the decline...

Authenticated attacks require that the attacker have access to credentials (or that default router credentials are used—an all-too-common situation) or that a victim is logged in with an active session at the time of the attack.
Click to expand...
 
Goty said:
I see reading comprehension is still on the decline...
Click to expand...

A number on the list still had unauthenticated attack vectors.

And, some of the authenticated attacks were simple CSRF attacks which should absolutely be fixed. OR even simpler csrf-type vulnerabilities like me knowing your router is 192.168.1.1 and sending you a link that goes to http://192.168.1.1/admin/delete_your_whole_face?lol or to a page with a button that does that and it deletes your entire face because you had an active router session in another tab.
 
Serpent said:
Authenticated attack basically is them knowing the default password, which is pretty common sense to change anyway. Since it's on the router itself.
Click to expand...
Hah yeah. I can't tell you how many Hotel Inn's and motels in America have a default password for the administrative web-interface and can be accessed over wireless. :D
 
InternationalHat said:
A number on the list still had unauthenticated attack vectors.

And, some of the authenticated attacks were simple CSRF attacks which should absolutely be fixed. OR even simpler csrf-type vulnerabilities like me knowing your router is 192.168.1.1 and sending you a link that goes to http://192.168.1.1/admin/delete_your_whole_face?lol or to a page with a button that does that and it deletes your entire face because you had an active router session in another tab.
Click to expand...

This. People really underestimate just how vulnerable web apps are nowadays. Every developer I've worked with after pentesting their web apps was really confused as to why they need to properly validate their input. Their usual response is "Well who would want to input THAT into that field?" There is no excuse for crappy and insecure coding. It's kinda sad, although I can't complain much since I make a good amount of my living as a White Hat.
 
Interesting. I was looking at the WiFi networks in my new apartment complex and found one that was broadcasting: "OLDPEOPLESHOULDNOTUSETECHNOLOGY".
 
The 2Wire routers that AT&T uses are really bad too. In fact there was a Defcon presentation about it a couple years back.
 
TheBuzzer said:
how about if I use openwrt or ddwrt firmwares?
Click to expand...

Good luck with that. DD-WRT...what a pure shit fest it is over there...

Follow the (your brand / model / chipset) wiki...no don't do that it will brick it...no it won't, yes, no, yes, no, yes, no...fuck that. I'll stick with stock and at least I won't brick my router because those people over there can't get their shit straight.

I mean I understand that its complicated, but GODDAMN, if you have a router with a BroadCom chipset in it (like my Linksys E1500), don't bother.
 
If it is correct in what i saw on the linksys page with proof of concept they have to do this :

In the following proof of concept attack, we assume that an WRT310v2 device administrator with an active management session established with the router has browsed to a malicious web page. Once there, an automatic form submission takes place to the Administrator's router, from the Administrator's browser. Since the Administrator has a current session established with the router, the form submissions are processed.

Here, the administrator password is changed to ISE_1337, and remote management is enabled on port 1337.
Click to expand...

So if you don't go browsing on webpages that are designed to hack your router there is no worry :) .
How do I know which webpage on the WWW is designed to hack your router. Every link send to you by email which you have no clue about but sounds like it is legit :) And yes that goes for links through any IM as well ;) . Those have been known to do the same thing even if it is a close friend sending you such a link.
 
My grandson set up my internet so that i just click on GrandpaClickHereForTheInternet in my wireless thing and I'm e-mailing people large Quicktimes of puppies doing silly things before you know it. He said since it's just me i don't have to worry about security.

He's really good with computers, he should really get a job with Belkin. That's the company that makes my internet.

p.s. where's a good site to get free pictures of old women with the silver carpet showing if you know what i mean? send me a reply on an internet if you can help. please, no funny stuff. only sites starting with http://192.168.1.2/admin?u=grampa&p=oldman1927 please.
 
You must log in or register to reply here.
Back
Top