Researcher will enable hackers to take over millions of home routers

Cisco and company, you've got approximately seven days before a security researcher rains down exploits on your web-based home router parade. Seismic's Craig Heffner claims he's got a tool that can hack "millions" of gateways using a new spin on the age-old DNS rebinding vulnerability, and plans to release it into the wild at the Black Hat 2010 conference next week. He's already tested his hack on thirty different models, of which more than half were vulnerable, including two versions of the ubiquitous Linksys WRT54G (pictured above) and devices running certain DD-WRT and OpenWRT Linux-based firmware. To combat the hack, the usual precautions apply -- for the love of Mitnick, change your default password! -- but Heffner believes the only real fix will come by prodding manufacturers into action. See a list of easily compromised routers at the more coverage link.

[imtired Posted Jul 21st 2010 6:40AM]

let 'er rip

[boomer7638 Posted Jul 21st 2010 6:43AM]

@imtired
Hmmmm.... My password is "admin" is that ok? Maybe I should change it to "password"-

[pankomputerek Posted Jul 21st 2010 6:48AM]

@boomer7638

Nah, change it to "password1"

[FauxNews Posted Jul 21st 2010 6:48AM]

@boomer7638 1234 is far more secure. Numbers aren't hackable.

[James T Kirk Posted Jul 21st 2010 6:54AM]

@FauxNews
That's the kind of combination an idiot has on his luggage!

[FNi Posted Jul 21st 2010 7:04AM]

Oh noes, hackers are going to change my port forwarding settings!

Well, good luck to them, because I for one cannot figure out how the hell to do it.

[yeoldgreat1 Posted Jul 21st 2010 7:05AM]

@James T Kirk
I have 9876, no one will think of that

[Kurian Posted Jul 21st 2010 7:07AM]

@imtired
I'm sorry, but this is just overhyped BS. Nothing but script kiddie noobsh1t techniques. Any fool can write a like to 192.168.1.1?dostuff.

Typical clueless journalism.

[Kelmon Posted Jul 21st 2010 7:10AM]

@James T Kirk

* Thinks about changing luggage combination *

[willwillywilson Posted Jul 21st 2010 7:54AM]

@pankomputerek Changing the password won't help. Everyone knows the universal password to everything is Joshua.

[Sea Urchin Posted Jul 21st 2010 9:03AM]

@imtired mine is 000000

[manofchao5 Posted Jul 21st 2010 9:41AM]

@imtired
so, the vulnerability is a default password?
thats the way this article makes this seem

[rollingwave Posted Jul 21st 2010 10:22AM]

@willwillywilson I thought the universal password was GodMode

[madwh Posted Jul 21st 2010 10:35AM]

So is there really anything I can do to protect my WRT54GL running DD-WRT v24-sp2?

[Slappy Wag Posted Jul 21st 2010 10:48AM]

@imtired

ALL YOUR ROUTER ARE BELONG TO US!

[andrewia Posted Jul 21st 2010 11:04AM]

Ditto.

[Failbait Posted Jul 21st 2010 11:34AM]

@imtired

What a boring achievement, this guy. In the amount of time he spent fooling around, he could have probably wrote a small program to sell and actually progress society while making a little money.

[Johann Posted Jul 21st 2010 2:29PM]

@imtired I personally set my passwords to "ifyoubruteforcedthisyoushouldreallyfindabetterwaytospendyourtime"

[Tiptup300 Posted Jul 21st 2010 2:58PM]

stupid ass i got norton
u cant do nothin

[jhs Posted Jul 21st 2010 6:41AM]

I, for one, welcome our new Hacker overlords.....NOT ;-(

[ryan420 Posted Jul 21st 2010 7:19AM]

@jhs

Hah, I have a WRT54G with DD-WRT. Too bad I know how to secure it properly! Muhahaha...

[vishal1082 Posted Jul 21st 2010 6:41AM]

NOoooooooooooooooooooooooo

[HotCollegeTeen Posted Jul 21st 2010 6:43AM]

Good Luck, I'm Behind 7 Proxies!

[arash Posted Jul 21st 2010 7:58AM]

@HotCollegeTeen Well our dear government in Iran not only censors half of the internet(facebook,tweeter,youtube,myspace,file sharing services,gizmodo(!),wmpoweruser(!),etc) but also with a very forward thinking security policies blocks half of the net protocols too, completely randomly, so since i can't connect to my own RDC host i don't think he have that much of chance to hack my port forwarding settings for online gaming. i feel safe.

[arash Posted Jul 21st 2010 8:00AM]

@arash Another time that i felt safe from their forward thinking was when i heard KIN announcement cause i instantly found out we are protected from it, since if you power on a KIN here it will boot up with this message: ACCESS IS BLOCKED

[ssguy Posted Jul 21st 2010 8:42AM]

@arash

lol.... atleast engadget is not blocked.

[arash Posted Jul 21st 2010 8:49AM]

@ssguy Nah i think they like joshua's beard

[Pickaxe Posted Jul 21st 2010 11:28AM]

@arash Our dear government in Cupertino also censors Gizmodo.

[piam101 Posted Jul 21st 2010 4:52PM]

@arash

Oddly enough, when I was in Iran in May, out of all the websites I visit from home the only one that wasn't blocked was Engadget...

[notsodumb Posted Jul 21st 2010 6:46AM]

Looks like he didn't get payment from those companies.

[pankomputerek Posted Jul 21st 2010 6:47AM]

My is already taken over..... *by me*

[guitarkid Posted Jul 21st 2010 6:49AM]

Good thing I've got a Belkin router.

[Blau Posted Jul 21st 2010 7:56AM]

@guitarkid ...From the briefings blurb listed on the black hat site:

http://www.blackhat.com/html/bh-us-10/bh-us-10-briefings.html

"Confirmed affected routers include models manufactured by Linksys, Belkin, ActionTec, Thompson, Asus and Dell, as well as those running third-party firmware such as OpenWRT, DD-WRT and PFSense."

[Scrubs Posted Jul 21st 2010 9:03AM]

@Blau awesome, netgear ftw

[Doctor Comrade Posted Jul 21st 2010 8:02PM]

@Blau

I wonder if Tomato is in that list...

[2FR35H Posted Jul 21st 2010 6:53AM]

I would love to see this.

[GGG Posted Jul 21st 2010 6:55AM]

i have a router that looks just right that :D


but i don't even know my username and pass, it's a good thing Firefox remembers it. it's probably set to default anyway

[loveshispizza Posted Jul 21st 2010 6:57AM]

Sean Hollister, please remove the comma after "days".

[acekilla Posted Jul 21st 2010 7:01AM]

ahh the black hat conference the dirtiest conference in the world or one of many. Well it's a good thing where I live people don't even know what wifi is and wat does it do.

[barry99705 Posted Jul 21st 2010 12:35PM]

@acekilla Looks like they don't know how to spell "what" either.

[Skizem Posted Jul 21st 2010 7:04AM]

This reeks of extortion to me, it seems pretty crazy that a researcher would do this, and compromise 'millions' of routers. He of course knows the only fix is a firmware update, and, let's face it; of those millions affected, how many millions even know how to update the firmware?

[Marwan boustany Posted Jul 21st 2010 7:53AM]

@Skizem That is exactly correct, very few is the answer! That person is acting very irresponsibly.

[zangetsu2 Posted Jul 21st 2010 4:00PM]

@Skizem
+1 Pretty much everyone I've ever done tech support for has absolutely no idea how to even log into their own router.

I dislike you, Craig Heffner.

[ForwardTwo Posted Jul 21st 2010 7:04AM]

Well this blows.

[whiskers Posted Jul 21st 2010 7:11AM]

This is the end of the internet. THE END! OF THE INTERNET!

[n1hmrd Posted Jul 21st 2010 8:11AM]

@whiskers :O !!! Yes this is reason for the 2012 end of mayan calendar Crap!,its not end of the world but its the end of internet!,and rebirth as a hack filled hellhole,where you turn your pc/router on and it filled with porn,hijackers,hacker geeks that laugh at your mp3,photo collections control your pc and steal all your money in your bank(also the people saying they are secure etc etc,yes you are for now,but this hack opens up whole new can of worms,and yes it taste yucky horrible and full of filth,be afraid people be very afraid.........

[dschu012 Posted Jul 21st 2010 8:24AM]

@whiskers Or the start of free internet

[Kelmon Posted Jul 21st 2010 7:14AM]

I trust that Craig isn't hoping to be receiving many Christmas cards this year from either Cisco or their customers. While I can fully appreciate the rationale behind this action, releasing this code (assuming it works) would be utter irresponsible because it effectively guarantees that hacks may occur in the wild rather than they potentially will.

[LordBrian Posted Jul 21st 2010 7:36AM]

@Kelmon sadly sometimes you can warn people and warn them and they do nothing so making it public is the only way.

Of course this exploit may already be in use by proper criminals so a bit of publicity might help close this door to them.

[Kelmon Posted Jul 21st 2010 8:02AM]

@LordBrian

Disagree. If Cisco hasn't fixed the problem despite warnings, there is no guarantee that this action will actually force them to fix it, plus you are then reliant upon them managing to get every impacted product in circulation updated. All this does is greatly increase the risk of a successful attack to customers and I fail to see how this can be a "good thing". As I said, I understand the rationale behind this but I do think this practice is fundamentally flawed, plus it sounds like a publicity stunt to boot.

Sorry, but I think this action is wrong. Security researchers are a fairly dubious bunch at the best of times (how many of them are ex-hackers?) and this one is definitely stepping beyond what is acceptable. It's almost hacking by proxy.