Researcher will enable hackers to take over millions of home routers

Cisco and company, you've got approximately seven days before a security researcher rains down exploits on your web-based home router parade. Seismic's Craig Heffner claims he's got a tool that can hack "millions" of gateways using a new spin on the age-old DNS rebinding vulnerability, and plans to release it into the wild at the Black Hat 2010 conference next week. He's already tested his hack on thirty different models, of which more than half were vulnerable, including two versions of the ubiquitous Linksys WRT54G (pictured above) and devices running certain DD-WRT and OpenWRT Linux-based firmware. To combat the hack, the usual precautions apply -- for the love of Mitnick, change your default password! -- but Heffner believes the only real fix will come by prodding manufacturers into action. See a list of easily compromised routers at the more coverage link.

[RM Posted Jul 21st 2010 12:34PM]

@UnixSystemsEngineer

DNS rebinding uses a local machine to accomplish this exploit so turning off WAN management won't help. This is as much of a problem with browsers and their plugins as it is with the routers.

[barry99705 Posted Jul 21st 2010 12:39PM]

@UnixSystemsEngineer Yes, you can install dd-wrt without changing the password.

[Akston Posted Jul 21st 2010 12:39PM]

I subscribe to the "security via obscurity" philosophy. I use a very uncommon text-based Soviet-surplus diesel-powered router. No one wants to hack it.

Then again, I'm currently having trouble visiting any sites that have a 5 in the address.

[bonedog73 Posted Jul 21st 2010 3:29PM]

"more than half" !? So the ones that were not vulnerable were the ones that changed the default password??

[simbr Posted Jul 21st 2010 6:03PM]

@bonedog73
On the linked spreadsheet 17 of the router models tested were successfully hacked and 13 failed. I assume they left them all on default settings.

[zerotheloner Posted Jul 21st 2010 8:26PM]

I believe the password is the best is a leet password, like mine! XP who agrees?!

[Viqsi Posted Jul 22nd 2010 2:33PM]

Y'know, I would be a lot more appreciative of this guy's efforts if he could, y'know, TELL US HOW TO PREVENT THE ATTACK FIRST. Do I turn off dnsmasq and just send my ISP's nameservers? Does my lack of default passwords already have me secure? Am I screwed no matter what with DD-WRT and need to move to a new firmware? Tell us how we lock the door before you tell everyone how to kick it down, kthx!

[Kelbit the Viking Posted Jul 31st 2010 6:56PM]

Changing the default password on any device should be the *first* thing that you do when you recieve it.

As for home users who are ignorant of the technology - it's really no excuse. When you buy a piece of equipment, you should educate yourself about all its features and everything that needs to be done so it will operate in a safe and secure manner. Of course, as anybody who's worked tech support well knows, with internet users this never happens.

Really the blame here falls on the router vendors - they know from experience how technically inept their customer base is. Rather than sink the money into the appropriate technologies to allow the equipment to update itself without confusing configuration, they simply leave the customer in the dark.

From a technical standpoint, the solution is ridiculously simple: have the router scrape an address belonging to the manufacturer to check for critical security patches/new firmware. Install these automatically, preferrably during the wee hours of the morning to avoid service disruption (although firmware upgrades take only 2-3 minutes). Implement public-key cryptography to guard against malicious DNS spoofing by third parties trying to install their own firmware.

This distribution channel would be used for critical patches only, to prevent unneccessary disruption every time a new revision is released. Even if it updated with every revision, a few minutes of downtime every three to four months isn't a lot - Windows Update does far more than that each week and nobody questions it.

Too late to do it for this exploit, but the vendors really ought to include something like this in the next revision.

[techlord Posted Aug 3rd 2010 8:12PM]

time to study some cisco.