Linksys E-series Unauthenticated Remote Code Execution Exploit | Hacker News Reader

Linksys E-series Unauthenticated Remote Code Execution Exploit

exploit-db.com

37 pointsaburan2813 comments

Is DD-WRT really a secure alternative to stock firmware at this point? It seems as though development has stalled out on it.

For example, I have an Linksys E2000. The "recommended" build on the DD-WRT wiki page is 14929, which is from approximately August 2010. The most recent compatible build I can find is 18946, which is dated 4/7/2012.

Running firmware that is 2 - 4 years old just seems very unsafe.

Am I correct in assuming this only affects the stock firmware and not say dd-wrt which I have installed on my e3200?

Which by the way is a pretty solid router so far. Aside from dd-wrt not supporting its 5ghz radio. I tried a Tomato build for it that support 5ghz, but for some reason my router would just lock up every other day with that firmware no matter how it was installed.

Yes.

I have one of those with DD-WRT as well. A vuln in a router will only affect DD-WRT as well if it's a hardware vuln that allows (for example) corrupting/modifying memory, which would also make the attack need to be highly targeted, or a critical 0day in the linux kernel/dropbear, etc.

I had similar problems with Tomato on an E4200 -- it would reboot itself every few hours (noticeable when the wifi would disappear for a minute or two!). My guess is there was some kind of lockup, but a watchdog had enabled to reboot it when the lockup occurred. This can be caused by overheating, in which case you can try turning down the Tx power setting on one or both of the radios.

Between this and the backdoor thing a few months ago, I don't know why anyone would still be running linksys if they can help it, especially since Cisco bought them out (I started as a cisco guy, now hate them). I prefer Open-WRT for cheap stuff, but PFsense and Monowall pretty much take the cake to me. I have been testing them but haven't moved any into home "production".

Bunch of WRTs on there.

I hope my good old WRT54G with tomato firmware is still safe after all these years.

Currently only works over LAN, how long until remote?

You could then tie it into something like Shodan...

Exploit is an HTTP request, so an attacker could send the request from javascript: any website could attack your router.

Javascript WTF #27,903

Wouldn't Same-Origin-Policy prevent this?

The challenge would not be the Same Origin Policy, it would be finding out what IP address your router has. Browsers don't give that to Javascript (which is probably good).

However, you'd be 99% successful trying the most common IPs first:

  192.168.0.1
  192.168.1.1
  10.0.0.1
  10.0.1.1
  etc.

Then the attacker just sets up a scripted DNS server under their domain, like this:

  192.168.0.1.ip.example.com A 192.168.0.1
  192.168.1.1.ip.example.com A 192.168.1.1
  10.0.0.1.ip.example.com    A 10.0.0.1
  10.0.1.1.ip.example.com    A 10.0.1.1
  etc.

As you can see, Same Origin Policy wouldn't prevent javascript from sending a POST request to a subdomain, and the attacker controls their DNS so getting an IP address isn't hard. (The DNS server uses a script instead of actually having all the IP addresses spelled out in a config file.)

Surely this only affects routers whose control panel is running on an open port 80 and also remote access is enabled? Or is the point of this exploit that by default the router has port 80 open and remote login enabled?

It wouldn't be remote login, it would be local login from the network, which routers tend to have enabled by default (how else would you manage them?).

Reply on news.ycombinator.com