DEFCON Router Hacking Contest Reveals Major Vulnerabilities
eff.org
eff.org
So he posed the question: What if all home routers get hacked and wiped in a mass attack against a country? People can't go out and buy new ones since they are just at risk and will probably just get hacked again. This puts a large amount of any countries technical infrastructure at risk.
The router manufacturers really need to step up here. And even technical users could benefit from more options on the market for secure routers, instead of just DIY OpenBSD boxes.
I'm curious if the gov will ever pressure these companies for better security, although they seem to prefer insecure-by-default.
What we need is more manufacturers simply to give up on developing router firmware and simply pay the devs on these quality projects to do the work for them. They've proven their dedication and can surely adapt to new hardware with relative ease. Some router manufacturers are already doing this. I know at least Buffalo was for some time.
I appreciate what the DD-WRT people are doing, but I would hardly hold them up as the paragon of updated, secure firmwares.
However, the firmware version I needed never got updated again for whatever reason. Along with the barrier to contribute back to the DD-WRT project I moved on.
Are any other Firmware versions out there more actively maintained?
One of my spare routers (came free with purchase of a cable modem) has only 4MB of flash storage, and recent builds of OpenWRT have had to strip out the web interface but in exchange gained IPv6 support. It's also got only a 350MHz MIPS 24k processor, so it's too slow for serious use with any connection faster than ADSL2. There's a lot of router hardware out there that's just not up to the task of being a home gateway anymore.
Your only option is to backport fixes. I read in forums that devs aren't interested do to introducing bugs and citing lack of free time. I roll my own Tomato kernel but I've only included a couple backports.
x86 is really your best bet as an enthusiast. I'm waiting for Braswell hw, personally.
https://www.thinkpenguin.com/gnu-linux/free-software-wireles...
There's your reason. Good luck getting a modern OS to fit in that. Twice that would still be crowded.
Also, it's 2.4GHz only. There's no justification for ever recommending a WiFi device that can't use the 5GHz band.
http://www.mouser.com/Semiconductors/Integrated-Circuits-ICs...
$2.50 for a 128 MB, single chip, qty 2500.
Linux gw 3.3.8 #1 Sat Mar 23 16:49:30 UTC 2013 mips GNU/Linux
More importantly, they provide their own router management utility (Mac/Windows only), which everyone will have installed when they set up their router. It notifies you of new firmware releases and prompts you to install them. Yes, you could do something similar on an admin panel at 192.168.1.1, but nobody's every going to check it. As much as I loved my WRT54GL and its various 3rd party firmwares, I think Apple's approach is better for general use.
Their most recent release was in April 2014, IIRC in response to Heartbleed. http://support.apple.com/kb/DL1708
Given all of the issues we've seen recently with their router firmware, the router "cloud" features, and the number of different models, I don't think they could do this successfully.
Netgear has (at current count) 97 wireless routers for sale on Newegg, including some duplication for refurbs. Whatever the exact number is, it's a lot more than 3.
The minor things I know offhand:
- The old configuration protocol transmits your password (and everything else) in pretty much plain-text, which can be theoretically intercepted by someone connected to your network (and anyone listening when you set it up for the first time). I think the newest configuration protocol uses Secure Remote Password, but I don't know if anyone's audited their implementation.
- When new AirPort routers first come online, they broadcast a public open WiFi hotspot to allow wireless setup. This can be accessed by anyone within range. An attacker could make a device (say, a WiFi Pineapple) automatically connect to every AirPort it sees and configure it maliciously. Using only public information, you mostly be able to annoy the owner (maybe intercept some traffic by updating their DNS settings). I won't rule out someone dropping a rootkit on your router during the open configuration period, but the simplest method (a firmware update) at this point will cause the router to reboot so it's at least a bit conspicuous.
Also see this comment: https://news.ycombinator.com/item?id=8441500
Who would want to do that, I wonder. I mean, it's not a one-click process, on that scale, diversity will be an important factor (FW and HW versions, manufacturers, OpenWRT and stuff).
It seems to me that this would require a lot of effort and the result will be questionable. What will be achieved by this?
I think if someone cares about security, they've already flashed DD-WRT by now and those who don't... well, router (in)security will not stop their systems from being overtaken.
... I'm pretty sure the infrastructure exists for organized crime to do this, just going by what I've read in the news.
I wonder if there might already be sleeper code in place for this purpose?
Botnet zombies seems to be the most obvious use-case, though. Or create your own TOR-type network to obscure the origin of criminal activity.
With sufficient density of vulnerable devices, you could setup your own mesh network to send your nefarious packets through someone else's Internet gateway miles away.
Nonsense.
a) People shouldn't have to flash their firmware to have an adequate level of security. If we're creating software we should hold some at least responsibility to provide basic security. Engineers in other fields take safety extremely seriously, why should software only provide it to a small percentage of people with technical knowledge?
b) Using up-to-date operating systems with update processes and security-conscious decision-making when packaging 3rd-party software is not a huge cost to these companies.
c) The goal of any security is to significantly increase costs and complexities of attacks. No solution will completely eliminate possibilities for attack but that doesn't negate need for security.
a) People shouldn't have to flash their firmware to have an adequate level of security. If we're creating software we should hold some at least responsibility to provide basic security. Engineers in other fields take safety extremely seriously, why should software only provide it to a small percentage of people with technical knowledge?
I think you are comparing fundamentally different threat levels.
Say you're designing a car. A cool, safe car in which passengers survive head-on collision with a wall at 100km/h with 100% chance. That's a nice car, but it can't save you if someone shoots you in the head with a 9mm through the windshield, unfortunately. You want that kind of protection? You go and buy special car with bulletproof glass and additional security measures.
Your router may save you against someone typing 192.168.0.1 in browser and getting full rights without password. But it won't (and probably can't) save you from someone with enough tech knowledge and determination by default.
> b) Using up-to-date operating systems with update processes and security-conscious decision-making when packaging 3rd-party software is not a huge cost to these companies.
Well they won't want to spend it. People will buy them anyway like they do now.
In other words, that armor glass should come standard, and there's no excuse for it not to.
Microsoft learned this lesson - you either design for security up front or you design for security after the fact, the hard way, breaking things as you go and annoying users.
I think it'd be fun, so that's one reason a lot of people may share. And, it's not hard to see it as a good thing: By bricking these routers, you're bringing light to a serious issue, before it gets even more serious (more reliance on the Internet).
This is a pretty active market already. It's called "Unified Threat Management" by the analyst firms. Keep your support up-to-date and they (ought to) take care of keeping the latest firmware on the device for you. Here are a bunch: http://mosaicsecurity.com/categories/68-unified-threat-manag...
NB: I used to work for one of those companies.
Second, your hypothetical mass attack would be easy to fix. Reinstall Windows on your malwared-up desktop, buy a new router, plug them both in, and update the router using approved vendor sites. There's no WAN hacks and the client machine wouldn't have any malware on it, so it could update safely.
The router manufacturers just need to disable all remote administration features and require a USB or CAT5 "admin port" to access setup functionality. Honestly, a bare-bones firewall with no features other than DHCP and NAT is all 99% of people use anyway.
That's just plain old FUD, nothing new under the sun!
I realize this is not a very constructive comment, but the fact of the matter is that some people in the information security business likes these types of extravagant displays of "this is the end of the world as we know it!"
Not many SOHO-routers have capabilities exposed to the outside world.
I mean, yes, it would be nice if the world was a safer place, but it's all about risk management, and risk is a factor of probability and cost, and the probability level here is very low.
LOL. AVM, biggest german manufacturer of soho routers (Fritzbox) suffered from a RCE vulnerability; hackers pwned the boxes and made highly expensive premium calls.
Most routers are incredibly insecure, but a good portion of those vulnerabilities can only be triggered if you share a LAN with the router or have and can widely deploy a XSS/CSRF exploit.
How big was the Fritzbox market share?
Background: I work at a company which makes a "home router". It's not one you will find at a big box store, but internally it's not much different.
Most of these routers are built from a MIPS SoC manufactured by Broadcom, Atheros, or Marvell. Since their business is selling chips, not routers, these SoC companies need to make it easy for your LanWan Company startup to choose to use their chipset.
So these SoC companies will give you a reference hardware design. They will also give you a completely functional software package with Linux kernel, drivers for all the peripherals (Wi-Fi, ethernet, etc.), all the necessary user space utilities, a complete GCC cross-compiler toolchain binary which runs on Ubuntu, and a bad web app. You can literally unzip this package, run 'make', and end up with a functional filesystem image ready to flash onto the reference board.
So LanWan startup can start manufacturing routers with only one or two software devs who know some C and a part-time hardware engineer. Manufacturing is contracted out to China.
The vendor-supplied C code is not written by expert programmers. It's obvious when you (try to) read the source. It's also a huge and messy pile of code.
Where I work we use the vendor-supplied kernel but we wrote all the user space ourselves. All this stuff is written in C. The software devs here have more than a few years of experience writing C, but are very uneducated about how to write secure code. They don't think about it. And management does not think about it. The only thing that matters to management is that the box passes the tests.
I've been around long enough to have figured out that things are like this in most places. Whether small companies or big companies doesn't matter.
These Soc vendors have to start working on a new kernel long before the chip is released, as they need working software by the time the chip goes to market (to offer the router makers). Broadcom's business depends on this. They will not simply hope some loose-knit group of volunteers will timely produce software which will help them sell their new chips.
And it's not realistic for the open router project to do this much work. It would require cooperation from the SoC vendors, providing free and early access to their kernel driver source and complete documentation for their chips. I don't see this happening.
At best the open router project could release software for hardware which is already a year or two old.
Sorry to be such a pessimist, but the incentives to make this work are just not there for the businesses involved.
(To be fair, I was working at a place selling all-in-one firewalls to SMB, so many of those boxes were our competitors.)
I'm trying to work out just how exposed I am, and whether there's anything practical I can do about it.
Presumably I can: 1) buy a different device not currently known to be vulnerable 2) reflash with an alternate firmware 3) disable as many admin options as possible to reduce surface area 4) pray
Are there other alternatives for the luckless home router owner?
While you still have the Q1000, be sure that you have the remote interface disabled and use the NoScript browser plugin. Those two items will mitigate a lot of the risk.
I replaced my Actiontec Q1000 with a used Zyxel Q1000Z I got for $30. I haven't had time to assess the Q1000Z yet, but it does not have any known 0-day vulnerabilities.
Now that I'm thinking about it transparent bridge mode might do the trick as well.
Responsible disclosure for the win. It's a good thing nobody else is looking for vulnerabilities in these routers.
As the article says the manufacturer has acknowledged the vulnerability, but I have not heard from them for quite a while. I've begun to wonder how much time has to pass without a fix before it would be irresponsible of me not to fully disclose the vulnerability. Lately I've been thinking that full disclosure may be the only responsible way to disclose a vulnerability. But I am still conflicted.
If you release it, you force the manager to do the right thing, and the developer will then be officially allowed time to fix it.
Give them a deadline and drop it. Even ZDI does this now. Some companies will sit on reports for years, because no one cares.
The only configuration method is over a custom binary protocol, so you can't just fuzz HTTP headers and input fields. The firmware downloads are encrypted, so there's no easy way to pull binaries from the device.
The only public way to do any analysis on the software requires soldering to the board.
The early models run VXWorks, the N models run NetBSD 4.3 on ARM (Express) and MIPS (Extreme), and the AC models (Extreme and Time Capsule, the weird tall ones) run a fork of NetBSD 6.0 on ARM. The AC versions actually contain a single-core binned ARM Cortex A9 from the iPhone 4S like you would find in the Apple TV.
That said, at least one group has root, firmware dumps, and is doing active research. Come hang out #theairportwiki on freenode if you're interested.
I think you are referring to the description of Track 1 and 2. Seems like you were one of the contestants. Sorry, we didn't mean to label anyone a newbie. It is just that Track 1 and 2 had goals of bringing in newbies. Of course many of the contestants were even experienced hackers. Indeed one of the winners of Track 1 was also the Track 0 winner.
I apologize if the phrasing in the blog post seemed like a put down of contestants' expertise in any of the Tracks.