bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

New security hole in internet routers

Summary

In 2001 the configuration password of DrayTek’s Vigor2000 and Vigor2200 DSL and ISDN routers could be spied out from the local network. Attackers on the LAN could use it to reconfigure the router; only firmware 1.07 helped. The hole could not be exploited from the internet and was therefore less dangerous than the insecure default configuration of many routers.

Ideas

  • The local network is not a trusted zone either.
  • A spied-out admin password allows the router to be completely reconfigured.
  • German firmware versions were distributed by the importers TwoCom and Dr. Bott.

Insights

  • Insecure defaults often endanger more devices than individual software bugs.
  • The reach of a hole, LAN or internet, determines its urgency.

Facts

  • The Vigor2000 and Vigor2200 series were affected.
  • The hole was closed with firmware version 1.07.

References

Critique

  • The report does not describe how the password could be spied out, which makes checking without an update harder.

Recommendations

  • Restrict access to router management to a separate management network or specific hosts.
  • Change routers’ default configurations and passwords when you put them into operation.

Read the original article

Search the Web Archive

hß · 2014

TR-069 remote maintenance hole in DSL routers: German internet providers call their networks secure

After Shahar Tal’s DEF CON talk about holes in TR-069 remote maintenance servers, heise asked German providers in 2014 how they were protected. Telekom, Vodafone, 1&1 and others considered their networks secure because their routers reject self-signed certificates or only contact preset servers. Tal had shown that a hijacked Auto Configuration Server can redirect or read out thousands of routers.

hß · 2007

DoS hole in Cisco IOS endangers internet providers’ routers [Update]

In 2007 a DoS hole in Cisco’s IOS allowed routers to be forced to restart via the command “show ip bgp regexp” with certain regular expressions. Many providers offered such commands publicly via telnet route servers or looking glass websites; repeated restarts could cause other networks to ignore the provider’s routes. As a workaround, providers filtered the expressions or blocked the command, and Cisco recommended the “Deterministic Regular Expression Engine”.

hß · 2024

Wednesday: Meta annoys AR developers, security hole at internet providers

Alongside Meta ending third-party AR effects and the Polaris Dawn launch, heise’s news round-up of 28 August 2024 reported an attack on internet providers. An unpatched hole in the network software Versa Director (CVE-2024-39717) was used to gain a foothold in at least four ISPs. There the attackers intercepted customer credentials in plain text before they were stored hashed; Lumen attributed the attack to the Chinese group Volt Typhoon.