bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

AVM routers: another hole in the FritzBox remote maintenance function

Summary

In 2014 heise Security found a hole in the MyFritz apps for Android and iOS through which attackers could access a FritzBox’s web interface without a password. The apps did not check the box’s SSL certificate sufficiently, so an attacker on someone else’s network could grab the session ID. AVM solved this with certificate pinning: the apps remember the certificate’s fingerprint on first contact and warn if it changes.

Ideas

  • Encryption without certificate checking does not protect against man-in-the-middle attacks.
  • An intercepted session ID replaces the password.
  • Every FritzBox runs its own certificate authority called localhost.
  • Certificate pinning replaces the missing trusted CA.

Insights

  • Self-signed certificates need a different trust anchor, otherwise HTTPS is ineffective.
  • The first connection is the critical moment with the trust-on-first-use principle.

Facts

  • With web access, an attacker could create their own user accounts and misuse telephony.
  • The hole had nothing to do with the TR-069 problems being discussed at the same time.
  • In early 2014 criminals had already exploited another FritzBox hole to make expensive phone calls via hijacked routers.

References

Critique

  • The report comes from the discoverer itself and does not assess how many users actually administered their router from other people’s Wi-Fi networks.

Recommendations

  • Set up pinned connections to your own infrastructure for the first time on your own trusted network.
  • Reach router management remotely via a VPN rather than via an open web interface.

Read the original article

Search the Web Archive

hß · 2014

TR-069 remote maintenance hole in DSL routers: German internet providers call their networks secure

After Shahar Tal’s DEF CON talk about holes in TR-069 remote maintenance servers, heise asked German providers in 2014 how they were protected. Telekom, Vodafone, 1&1 and others considered their networks secure because their routers reject self-signed certificates or only contact preset servers. Tal had shown that a hijacked Auto Configuration Server can redirect or read out thousands of routers.

hß · 2022

TP-Link: smuggling malicious code through a security hole in routers

In 2022 researchers from the Vietnamese telecommunications group Viettel found a buffer overflow in the web-based ping tool of the low-cost TP-Link TL-WR841N Wi-Fi router (CVE-2022-30024). Logged-in attackers could execute their own code via an overlong host address and, for example, install a backdoor. TP-Link delivered updates for revisions V10 to V12 and declared older devices end-of-life.

hß · 2022

Takeover possible: DrayTek routers with critical security hole

In 2022 Trellix found a critical hole (CVE-2022-32548, CVSS 10.0) in numerous DrayTek routers through which unauthenticated attackers could take over the devices. A logic error in the length check on the login page /cgi-bin/wlogin.cgi led to a buffer overflow, exploitable from the LAN or via the internet if management was reachable there. The researchers found more than 200,000 vulnerable devices on the net.