bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Wi-Fi routers targeted by hackers

Summary

According to Trend Micro, unauthorised login attempts on home routers rose from 23 to 249 million between September and December 2019. Attackers want to take over the devices by brute force and integrate them into botnets for DDoS attacks, especially as more company data moved into home offices. An analysis of 127 routers by Fraunhofer FKIE also showed that many had not received updates for years and ran on very old Linux kernels.

Ideas

  • The router is the first device of the home network reachable from the internet.
  • Hijacked routers serve as a bridgehead to IoT devices behind them.
  • Many manufacturers do not provide security updates for older models.
  • Exploit mitigations were missing in many firmware images.

Insights

  • Working from home turns the security of private routers into a company matter.
  • The age of the built-in kernel is a good indicator of how well firmware is maintained.

Facts

  • For 22 of the 127 devices tested there had been no firmware update for two years.
  • More than a third of the firmware used kernels without security updates for at least nine years.
  • AVM routers performed best by far in the Fraunhofer test.
  • In July 2020 the BSI published a test specification for certifying home routers according to its technical guideline.

References

Critique

  • The attack figures come from an antivirus vendor with its own product interest.

Recommendations

  • Disable remote access to router management from the internet.
  • Replace routers for which the manufacturer no longer provides security updates.

Read the original article

Search the Web Archive

hß · 2022

TP-Link: smuggling malicious code through a security hole in routers

In 2022 researchers from the Vietnamese telecommunications group Viettel found a buffer overflow in the web-based ping tool of the low-cost TP-Link TL-WR841N Wi-Fi router (CVE-2022-30024). Logged-in attackers could execute their own code via an overlong host address and, for example, install a backdoor. TP-Link delivered updates for revisions V10 to V12 and declared older devices end-of-life.

hß · 2022

Takeover possible: DrayTek routers with critical security hole

In 2022 Trellix found a critical hole (CVE-2022-32548, CVSS 10.0) in numerous DrayTek routers through which unauthenticated attackers could take over the devices. A logic error in the length check on the login page /cgi-bin/wlogin.cgi led to a buffer overflow, exploitable from the LAN or via the internet if management was reachable there. The researchers found more than 200,000 vulnerable devices on the net.

hß · 2014

TR-069 remote maintenance hole in DSL routers: German internet providers call their networks secure

After Shahar Tal’s DEF CON talk about holes in TR-069 remote maintenance servers, heise asked German providers in 2014 how they were protected. Telekom, Vodafone, 1&1 and others considered their networks secure because their routers reject self-signed certificates or only contact preset servers. Tal had shown that a hijacked Auto Configuration Server can redirect or read out thousands of routers.