Router Security – Linksys Vulns Exposed
Recently a researcher posted an article entitled “Don’t Use Linksys Routers” in which he details a series of vulnerabilities that he found in very little time. The vulnerabilities affect the popular WRT54GL and EA2700, and they’re very significant, allowing for full access to password files, firmware installation, etc.
These vulnerabilities are so dangerous because your router is at the front of your network – the average user has all of their devices behind one, and a compromise of the router will allow for MITM attacks, DOS, or just a silent botnet/backdoor. And these vulnerabilities took a mere 30 minutes to find, indicating that with only a bit more time quite a few more would pop up. As the author puts it:
This vulnerability tells me that this routers software was never given a security pen-test because it is just TOO easy!
The vulnerabilities speak to an issue with the development lifecycle. And that’s key. You are not just “safe” by using a different router, these vulnerabilities indicate that they’re doing something critically incorrect during the development stage of the software – they are not testing their product for security issues.
So your issues are not limited to WRT54GL and EA2700, and, in my opinion, they’re not even limited to Linksys.
Routers simply don’t have strong security. They sit at the edge of your network, fairly exposed, and they take in all incoming data, leaving them in a hostile environment. They’re rarely patched, and even when patches are pushed out, how often do you really update it? Updating isn’t easy, and there’s often big scary warnings saying you’ll brick your device if you do it (what the hell?) so the vast majority of users are likely very very much vulnerable to a series of already patched vulnerabilities.
And routers don’t do anything extraordinary. Even DD-WRT and Tomato don’t. They just run a simple 2.6 Linux Kernel, which has all of the problems of the Linux kernel already, and then they put some services on it that have to connect out to work.
There’s significant attack surface here.
I demonstrated how anybody could design an internet worm that targeted common network devices like routers and turn them into a powerful botnet that is able to monitor traffic across all types of networks.
That vulnerability demonstrated still remains unpatched FYI. This botnet is for the taking, to whoever goes for it first.
So what can you do to protect yourself?
Well, like I said, just running another router firmware isn’t exactly making you “secure”, but they’ll probably patch better, and not suck so completely hard. So that’s a start.
I also suggest disabling Universal Plug And Play if for whatever reason it has been enabled.
In your administrator settings ensure that you have disabled remote configuration entirely (meaning you have to be wired into the router itself just to get access to the webpage.)
Make sure you change your username and password on the router – make it a strong password, make it unique.
Stay patched.
And hope for the best!
Of course, you can build your own router, which would allow you to secure it significantly more. You could simply take some old laptop you don’t use anymore, throw on Linux, patch it with Grsecurity, set up complex uptables rules, get your services patched constantly, etc. But that’s time.
blog comments powered by Disqus