6 ms·

Over 25k Linksys routers vulnerable to sensitive information disclosure flaw

79 points by bad_packets 7y ago

StudentStuff 7y ago
Once again embedded device security is a joke. Firmware updates are provided for 2 years or less on devices that end up lingering, acting as the core of networks for 5 to 15 years. Repeat offenders should be held accountable, standards should be enforced (like running point releases of OpenWRT, providing vendor skins as a package, thus the vendor doesn't have to deal with software updates).
- ChuckNorris89 7y ago
  > Once again embedded device security is a joke. Have you seen the state of salaries in the firmware dev industry? That pretty much explains why firmware security is such a mess. You pay peanuts you get peanuts.
  - StudentStuff 7y ago
    The state of salaries in hardware/embedded roles is quite poor, along with the decision making process of most companies that create embedded hardware. Only TI ever really went all in with a fully open stack that had support mainlined, problem being by the time their chips had full support upstream they'd be lagging 1 to 2 years behind Qualcomm, Nvidia, Mediatek, Allwinner, Spreadtrum, etc while having a much higher cost per chip, most of said cost being the decently written and upstreamed drivers. For longer lived architectures (eg: AMD/Intel CPUs) totally new device drivers aren't needed on launch day, in part due to older upstreamed drivers still mostly working with newer hardware. None of the aforementioned vendors besides TI ever got into this virtuous cycle of having upstreamed drivers, thus they've trapped their devices on sketchy, unstable & insecure BSPs that hurt the reliability, performance and sometimes the market image of the final product (eg: when the device randomly crashes or gets exploited due to latent bugs).
svacko 7y ago
Pity that the author didn't mention alternative firmwares as an option to fix the vulnerability. I recommend everyone with the affected device to go to https://openwrt.org/toh/start?dataflt%5BBrand*%7E%5D=Linksys https://openwrt.org/toh/start?dataflt%5BBrand*%7E%5D=Linksys and install the OpenWRT firmware, it's pretty easy.
- bad_packets 7y ago
  Will add to the post, thanks for the recommendation.
- IntelMiner 7y ago
  +1 for OpenWRT I've had a Linksys WRT1900AC since its release (specifically on the promise of OpenWRT support) The device has gradually gotten better and better with each OpenWRT release. These days I get a blistering 60MB/s file transfers over Wi-Fi to my laptop. Even with newer, "faster" specced devices on the market, I really can't see any compelling reason to upgrade
smnra 7y ago
This is not a problem if you are behind a CG-NAT. If you are not (that should be the default) then ask your ISP to put you behind one. If they don't offer that service, then it's time to shop around.
- wtallis 7y ago
  Asking your ISP to cripple your connection like that is a horrible "solution", and usually isn't a change they're prepared to make by request. If you have the option of shopping around for ISPs, the one that doesn't do CG-NAT is usually the best choice.
  - smnra 7y ago
    I disagree with you. The majority of users don't care about being behind a CG-NAT (what you call "crippling"), and CG-NAT offers a very big layer of protection that avoids problems like the one on this article.
    - pixl97 7y ago
      Stop breaking the internet for goodness sake. Blithely throwing more power into the ISP's hands does no one any good in the long run. Also it is very likely you are still vulnerable from other users on the same ISP attacking you.
      - viraptor 7y ago
        This is very unlikely. Any ISP with some experience will make sure customers are not able to interact any more than they could from outside the network. That's network 101.
        pixl97 7y ago
        Having worked for large ISP's for around a decade, cheap comes first, customer safety comes last. Also, QUIT BREAKING THE INTERNET. CGNAT is complete crap that breaks the internet peer model. Even ISPs not using CGNAT are pushing complete crap on users. For example last week I had a user that VOIP stopped working. They received a new integrated cable modem router from their ISP. If you rebooted the unit VOIP worked about an hour, after that it would stop passing VOIP packets (ran tcpdump on the server and watched them stop). If we ran VOIP over another port it would work (but had different issues related to changing around 50 phones so we only used it for testing). There were no options to disable SIP_NAT, nor any other settings that would fix the problem. Since this ISP also provided their own phone service I found the whole debacle rather anti-competitive. They simply have no interest in contacting the modem vendor and having them fix the problem. We ended up supplying our own modem and router in this case and the problem was resolved.
gambiting 7y ago
Linksys just doesn't give a shit. At all. I specifically bought one of their top end routers to use it as a NAS with USB storage, only to discover that their best of the best router serves files over.....Samba 1.0. Even though Samba 2.0 has been available for over a decade and Samba 3.0 is common place now. Which means that Windows 10 doesn't allow you to actually browse it by default anymore, since it's a huge security risk. And even when you manually install SMB 1.0 suppport, it's still not going to work on Windows 10 Pro editions. Which means that the main selling point of the router is now useless for me. Linksys of course remains completely silent, they don't see anything wrong there.
- alimbada 7y ago
  You bought a router to use as a NAS? I think that's your problem right there. How is this even voted to the top? Edit: Looks like I hit a nerve. God forbid anyone buy hardware for a purpose it was actually designed for.
  - wDcBKgt66V8WDs 7y ago
    Because your comment is not contributing. Linksys produces and advertises a "best of the best" router with inbuilt alternative NAS feature that not only is so poorly maintained that it's insecure but also unusable by modern OS. Some people find that appalling because they want a basic NAS without breaking the bank and more "stuff" lying around, expecting a high end router to cheaply fill that gap. Some other people will find it appalling because it shows how little Linksys actually cares about the product and security as a whole.
  - nacs 7y ago
    It's actually common nowadays to have NAS-type features in routers now. My non-Linkysys router has SMB/FTP access as part of the stock firmware for USB attached storage.
  - markovbot 7y ago
    You may be lucky enough to have avoided learning about the shitshow that is consumer grade "routers". They seem to constantly be trying to come up with stupid shit they can do. Many of the "high end" of the spectrum of garbage have things like OpenVPN servers and samba shares off the included USB port. They are all hot garbage and should not be used.
tasubotadas 7y ago
Are there any routers that come out by default with Tomato or OpenWRT?
- MrBingley 7y ago
  The Turris Omnia and soon-to-be Turris Mox are the only ones that I'm aware of. I know Linksys has a special line of WRT "open source ready" routers that are supposedly OpenWRT compatible, but the Amazon reviews are completely trash. They're a little more pricey, but my next router will be a Turris. https://www.turris.cz/en/turris-omnia/ https://www.turris.cz/en/turris-omnia/
  - tasubotadas 7y ago
    Now that I think about it, probably the new Raspberry Pi would do a phenomenal job.
bjt2n3904 7y ago
Confirmed this happens on my router -- but the saving grace is that my ISP doesn't allow port 80. Whoof.
duxup 7y ago
It would be nice if there was a home commercial product that cut out all the remote access or even local access, reduced feature set (I don't need NAS on my router), allowed admin access via a physical port only and thus cut out a lot of the attack surface area.... It shouldn't even be hard for Linksys (granted with their history I wouldn't trust them) or someone to provide that option. With a reduced feature set and etc maybe updates would be easier too. Granted when it comes to home commercial routing products it looks like it is all about a bazillion new features (at least the way they look on the box / shopping sites) ... not less.
- Jonnax 7y ago
  Ubiquiti Networks have their Unifi product line that sells to business but since they don't charge licence fees have become quite popular with keen home users. There's regular firmware updates and the feature set is quite standard. Though their routers and access points are separate: Eg: Their smallest router: https://www.ui.com/unifi-routing/usg/ https://www.ui.com/unifi-routing/usg/ Their cheap WiFi AP: https://www.ui.com/unifi/unifi-ap-ac-pro/ https://www.ui.com/unifi/unifi-ap-ac-pro/ To configure the network you use their controller software, can be deployed on a raspberry pi but I just run it ad hoc on my laptop when I need to change some configuration.
  - duxup 7y ago
    I keep meaning to try them out, although I have a bit of trouble parsing their product lines / names at times ;)
PretzelFisch 7y ago
Just incase you are not sure who owns Linksys. Cisco sold them in 2013 and Belkin is their new parent company.
frf37 7y ago
At least I thought that you could opt out of the remote management at least on some models. This is what this seems to indicate as well: https://community.linksys.com/t5/Wireless-Routers/EA8300-can-t-re-enable-remote-administration-smart-wifi/m-p/1182872#M338770 https://community.linksys.com/t5/Wireless-Routers/EA8300-can... When remote admin is disabled the info leak does not occur as far as I can tell. Not sure if anyone can confirm that as well.

79 points by bad_packets 7y ago

Once again embedded device security is a joke. Firmware updates are provided for 2 years or less on devices that end up lingering, acting as the core of networks for 5 to 15 years. Repeat offenders should be held accountable, standards should be enforced (like running point releases of OpenWRT, providing vendor skins as a package, thus the vendor doesn't have to deal with software updates).

ChuckNorris89 7y ago
> Once again embedded device security is a joke. Have you seen the state of salaries in the firmware dev industry? That pretty much explains why firmware security is such a mess. You pay peanuts you get peanuts.
- StudentStuff 7y ago
  The state of salaries in hardware/embedded roles is quite poor, along with the decision making process of most companies that create embedded hardware. Only TI ever really went all in with a fully open stack that had support mainlined, problem being by the time their chips had full support upstream they'd be lagging 1 to 2 years behind Qualcomm, Nvidia, Mediatek, Allwinner, Spreadtrum, etc while having a much higher cost per chip, most of said cost being the decently written and upstreamed drivers. For longer lived architectures (eg: AMD/Intel CPUs) totally new device drivers aren't needed on launch day, in part due to older upstreamed drivers still mostly working with newer hardware. None of the aforementioned vendors besides TI ever got into this virtuous cycle of having upstreamed drivers, thus they've trapped their devices on sketchy, unstable & insecure BSPs that hurt the reliability, performance and sometimes the market image of the final product (eg: when the device randomly crashes or gets exploited due to latent bugs).

svacko 7y ago

Pity that the author didn't mention alternative firmwares as an option to fix the vulnerability. I recommend everyone with the affected device to go to https://openwrt.org/toh/start?dataflt%5BBrand*%7E%5D=Linksys https://openwrt.org/toh/start?dataflt%5BBrand*%7E%5D=Linksys and install the OpenWRT firmware, it's pretty easy.

bad_packets 7y ago
Will add to the post, thanks for the recommendation.
IntelMiner 7y ago
+1 for OpenWRT I've had a Linksys WRT1900AC since its release (specifically on the promise of OpenWRT support) The device has gradually gotten better and better with each OpenWRT release. These days I get a blistering 60MB/s file transfers over Wi-Fi to my laptop. Even with newer, "faster" specced devices on the market, I really can't see any compelling reason to upgrade

smnra 7y ago

This is not a problem if you are behind a CG-NAT. If you are not (that should be the default) then ask your ISP to put you behind one. If they don't offer that service, then it's time to shop around.

wtallis 7y ago
Asking your ISP to cripple your connection like that is a horrible "solution", and usually isn't a change they're prepared to make by request. If you have the option of shopping around for ISPs, the one that doesn't do CG-NAT is usually the best choice.
- smnra 7y ago
  I disagree with you. The majority of users don't care about being behind a CG-NAT (what you call "crippling"), and CG-NAT offers a very big layer of protection that avoids problems like the one on this article.
  - pixl97 7y ago
    Stop breaking the internet for goodness sake. Blithely throwing more power into the ISP's hands does no one any good in the long run. Also it is very likely you are still vulnerable from other users on the same ISP attacking you.
    - viraptor 7y ago
      This is very unlikely. Any ISP with some experience will make sure customers are not able to interact any more than they could from outside the network. That's network 101.
      - pixl97 7y ago
        Having worked for large ISP's for around a decade, cheap comes first, customer safety comes last. Also, QUIT BREAKING THE INTERNET. CGNAT is complete crap that breaks the internet peer model. Even ISPs not using CGNAT are pushing complete crap on users. For example last week I had a user that VOIP stopped working. They received a new integrated cable modem router from their ISP. If you rebooted the unit VOIP worked about an hour, after that it would stop passing VOIP packets (ran tcpdump on the server and watched them stop). If we ran VOIP over another port it would work (but had different issues related to changing around 50 phones so we only used it for testing). There were no options to disable SIP_NAT, nor any other settings that would fix the problem. Since this ISP also provided their own phone service I found the whole debacle rather anti-competitive. They simply have no interest in contacting the modem vendor and having them fix the problem. We ended up supplying our own modem and router in this case and the problem was resolved.

gambiting 7y ago

Linksys just doesn't give a shit. At all. I specifically bought one of their top end routers to use it as a NAS with USB storage, only to discover that their best of the best router serves files over.....Samba 1.0. Even though Samba 2.0 has been available for over a decade and Samba 3.0 is common place now. Which means that Windows 10 doesn't allow you to actually browse it by default anymore, since it's a huge security risk. And even when you manually install SMB 1.0 suppport, it's still not going to work on Windows 10 Pro editions. Which means that the main selling point of the router is now useless for me. Linksys of course remains completely silent, they don't see anything wrong there.

alimbada 7y ago
You bought a router to use as a NAS? I think that's your problem right there. How is this even voted to the top? Edit: Looks like I hit a nerve. God forbid anyone buy hardware for a purpose it was actually designed for.
- wDcBKgt66V8WDs 7y ago
  Because your comment is not contributing. Linksys produces and advertises a "best of the best" router with inbuilt alternative NAS feature that not only is so poorly maintained that it's insecure but also unusable by modern OS. Some people find that appalling because they want a basic NAS without breaking the bank and more "stuff" lying around, expecting a high end router to cheaply fill that gap. Some other people will find it appalling because it shows how little Linksys actually cares about the product and security as a whole.
- nacs 7y ago
  It's actually common nowadays to have NAS-type features in routers now. My non-Linkysys router has SMB/FTP access as part of the stock firmware for USB attached storage.
- markovbot 7y ago
  You may be lucky enough to have avoided learning about the shitshow that is consumer grade "routers". They seem to constantly be trying to come up with stupid shit they can do. Many of the "high end" of the spectrum of garbage have things like OpenVPN servers and samba shares off the included USB port. They are all hot garbage and should not be used.

tasubotadas 7y ago

Are there any routers that come out by default with Tomato or OpenWRT?

MrBingley 7y ago
The Turris Omnia and soon-to-be Turris Mox are the only ones that I'm aware of. I know Linksys has a special line of WRT "open source ready" routers that are supposedly OpenWRT compatible, but the Amazon reviews are completely trash. They're a little more pricey, but my next router will be a Turris. https://www.turris.cz/en/turris-omnia/ https://www.turris.cz/en/turris-omnia/
- tasubotadas 7y ago
  Now that I think about it, probably the new Raspberry Pi would do a phenomenal job.

bjt2n3904 7y ago

Confirmed this happens on my router -- but the saving grace is that my ISP doesn't allow port 80. Whoof.

duxup 7y ago

It would be nice if there was a home commercial product that cut out all the remote access or even local access, reduced feature set (I don't need NAS on my router), allowed admin access via a physical port only and thus cut out a lot of the attack surface area.... It shouldn't even be hard for Linksys (granted with their history I wouldn't trust them) or someone to provide that option. With a reduced feature set and etc maybe updates would be easier too. Granted when it comes to home commercial routing products it looks like it is all about a bazillion new features (at least the way they look on the box / shopping sites) ... not less.

Jonnax 7y ago
Ubiquiti Networks have their Unifi product line that sells to business but since they don't charge licence fees have become quite popular with keen home users. There's regular firmware updates and the feature set is quite standard. Though their routers and access points are separate: Eg: Their smallest router: https://www.ui.com/unifi-routing/usg/ https://www.ui.com/unifi-routing/usg/ Their cheap WiFi AP: https://www.ui.com/unifi/unifi-ap-ac-pro/ https://www.ui.com/unifi/unifi-ap-ac-pro/ To configure the network you use their controller software, can be deployed on a raspberry pi but I just run it ad hoc on my laptop when I need to change some configuration.
- duxup 7y ago
  I keep meaning to try them out, although I have a bit of trouble parsing their product lines / names at times ;)

PretzelFisch 7y ago

Just incase you are not sure who owns Linksys. Cisco sold them in 2013 and Belkin is their new parent company.

frf37 7y ago

At least I thought that you could opt out of the remote management at least on some models. This is what this seems to indicate as well: https://community.linksys.com/t5/Wireless-Routers/EA8300-can-t-re-enable-remote-administration-smart-wifi/m-p/1182872#M338770 https://community.linksys.com/t5/Wireless-Routers/EA8300-can... When remote admin is disabled the info leak does not occur as far as I can tell. Not sure if anyone can confirm that as well.