5 ms·

This needs some context. DSP-W215 is a remote controlled power switch with WiFi.

0x0 12y ago
Also, this is the third remote code execution vulnerability blogged in about as many days. Seems like dlink is having major quality issues with their software/firmware, which is spooky considering the things the device is supposed to do (manage power on an AC outlet). They did release a patch for the first problem but failed to review and fix similar flaws in the immediately surrounding code.
- michh 12y ago
  I wonder if 3 vulnerabilities in 3 days means this device has exceptionally bad firmware compared to other similar devices or is just suddenly getting a lot of attention from skilled hackers. Guessing by how frail software on these types of devices (routers, access points, home automation stuff, DSL modems, cable boxes, consumer NAS enclosures, etc etc) often feels, I fear it's the latter.
  - lunixbochs 12y ago
    It's the latter.
  - pasbesoin 12y ago
    In my stints doing QA, I've found that developers seldom look beyond the immediately presented problem/issue, even when that problem makes it apparent that further review and consideration is warranted if not demanded. [1] Further, all too often, minimum mitigations -- sometimes, the word "solution" cannot even be accurately applied to these -- are conceived and implemented. When you see repeated problems cropping up like this, based upon experience, I can express the opinion that the organization and/or the individuals involved are not really paying attention or respecting sufficiently the security aspects involved. Hopefully, the repeated bad press will begin to change this. But... those in the organization responsible for setting or sanctioning such initiative, are often all-to-well insulated from the immediate "real world". -- [1] P.S. I guess I should qualify this to say that I'm speaking of what I consider to be a typical "corporate" environment. Lots of politics and inertia and, all too often, "just do what you're told".
  - xyzzy123 12y ago
    It's bad; it's not exceptionally bad compared to similar devices though. So I agree with you. I do think embedded devices as a whole are getting a lot more attention lately - because they're so fun to hack. A consumer home router is often quite similar in terms of hardware to a Linux box from say 1995 (with differences due to Moore's law versus Kryder's law). 20 years as a rule of thumb is OK. Unfortunately the development practices you see tend to be 20 years out of date as well [shoddy, non-memory safe code, with no automated tests, talking to the network]. This is partly why hacking embedded devices is fun; it's like the 90's again! [I think every pentester has dreamed about the idea of being transported to 1995, knowing what they know now...]
- xyzzy123 12y ago
  D-Link don't actually do anything like what you or I might call R&D or even software development. These products are absolutely riddled with security flaws, but the brands haven't caught on yet. I think really understanding why requires a bit of background, which I'll attempt to provide: Brands like D-Link solicit stuff from "white label" vendors (who most people will have never heard of); the models they like the best get D-Link branded and get a chance at shelf space around the world. The brands do have input into things like the web interface, enclosure design and/or setup procedures (e.g. WPS button). What the brands do is valuable, but they usually do not have deep insight into how the product actually works or how it's developed. The white-label vendors are like artists, trying to produce "hits", and the major brands are like record labels who can introduce things to a wide audience. Naturally, the brands try to find suppliers who can provide the best features at the lowest hardware cost. The software side is often not looked at very closely. When a researcher reports a vulnerability, this usually goes through the brand. Unfortunately, since they're not very technical, the brand tends to mangle the communications to the white-label. The white-label is scrambling to make their upstream customer (i.e. D-Link) happy, not the consumer. Communications problems are exacerbated when (as quite often happens) the firmware developer at the end of this chain does not have strong english. Finally, in the case where the firmware is riddled with such bugs, it's in the interest of the white-label to HIDE this fact from the brand. I think what needs to happen is that D-Link need to have high quality security reviews conducted as part of their vendor / hardware selection process. It's likely to happen, but it'll take years for the benefits to flow through to consumers. On the Telco side, most places are now putting their home gateways and so on through fairly rigorous security reviews during the selection and deployment process. The hardware vendors are slowly learning embedded security via that route. No-one likes to lose multi-million unit sales. [source: I've worked both in wifi router firmware development and pentesting, including embedded device security reviews].
  - 0x0 12y ago
    That's a very informative post, thanks! I guess this means dlink has even bigger issues with QA than I first thought ;)

0x0 12y ago

Also, this is the third remote code execution vulnerability blogged in about as many days. Seems like dlink is having major quality issues with their software/firmware, which is spooky considering the things the device is supposed to do (manage power on an AC outlet). They did release a patch for the first problem but failed to review and fix similar flaws in the immediately surrounding code.

michh 12y ago
I wonder if 3 vulnerabilities in 3 days means this device has exceptionally bad firmware compared to other similar devices or is just suddenly getting a lot of attention from skilled hackers. Guessing by how frail software on these types of devices (routers, access points, home automation stuff, DSL modems, cable boxes, consumer NAS enclosures, etc etc) often feels, I fear it's the latter.
- lunixbochs 12y ago
  It's the latter.
- pasbesoin 12y ago
  In my stints doing QA, I've found that developers seldom look beyond the immediately presented problem/issue, even when that problem makes it apparent that further review and consideration is warranted if not demanded. [1] Further, all too often, minimum mitigations -- sometimes, the word "solution" cannot even be accurately applied to these -- are conceived and implemented. When you see repeated problems cropping up like this, based upon experience, I can express the opinion that the organization and/or the individuals involved are not really paying attention or respecting sufficiently the security aspects involved. Hopefully, the repeated bad press will begin to change this. But... those in the organization responsible for setting or sanctioning such initiative, are often all-to-well insulated from the immediate "real world". -- [1] P.S. I guess I should qualify this to say that I'm speaking of what I consider to be a typical "corporate" environment. Lots of politics and inertia and, all too often, "just do what you're told".
- xyzzy123 12y ago
  It's bad; it's not exceptionally bad compared to similar devices though. So I agree with you. I do think embedded devices as a whole are getting a lot more attention lately - because they're so fun to hack. A consumer home router is often quite similar in terms of hardware to a Linux box from say 1995 (with differences due to Moore's law versus Kryder's law). 20 years as a rule of thumb is OK. Unfortunately the development practices you see tend to be 20 years out of date as well [shoddy, non-memory safe code, with no automated tests, talking to the network]. This is partly why hacking embedded devices is fun; it's like the 90's again! [I think every pentester has dreamed about the idea of being transported to 1995, knowing what they know now...]
xyzzy123 12y ago
D-Link don't actually do anything like what you or I might call R&D or even software development. These products are absolutely riddled with security flaws, but the brands haven't caught on yet. I think really understanding why requires a bit of background, which I'll attempt to provide: Brands like D-Link solicit stuff from "white label" vendors (who most people will have never heard of); the models they like the best get D-Link branded and get a chance at shelf space around the world. The brands do have input into things like the web interface, enclosure design and/or setup procedures (e.g. WPS button). What the brands do is valuable, but they usually do not have deep insight into how the product actually works or how it's developed. The white-label vendors are like artists, trying to produce "hits", and the major brands are like record labels who can introduce things to a wide audience. Naturally, the brands try to find suppliers who can provide the best features at the lowest hardware cost. The software side is often not looked at very closely. When a researcher reports a vulnerability, this usually goes through the brand. Unfortunately, since they're not very technical, the brand tends to mangle the communications to the white-label. The white-label is scrambling to make their upstream customer (i.e. D-Link) happy, not the consumer. Communications problems are exacerbated when (as quite often happens) the firmware developer at the end of this chain does not have strong english. Finally, in the case where the firmware is riddled with such bugs, it's in the interest of the white-label to HIDE this fact from the brand. I think what needs to happen is that D-Link need to have high quality security reviews conducted as part of their vendor / hardware selection process. It's likely to happen, but it'll take years for the benefits to flow through to consumers. On the Telco side, most places are now putting their home gateways and so on through fairly rigorous security reviews during the selection and deployment process. The hardware vendors are slowly learning embedded security via that route. No-one likes to lose multi-million unit sales. [source: I've worked both in wifi router firmware development and pentesting, including embedded device security reviews].
- 0x0 12y ago
  That's a very informative post, thanks! I guess this means dlink has even bigger issues with QA than I first thought ;)