5 ms·

Your Wireless Router Is Broken – Help Us Fix It At DEF CON

149 points by sinak 12y ago

miles 12y ago
FTA: "Last year, researchers at ISE found that a staggering 100% of SOHO routers they evaluated were vulnerable to remote attacks." However, the linked study[1] shows that: 1. 2 of the routers did not have remote exploits 2. All but 2 of the other routers required authenticated access to exploit remotely Authenticated attacks "require that the attacker have access to credentials (or that default router credentials are used—an all-too-common situation) or that a victim is logged in with an active session at the time of the attack." While default passwords may be common, virtually all routers have remote admin turned off by default as well. [1] https://securityevaluators.com/knowledge/case_studies/routers/soho_router_hacks.php https://securityevaluators.com/knowledge/case_studies/router...
- AlyssaRowan 12y ago
  The real fun comes when you can turn remote admin back on remotely. Oh, god, I wish I was joking.
  - hornetblack 12y ago
    I did that to a ISP provided router. The company wouldn't enable port forwarding for games. So I did it myself. Why do those routers have open telnet interfaces.
- xorcist 12y ago
  There's a lot of ways to access internal interfaces. By executing javascript on an internal computer for example. An img src is enough for simple requests. If the home router implements uPnP (many do), and if that implementation is insecure (all are), you can often pop holes from the outside. And that's just the two ideas to try first... Don't expect a disabled remote admin to protect you from anything else than automated bots.
iuguy 12y ago
I really don't understand why they feel they need to develop their own full firmware rather than contribute to another project like OpenWRT or CeroWRT? Anyone involved care to tell us why?
- ac29 12y ago
  Its based on CeroWRT/OpenWRT, see here: https://github.com/EFForg/OpenWireless https://github.com/EFForg/OpenWireless Hopefully any interesting new features or fixes will get pushed upstream.
- bjornsing 12y ago
  Yea, that's surprising. Looking at their github repo it looks pretty hopeless to backport their improvements into LuCI/OpenWrt/CeroWrt. To me it would make more sense to either a) help improve LuCI/OpenWrt/CeroWrt or b) educate consumers about which commercial Wi-Fi routers are good/bad from a security perspective. Their current approach seems to do neither.
- cryptolect 12y ago
  I would guess that they want the default behaviour and user experience different to OpenWRT's goals.
  - ssebastianj 12y ago
    If UX is a must, then Gargoyle is an option: http://www.gargoyle-router.com/ http://www.gargoyle-router.com/
Kayou 12y ago
At least one of the attack, the CSRF on the Asus RT-N56U, seems to need the IP address of the router. Does this mean that this attack is useless when the attacker doesn't know the IP of the router? Or is there a way to know it remotely? (I happen to have this router and the IP of the router is not the same, and I don't think that the default config has been changed as the admin interface has the default password.) Also, an attack necessitating a user to be logged in to the admin interface has probably a very small chance of success. I don't know any "normal" person who would log into their router admin interface (unless maybe they are asked for with social engineering). PS: but having an Open Wireless Router is a good idea anyway. We could imagine one having upgradeable hardware and just switch the mini PCIe card to have 802.11 ac instead of 802.11 n for instance.
- hrrsn 12y ago
  Can easily be obtained by spear phishing or nmapping IP ranges.
  - Kayou 12y ago
    Do you need to be on the same local network as the user to do that or does that work with an attacker being on the internet?
    - hrrsn 12y ago
      If you just need their external IP address, you can probably easily coerce that out of them by getting them to click a link. Send an IM to a bit.ly link that logs an IP and forwards on to some random image, an email, a tweet, etc.
  - zdw 12y ago
    Or frequently by the email header of someone who sent mail from behind the router.
- sokoloff 12y ago
  If it's on the network and transmitting (at all) from that IP address, finding the set of IP addresses to check is trivial for an attacker.
acd 12y ago
One thing I realized is that you can share several safe internet sites on a public SSID. For example you could share Google and duckduckgo searches you can also share Wikipedia. You can also share access to well known VPN services. So you put in an iptables rules for the guest SSID interface. This is not a fully open net and all respect to those who build it but I am a bit affraid what sites users might surf on and as it now law enforcement assume ip==user who did things.
- IvyMike 12y ago
  I built a Onion Pi router for this purpose. All traffic on the public access point is sent over Tor. It's a mixed bag but seems to work well enough. https://learn.adafruit.com/onion-pi/overview https://learn.adafruit.com/onion-pi/overview
  - Istof 12y ago
    it would be nice to have routers with pre-configured exit nodes
- xorcist 12y ago
  > now law enforcement assume ip==user who did things That is false. However, they might have a few questions. The plausible deniability is in fact a big plus for lesser crimes that they don't really want to investigate, such as file sharing. I've been running an open access point for 14 years now for the simple reason that I want to live in a society where people do such things.
kriro 12y ago
Does anyone know the rough economics of router manufacturing? At what quantity could you get reasonable enough prices to sell it at an acceptable (to consumers) premium? Build your own, only open hardware (if that's even feasable..soooo much closed stuff) and sell as EFF approved/privacy friendly whatever. EFF probably has enough brand recognition with the right folks to pull it off as a sponsor or something. Seems like a couple of million kickstarter or similar project to me. Especially if they also serve the non-US market which is currently rather security/privacy concerned. [unfortunately I know very little about hardware cost/closednes but last time I did a rough check it seems like somewhat of a nightmare field to be in] Edit: Heck YC could think about opening a spot specifically for a startup that improves privacy (i.e. open wifi router). After all they did enter the nonprofit market. Seems like a reasonable PR/goodwill move.
- teacup50 12y ago
  Router boards these days are a commodity, with all the available consumer access points using the same SoC and hardware on a different PCB with their own plastic case. A single SoC often provides 1) MIPS processor, 2) Ethernet MAC, 3) Switch in ASIC, 4) WiFi MAC See also: http://www.eeboard.com/wp-content/uploads/downloads/2013/08/AR9331.pdf http://www.eeboard.com/wp-content/uploads/downloads/2013/08/... You can buy off-the-shelf complete systems ready to be dropped in a plastic case, or even complete (and very commodity) systems: http://routerboard.com/ http://routerboard.com/ I'd love to see a RaspberryPi-style approach to home access points using the popular MIPS SoCs, with pfsense (https://pfsense.org/ https://pfsense.org/).
ck2 12y ago
What about things like http://wrtnode.com/ http://wrtnode.com/ Opensource hardware with opensource dd-wrt

149 points by sinak 12y ago

miles 12y ago

FTA: "Last year, researchers at ISE found that a staggering 100% of SOHO routers they evaluated were vulnerable to remote attacks." However, the linked study[1] shows that: 1. 2 of the routers did not have remote exploits 2. All but 2 of the other routers required authenticated access to exploit remotely Authenticated attacks "require that the attacker have access to credentials (or that default router credentials are used—an all-too-common situation) or that a victim is logged in with an active session at the time of the attack." While default passwords may be common, virtually all routers have remote admin turned off by default as well. [1] https://securityevaluators.com/knowledge/case_studies/routers/soho_router_hacks.php https://securityevaluators.com/knowledge/case_studies/router...

AlyssaRowan 12y ago
The real fun comes when you can turn remote admin back on remotely. Oh, god, I wish I was joking.
- hornetblack 12y ago
  I did that to a ISP provided router. The company wouldn't enable port forwarding for games. So I did it myself. Why do those routers have open telnet interfaces.
xorcist 12y ago
There's a lot of ways to access internal interfaces. By executing javascript on an internal computer for example. An img src is enough for simple requests. If the home router implements uPnP (many do), and if that implementation is insecure (all are), you can often pop holes from the outside. And that's just the two ideas to try first... Don't expect a disabled remote admin to protect you from anything else than automated bots.

iuguy 12y ago

I really don't understand why they feel they need to develop their own full firmware rather than contribute to another project like OpenWRT or CeroWRT? Anyone involved care to tell us why?

ac29 12y ago
Its based on CeroWRT/OpenWRT, see here: https://github.com/EFForg/OpenWireless https://github.com/EFForg/OpenWireless Hopefully any interesting new features or fixes will get pushed upstream.
bjornsing 12y ago
Yea, that's surprising. Looking at their github repo it looks pretty hopeless to backport their improvements into LuCI/OpenWrt/CeroWrt. To me it would make more sense to either a) help improve LuCI/OpenWrt/CeroWrt or b) educate consumers about which commercial Wi-Fi routers are good/bad from a security perspective. Their current approach seems to do neither.
cryptolect 12y ago
I would guess that they want the default behaviour and user experience different to OpenWRT's goals.
- ssebastianj 12y ago
  If UX is a must, then Gargoyle is an option: http://www.gargoyle-router.com/ http://www.gargoyle-router.com/

Kayou 12y ago

At least one of the attack, the CSRF on the Asus RT-N56U, seems to need the IP address of the router. Does this mean that this attack is useless when the attacker doesn't know the IP of the router? Or is there a way to know it remotely? (I happen to have this router and the IP of the router is not the same, and I don't think that the default config has been changed as the admin interface has the default password.) Also, an attack necessitating a user to be logged in to the admin interface has probably a very small chance of success. I don't know any "normal" person who would log into their router admin interface (unless maybe they are asked for with social engineering). PS: but having an Open Wireless Router is a good idea anyway. We could imagine one having upgradeable hardware and just switch the mini PCIe card to have 802.11 ac instead of 802.11 n for instance.

hrrsn 12y ago
Can easily be obtained by spear phishing or nmapping IP ranges.
- Kayou 12y ago
  Do you need to be on the same local network as the user to do that or does that work with an attacker being on the internet?
  - hrrsn 12y ago
    If you just need their external IP address, you can probably easily coerce that out of them by getting them to click a link. Send an IM to a bit.ly link that logs an IP and forwards on to some random image, an email, a tweet, etc.
- zdw 12y ago
  Or frequently by the email header of someone who sent mail from behind the router.
sokoloff 12y ago
If it's on the network and transmitting (at all) from that IP address, finding the set of IP addresses to check is trivial for an attacker.

acd 12y ago

One thing I realized is that you can share several safe internet sites on a public SSID. For example you could share Google and duckduckgo searches you can also share Wikipedia. You can also share access to well known VPN services. So you put in an iptables rules for the guest SSID interface. This is not a fully open net and all respect to those who build it but I am a bit affraid what sites users might surf on and as it now law enforcement assume ip==user who did things.

IvyMike 12y ago
I built a Onion Pi router for this purpose. All traffic on the public access point is sent over Tor. It's a mixed bag but seems to work well enough. https://learn.adafruit.com/onion-pi/overview https://learn.adafruit.com/onion-pi/overview
- Istof 12y ago
  it would be nice to have routers with pre-configured exit nodes
xorcist 12y ago
> now law enforcement assume ip==user who did things That is false. However, they might have a few questions. The plausible deniability is in fact a big plus for lesser crimes that they don't really want to investigate, such as file sharing. I've been running an open access point for 14 years now for the simple reason that I want to live in a society where people do such things.

kriro 12y ago

Does anyone know the rough economics of router manufacturing? At what quantity could you get reasonable enough prices to sell it at an acceptable (to consumers) premium? Build your own, only open hardware (if that's even feasable..soooo much closed stuff) and sell as EFF approved/privacy friendly whatever. EFF probably has enough brand recognition with the right folks to pull it off as a sponsor or something. Seems like a couple of million kickstarter or similar project to me. Especially if they also serve the non-US market which is currently rather security/privacy concerned. [unfortunately I know very little about hardware cost/closednes but last time I did a rough check it seems like somewhat of a nightmare field to be in] Edit: Heck YC could think about opening a spot specifically for a startup that improves privacy (i.e. open wifi router). After all they did enter the nonprofit market. Seems like a reasonable PR/goodwill move.

teacup50 12y ago
Router boards these days are a commodity, with all the available consumer access points using the same SoC and hardware on a different PCB with their own plastic case. A single SoC often provides 1) MIPS processor, 2) Ethernet MAC, 3) Switch in ASIC, 4) WiFi MAC See also: http://www.eeboard.com/wp-content/uploads/downloads/2013/08/AR9331.pdf http://www.eeboard.com/wp-content/uploads/downloads/2013/08/... You can buy off-the-shelf complete systems ready to be dropped in a plastic case, or even complete (and very commodity) systems: http://routerboard.com/ http://routerboard.com/ I'd love to see a RaspberryPi-style approach to home access points using the popular MIPS SoCs, with pfsense (https://pfsense.org/ https://pfsense.org/).

ck2 12y ago

What about things like http://wrtnode.com/ http://wrtnode.com/ Opensource hardware with opensource dd-wrt