Cyber Training Group International (CTGI)

Tag: WiFi routers

  • Security holes discovered in 9 popular routers – is yours on the list?

    Security holes discovered in 9 popular routers – is yours on the list?

    Keeping a close eye on your online accounts is incredibly important with scams, hacks, and breaches as common as they are. Your hardware is at risk as well, which is why we always recommend keeping your devices updated. In fact, one of the most indispensable devices in your home can also be one of the most vulnerable. Cyber Security researchers recently examined a number of popular WiFi routers and found over 200 potential security holes that could put your data at risk.

    Popular WiFi routers have huge security holes

    Editors at the German IT magazine CHIP recently conducted a thorough security test on nine routers from major brands. They teamed up with security experts from IoT Inspector, who provided a security platform for automated IoT firmware checks. What they found might shock you.

    “The test negatively exceeded all expectations for secure small business and home routers,” Florian Lukavsky, CTO of IoT Inspector, said of the results of the test on Thursday. “Not all vulnerabilities are equally critical – but at the time of the test, all devices showed significant security vulnerabilities that could make a hacker’s life much easier.”

    According to IoT Inspector, the test featured routers from Asus, AVM, D-Link, Netgear, Edimax, TP-Link, Synology, and Linksys. Millions of units of each model are currently in circulation around the world. In all, the researchers found 226 vulnerabilities between the nine models.

    Devices from TP-Link had the most vulnerabilities of any device. The company’s Archer AX6000 routers had a whopping 32 security holes. Meanwhile, Synology’s RT-2600ac router came in second place with 30 vulnerabilities. You can see the full list in this document (German).

    Also Read: NINE WIFI ROUTERS USED BY MILLIONS WERE VULNERABLE TO 226 FLAWS

    What are the vulnerabilities?

    Wireless internet routers with status lights on.
    Wireless internet router with status lights on. Image source: Oleksandr Delyk/Adobe

    As IoT Inspector explains, many of the routers had the same vulnerabilities. In many cases, it was an outdated operating system. The researchers noted that integrating a new kernel in the firmware is expensive. As a result, none of the manufacturers were up to date.

    The routers also weren’t on the latest software. Most routers update themselves automatically, but only if you enable the feature. Router updates aren’t as frequent as phone or computer updates, but they’re just as important.

    The researchers contacted all of the affected manufacturers before publishing the report. Every manufacturer responded by releasing firmware patches for their routers. Even if your router isn’t on the list, take this opportunity to check for any outstanding firmware updates.

    Additionally, the German government announced that manufacturers will have to take greater responsibility going forward. The new coalition agreement states that “manufacturers are liable for damage negligently caused by IT security vulnerabilities in their products.” So if hackers find and exploit security holes in routers in the future, manufacturers will pay the price.

    What you can do to protect yourself

    Of course, whether or not the manufacturer is responsible, your data is still at risk. IoT Inspector CEO Jan Wendenburg offered the following helpful hint for all router owners:

    Changing passwords on first use and enabling the automatic update function must be standard practice on all IoT devices, whether the device is used at home or in a corporate network. The greatest danger, besides vulnerabilities introduced by manufacturers, is using an IoT device according to the motto ‘plug, play and forget.’

    Update your software, use strong passwords, and keep an eye out for reports such as these.

    Credits: bgr.com

  • Nine WiFi routers used by millions were vulnerable to 226 flaws

    Nine WiFi routers used by millions were vulnerable to 226 flaws

    Security researchers analyzed nine popular WiFi routers and found a total of 226 potential vulnerabilities in them, even when running the latest firmware.

    The tested routers are made by Asus, AVM, D-Link, Netgear, Edimax, TP-Link, Synology, and Linksys, and are used by millions of people.

    The front-runners in terms of the number of vulnerabilities are the TP-Link Archer AX6000, having 32 flaws, and the Synology RT-2600ac, which has 30 security bugs.

    High-severity flaws affecting TP-Link Archer AX6000
    High-severity flaws affecting TP-Link Archer AX6000
    Source: IoT Inspector

    The testing process

    Researchers at IoT Inspector carried out the security tests in collaboration with CHIP magazine, focusing on models used mainly by small firms and home users.

    “For Chip’s router evaluation, vendors provided them with current models, which were upgrade to the latest firmware version,” Florian Lukavsky, CTO & Founder at IoT Inspector, told BleepingComputer via email.

    “The firmware versions were automatically analyzed by IoT Inspector and checked for more than 5,000 CVEs and other security issues.”

    Their findings showed that many of the routers were still vulnerable to publicly disclosed vulnerabilities, even when using the latest firmware, as illustrated in the table below.

    Router models and flaws categorized as per their severity
    Router models and flaws categorized as per their severity
    Source: CHIP
    Left column translated by BleepingComputer

    While not all flaws carried the same risk, the team found some common problems that affected most of the tested models:

    • Outdated Linux kernel in the firmware
    • Outdated multimedia and VPN functions
    • Over-reliance on older versions of BusyBox
    • Use of weak default passwords like “admin”
    • Presence of hardcoded credentials in plain text form

    Jan Wendenburg, the CEO of IoT Inspector, noted that one of the most important ways of securing a router is to change the default password when you first configure the device.

    “Changing passwords on first use and enabling the automatic update function must be standard practice on all IoT devices, whether the device is used at home or in a corporate network.” explained Wendenburg.

    “The greatest danger, besides vulnerabilities introduced by manufacturers, is using an IoT device according to the motto ‘plug, play and forget’.”

    Also Read: HACKERS DEPLOY LINUX MALWARE, WEB SKIMMER ON E-COMMERCE SERVERS

    Extracting an encryption key

    The researchers didn’t publish many technical details about their findings, except for one case concerning the extraction of the encryption key for D-Link router firmware images.

    The team found a way to gain local privileges on a D-Link DIR-X1560 and get shell access via the physical UART debug interface.

    Next, they dumped the whole filesystem using built-in BusyBox commands and then located the binary responsible for the decryption routine.

    By analyzing the corresponding variables and functions, the researchers eventually extracted the AES key used for the firmware encryption.

    Deriving the AES key on CyberChef
    Deriving the AES key on CyberChef
    Source: IoT Inspector

    Using that key, a threat actor can send malicious firmware image updates to pass verification checks on the device, potentially planting malware on the router.

    Such problems can be solved with full-disk encryption that secures locally stored images, but this practice is not common.

    Manufacturers responded quickly

    All of the affected manufacturers responded to the researchers’ findings and released firmware patches.

    CHIP’s author Jörg Geiger commented that the router vendors addressed most of the security flaws identified by the working group, but not all of them.

    The researchers have told Bleeping Computer that the unpatched flaws are mostly lower importance vulnerabilities. However, they clarified that no follow-up tests were done to confirm that the security updates fixed the reported issues.

    The vendor responses to CHIP (translated) were the following:

    • Asus: Asus examined every single point of the analysis and presented us with a detailed answer. Asus has patched the outdated BusyBox version, and there are also updates for “curl” and the web server. The pointed out that password problems were temp files that the process removes when it is terminated. They do not pose a risk.
    • D-Link: D-Link thanked us briefly for the information and published a firmware update that fixes the problems mentioned.
    • Edimax: Edimax doesn’t seem to have invested too much time in checking the problems, but at the end there was a firmware update that fixed some of the gaps.
    • Linksys: Linksys has taken a position on all issues classified as “high” and “medium”. Default passwords will be avoided in the future; there is a firmware update for the remaining problems.
    • Netgear: At Netgear they worked hard and took a close look at all problems. Netgear sees some of the “high” issues as less of a problem. There are updates for DNSmasq and iPerf, other reported problems should be observed first.
    • Synology: Synology is addressing the issues we mentioned with a major update to the Linux kernel. BusyBox and PHP will be updated to new versions and Synology will soon be cleaning up the certificates. Incidentally, not only the routers benefit from this, but also other Synology devices.
    • TP-Link: With updates from BusyBox, CURL and DNSmasq, TP-Link eliminates many problems. There is no new kernel, but they plan more than 50 fixes for the operating system

    If you are using any of the models mentioned in the report, you are advised to apply the available security updates, enable “automatic updates”, and change the default password to one that is unique and strong.

    Additionally, you should disable remote access, UPnP (Universal Plug and Play), and the WPS (WiFi Protected Setup) functions if you’re not actively using them.

    Bleeping Computer has contacted all of the affected manufacturers requesting a comment on the above, and we will update this piece as soon as we receive their response.

    Credits: BleepingComputer.com