The SoHo router backdoor that was “fixed” by hiding it behind another backdoor

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Over the Christmas break at the end of 2013, French hacker Eloi Vanderbeken decided to see if he could break into his own Netgear router.

He wanted to tweak some of the performance settings, but realised he'd forgotten the password, and hacking his way in seemed more fun that doing a hardware reset and starting from scratch.

Long story short, Vanderbeken found his way in.

Turns out there was a service listening on port 32764 (mercifully only on the internal interface by default, not on the internet side!) that could be instructed, without authentication, to dump the router's configution.

Including the admin username and password.

All he had to do was to send the text ScMM (short for SerComm, the original equipment manufacturer), followed by a command number (1 to dump the configuration), followed by the number zero (meaning "I have no further data to send").

Even if a backdoor like this is only accessible to users who are already on your network, it's still a giant security hole.

It means, for example, that any duplicitous guests to whom you grant internet access can surreptitiously get into your router and mess with the settings, including opening up the backdoor on the internet interface so they can get back in later.

The vendor therefore came out with a patch, closing the listening port and with it the backdoor.

That got Mr Vanderbreken thinking, "How serious was the patch?"

After all, if the original purpose of the backdoor was to make it easier for the vendor's own management software to interact with the router, a patch that closed the backdoor altogether would necessitate wholesale changes to the management software, too.

Another long story short, Vanderbeken found that the backdoor was still there [PDF], just turned off by default.

He discovered that you could re-renable it by sending the router a so-called "magic ethernet packet."

? If you've ever used a feature called Wake-on-LAN, you've used a "magic packet": it's an ethernet frame that acts as a signal, rather than carrying data, telling a network card to power up the computer in which it's installed. Wake-on-LAN can be very handy. You can leave your computers turned off at night to save power, and rely on the network card alone to let you activate the computer remotely if required, for example to install security updates.

Greatly simplified, Ethernet frames start with the six-byte MAC address (network card ID) of the destination device; the MAC address of the source device; and a two-byte type EtherType identifier.

Example EtherTypes are 0800 for an IPv4 packet, 86DD for an IPv6 packet, 0806 for ARP (address resolution protocol), and 0842 for Wake-on-LAN.

Sercomm routers, or at least Vanderbeken's Sercomm router, also look out for 8888 "magic packets", which act as another backdoor.

Vanderbeken found that if he sent his router an 8888-type packet containing the number 0x0201 (effectively a command identifier) and the MD5 checksum of the string DGN1000, corresponding to his router's model number, then...

...the original backdoor listening on port 32764 was reactivated!

Just in case you don't know if there are any vulnerable routers on the current LAN segment, Vanderbeken also found that sending a broadcast 8888 packet with command number 0x0200 would provoke the router to reply, allowing a would-be attacker on a LAN to find out automatically if there are any exploitable routers in range.

Short of decompiling your router's firmware, like Vanderbeken did, it's hard to tell whether your vendor has left behind a security hole of this sort.

Even if you think your router has this very same "magic packet" hole, you can never be sure exactly what model identifier string is used in the firmware to generate the MD5 checksum used to validate the magic packets.

So we'll simply repeat the advice we gave last time.

If you're technically inclined, or have a friend or family member who is and can help you, you might want to see if your router can run an open source firmware such as OpenWRT or DD-WRT.

Those are Linux-based firmware builds for low-end routers that are much more modular than most of the firmware downloads from router vendors, meaning that you can leave out the bits you don't need.

They also receive regular security patches, thanks to the care and attention of the developer communities that have sprung up around them.

And if you are ready to go a bit more high-end than a SoHo router, you might want to grab a copy of Sophos's award-winning UTM product, which you can run entirely for free at home.

Follow @duckblog

Image of open doors courtesy of Shutterstock.

View the original article here

US Department of Labor website hacked, serves malware, now fixed

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

You may have read about the US Department of Labor "getting hacked".

It's true, but fortunately the story is not quite as gory as it sounds in those two fateful words.

A subdomain of the Department's main website, running off a separate server - what's known colloquially as a microsite - was modified to serve up malware.

There's a sort of double irony here, because news about the breach broke on May Day, which is Labour Day in much of the world, though not in the United States, where it is celebrated in September.

The affected microsite was www.sem.dol.gov, which is currently (2013-05-02T10:22Z) offline.

SEM stands for Site Exposure Matrices, but the "site" in the name refers not to websites but to worksites.

The SEM "is a repository of information on toxic substances present at Department of Energy sites and other locations where radiation exposure is a possible hazard.

We've already seen speculation that the radiation-related nature of the SEM site tells us that this is a targeted attack, and certainly the site is not one you would expect to draw a lot of traffic.

On the other hand, of course, it might just be that the site was attacked because it was vulnerable while other parts of the Department of Labor site were not.

? Many organisations use microsites for special purposes, such as conducting one-off marketing campaigns or, as in this case, for presenting specialised data. Often, this is to avoid bothering the IT team with change requests for the main website, or in order to try something new. If you use microsites this way, make sure you don't take any security shortcuts while you are "innovating".

The attack used a malicious JavaScript file to get your browser to download a file called bookmark.png.

This sounds like an image file, but is in fact a Windows program with the first byte altered so that it can't run by itself.

In theory, your browser shouldn't do anything more than simply, and harmlessly, download the offending file.

But the malicious JavaScript then uses the function called helo() in the script above in an effort to trigger the CVE-2012-4792 remote code execution vulnerability in Internet Explorer.

The attackers hope that this will trick your browser into jumping over its security checks to modify and run the downloaded malware program without asking you.

The exploit seems to have borrowed both code and concept from a publicly-available Metasploit module that gives more detail (perhaps a little too much for some readers' comfort) about this exploit.

The good news is that if you've patched Windows recently, or if you are using Internet Explorer 9 or 10, you should be safe, since the vulnerability will be fixed, the exploit won't work and the non-functional bookmark.png file will do you no harm.

? Sophos security products block the drive-by-download exploit script as Troj/ExpJS-IT and the "payload" executable as Troj/Agent-ABOB.

The attack also uses a malicious script file that includes what are known as anti-anti-virus techniques.

This means that the attacker actively attempts to evade detection by interfering with the operation of one or more of the anti-virus tools you may be running.

If you're using BitDefender, the script even tries to connect to the local web console to reconfigure the product on your behalf.

? Sophos security products block this malicious script as Troj/ExpJS-IV.

To summarise:

A patched version of Windows should be immune to the exploit used in this attack.Internet Explorer later than version 8 should be immune.The hacked site is off the air and unlikely to reappear until it is clean and safe.An up-to-date anti-virus ought to block the malicious files, even on an unpatched computer.

Oh, and one more thing.

If you use microsites for special-purpose content, take care to avoid introducing special purpose risks at the same time!

Follow @duckblog

View the original article here

Apple password reset website - gaping hole found, fixed

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Apple has had a good-bad-good-bad week of it in the computer security environment.

Cupertino released iOS 6.1.3, a modestly-sized update (at least by modern standards) of 18MByte that promised to fix a lock screen bypass bug.

Admittedly, that bug didn't give a crook access to your whole phone or to all its data, and you had to make a phoney emergency (911) call during the exploit.

But a lock screen is supposed to be a lock screen, and so Apple did well to publish an over-the-air update, patching this and other holes, in just over a month.

It soon went pear-shaped for Apple, though, with iOS thorn-in-the-side hacker "videosdebarraquito" quickly devising a wheeze to bypass the 6.1.3 lock screen.

Once again, the attack requires a fair amount of fiddling, including popping out the SIM card; only gives access to the phone itself and your photo gallery; and won't work if you turn voice dialling off.

But a lock screen is supposed to be a lock screen, especially if it's the lock screen of an update that was shipped to patch a flaw in the lock screen.

Think that was a problem?

Then you might want to feel sorry for Apple, which faced even bigger woes on the authentication front this week.

Seven months ago, Apple faced a huge blast of negative publicity when a journalist lost his fruit-flavoured digital life after an attacker tricked Apple's support staff into handing over his Apple ID password.

So, to widespread approval, including from Naked Security, Apple this week announced the introduction of a two-step verification feature for Apple ID logins.

You login as usual, then Apple SMSes you a one-time magic code which you need to type in to complete the authentication process.

Not perfect, and nowhere near as good as a standalone access token like your bank might have given you, but a definite step forward.

But then came news that Apple's password recovery, at least for those who haven't turned on, or don't want to or can't turn on, two-step verification, was deeply flawed.

For flawed, read, "Broken."

Apparently, all you had to do was to know was your victim's email address and date of birth, and to paste a specially-formed URL into one of the fields on Apple's official password recovery site (the inanely-named "iForgot").

By doing so, you could jump over the security-related part of the reset process and score a password stealer's hole-in-one.

? Why anyone's date of birth should be considered a secret suitable for security purposes beggars belief. By definition, at least in the developed world, your birthday can't be a true secret, since the law requires it to be registered officially (in plaintext, no less) within a short time of your birth. Furthermore, society actively encourages you celebrate it at least semi-publicly every year, a situation that is incommensurate with secrecy.

Whether this exploit relied on cross-site scripting (where a URL for an unofficial site is accidentally processed in the security context of a legitimate site), or command injection (where a database lookup is mistakenly processed as a command), is not clear.

Whatever the cause, Apple quickly took the iForgot page down and then brought it back up, apparently after closing the hole.

Turning on the new and much-vaunted two-step verification would have neutralised the attack, but sadly the Apple two-step isn't yet available worldwide.

It's only officially supported in the US, the UK, Ireland, Australia and New Zealand, and even in the UK, many users (including Naked Security's own Graham Cluley) say that aren't able to turn it on yet anyway.

It's a pity that Apple announced its new security feature as though it were ready when clearly it was not.

Marketing allows for a bit of puffery, and the software industry has long relied on "pre-announcements" (less politely known as vapourware) to promote products that aren't quite ready yet.

But let's all agree to go easy on the vapourware-style pronouncements on security issues.

Don't invite people to adopt new security features unless they really are ready and working precisely as claimed.

After all, it's the early adopters in security who are your best shot at getting the rest of the world to change for the better, too...

Follow @duckblog

PS. If you can turn on two-step verification, I recommended that you do, especially if you have any purchases or data tied up in iTunes, the App Store or iCloud. Two-step verification raises the bar for the crooks.

View the original article here