The SoHo router backdoor that was “fixed” by hiding it behind another backdoor

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Over the Christmas break at the end of 2013, French hacker Eloi Vanderbeken decided to see if he could break into his own Netgear router.

He wanted to tweak some of the performance settings, but realised he'd forgotten the password, and hacking his way in seemed more fun that doing a hardware reset and starting from scratch.

Long story short, Vanderbeken found his way in.

Turns out there was a service listening on port 32764 (mercifully only on the internal interface by default, not on the internet side!) that could be instructed, without authentication, to dump the router's configution.

Including the admin username and password.

All he had to do was to send the text ScMM (short for SerComm, the original equipment manufacturer), followed by a command number (1 to dump the configuration), followed by the number zero (meaning "I have no further data to send").

Even if a backdoor like this is only accessible to users who are already on your network, it's still a giant security hole.

It means, for example, that any duplicitous guests to whom you grant internet access can surreptitiously get into your router and mess with the settings, including opening up the backdoor on the internet interface so they can get back in later.

The vendor therefore came out with a patch, closing the listening port and with it the backdoor.

That got Mr Vanderbreken thinking, "How serious was the patch?"

After all, if the original purpose of the backdoor was to make it easier for the vendor's own management software to interact with the router, a patch that closed the backdoor altogether would necessitate wholesale changes to the management software, too.

Another long story short, Vanderbeken found that the backdoor was still there [PDF], just turned off by default.

He discovered that you could re-renable it by sending the router a so-called "magic ethernet packet."

? If you've ever used a feature called Wake-on-LAN, you've used a "magic packet": it's an ethernet frame that acts as a signal, rather than carrying data, telling a network card to power up the computer in which it's installed. Wake-on-LAN can be very handy. You can leave your computers turned off at night to save power, and rely on the network card alone to let you activate the computer remotely if required, for example to install security updates.

Greatly simplified, Ethernet frames start with the six-byte MAC address (network card ID) of the destination device; the MAC address of the source device; and a two-byte type EtherType identifier.

Example EtherTypes are 0800 for an IPv4 packet, 86DD for an IPv6 packet, 0806 for ARP (address resolution protocol), and 0842 for Wake-on-LAN.

Sercomm routers, or at least Vanderbeken's Sercomm router, also look out for 8888 "magic packets", which act as another backdoor.

Vanderbeken found that if he sent his router an 8888-type packet containing the number 0x0201 (effectively a command identifier) and the MD5 checksum of the string DGN1000, corresponding to his router's model number, then...

...the original backdoor listening on port 32764 was reactivated!

Just in case you don't know if there are any vulnerable routers on the current LAN segment, Vanderbeken also found that sending a broadcast 8888 packet with command number 0x0200 would provoke the router to reply, allowing a would-be attacker on a LAN to find out automatically if there are any exploitable routers in range.

Short of decompiling your router's firmware, like Vanderbeken did, it's hard to tell whether your vendor has left behind a security hole of this sort.

Even if you think your router has this very same "magic packet" hole, you can never be sure exactly what model identifier string is used in the firmware to generate the MD5 checksum used to validate the magic packets.

So we'll simply repeat the advice we gave last time.

If you're technically inclined, or have a friend or family member who is and can help you, you might want to see if your router can run an open source firmware such as OpenWRT or DD-WRT.

Those are Linux-based firmware builds for low-end routers that are much more modular than most of the firmware downloads from router vendors, meaning that you can leave out the bits you don't need.

They also receive regular security patches, thanks to the care and attention of the developer communities that have sprung up around them.

And if you are ready to go a bit more high-end than a SoHo router, you might want to grab a copy of Sophos's award-winning UTM product, which you can run entirely for free at home.

Follow @duckblog

Image of open doors courtesy of Shutterstock.

View the original article here

Anatomy of an exploit - Linksys router remote password change hole

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A security researcher from San Jose in California has published a how-to guide detailing a number of vulnerabilities in various Linksys routers.

Phil Purviance, who goes by the handle of SUPER.EVR (EVR stands for Exploitation Vulnerability Research), reported the holes privately on 05 March 2013:

Hello Cisco PSIRT, I would like to report several vulnerabilities in Linksys network equipment. A public advisory regarding these issues may be released 30 days after sending this report.

And Purviance certainly lived up to his threat, publicly releasing the gory details on 05 April 2013 on his blog.

I don't want to get sidetracked into a discussion about the disclosure process here - whether 30 days was long enough, whether it was fair to expect a reply after emailing Cisco, which no longer owns the Linksys brand, or whether explicitly documenting the holes was wise.

You'll have to make your own mind up on those issues, because the purpose of this article to zoom in on one of the holes to see what we can learn from it.

The vulnerability we'll be looking at is:

Linksys EA2700 Password Change Insufficient Authentication and CSRF Vulnerability

Imagine that you are trying to penetrate a network inside a building that is monitored by security guards, offers no remote computer access, and is surrounded by an electric fence and motion detectors.

You're not going to get inside, but now imagine yourself holding up a placard outside one of the office windows saying, "Kindly enable remote login on port 5128 and change the password to b4nana," and waiting a while.

Imagine if it worked!

That's a simile for one of the bugs that Purviance found.

It gets the tag CSRF, for Cross Site Request Forgery, because it lets you embed, in an external web page (that's the placard outside the window), a URL that refers to a configuration script that will run on your router (that's the list of instructions on the placard).

So the Cross Site Request isn't a demand from an angry web server, but rather a web page that deliberately takes you to site B via site A.

In this case, visiting an otherwise innocent-looking external site can cause your browser to initiate internal actions on your router.

And if the router assumes that you are authorised simply on the basis that you are issuing the request from inside the network, an external attacker can easily use you as his "inside proxy" to violate security.

The unprotected configuration page found by Purviance permitted just the sort of silent reconfiguration jokingly shown on our placard: enabling external router admin (something you should never be tempted to do by choice), changing the password, and more.

So much for the metaphorical electric fence, the security guards and the motion detectors.

Of course, for this attack to work, the criminal needs to know what internal URL to embed in his external web page, which means he needs to know the internal name or IP number of your router:

That's so that when your browser processes the dodgy URL, the malicious reconfiguration request goes to the right web page on the right router, and produces the right HTTP request, as in the example above.

In Purviance's example, as above, he chose 192.168.1.1, which is a good guess for many networks.

? Private IP address ranges for your home or business network run from 10.0.0.0 to 10.255.255.255, from 172.16.0.0 to 172.31.255.255, and from 192.168.0.0 to 192.168.255.255. Advocates of security through obscurity suggest choosing randomly from the available private spaces, and as long as you don't rely on this as a security measure in its own right, you might as well do just that.

By the way, the problem of internal command-and-control URLs embedded into external websites (the Cross Site Request part) is why many web services require you to enter your password again to authorise key operations, even if you are already logged in.

That not only does prevents curious (or malevolent) colleagues from making long-term changes to your configuration if you inadvertently leave your screen unlocked, but also makes attempted alterations caused by CSRF more obvious.

Requiring re-authentication not only makes the CSRF fail, but also draws your attention to the attempt because an unexpected password dialog pops up.

So, the lessons to learn from this bug are:

Don't gripe at websites that ask for your credentials again when performing configuration or security-related tasks. The inconvenience is a small price to pay for the additional safety.Keep your eye open for firmware updates for your routers and other network hardware. Security patches don't just apply to desktop operating systems and applications.When writing web services that are worth password-protecting, don't just protect access to the URL of the relevant starting page. Make sure that the individual URLs that accept and process commands (whether by GET or POST requests) are all authenticated, too.Logout from web services when you aren't using them. Don't needlessly leave yourself in the position that accidental or unexpected clicks can have unintended side-effects.

? Yes, the last point above includes logging out routinely from Facebook, Twitter and your webmail, too. It's much more convenient to stay logged in all day, but much less safe, and very much less secure.

As for closing this hole if you have a Linksys EA2700 router, Dan Goodin of Ars Technica reports that:

A statement issued by officials from Belkin, which recently acquired the Linksys brand, said the vulnerabilities documented by Purviance had been fixed in the Linksys Smart Wi-Fi Firmware that was released in June.

And according to Linksys, the June 2012 firmware release was itself superseded in July, October and November last year:

Purviance didn't make it clear, in his vulnerability disclosure, which firmware version he used during his research.

But if you aren't on the latest firmware version, you probably ought to grab it anyway.

After all, this isn't the first time we've written about vulnerabilities in, and the external misuse of, SoHo routers.

And if you're really keen, you can use the hacking-by-numbers tool Metasploit to do a penetration test against your own router, as exploit modules for Purviance's holes are already available online.

Follow @duckblog

View the original article here