Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

threatpost.com

Post reply on HN
Print view View original

151–160 of 306 posts

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#151

Post by peeters »

jjeaff wrote: post #137
spartas wrote: post #118

Earlier quoted context omitted.

>Of course, in reality, this CVE seems almost un-exploitable in the wild, anyway. How will an exploiter get to the login page in the first place? They'd have to know your network password and be in your physical vicinity, or your ISP would have to send traffic to your router's login page from the Internet. Nope. Not at all. Most router attacks these days are malicious JavaScript (like in ads and trackers) that send H…

Would this not also require some sort of exploitable CORS vulnerability?

Depends on the attack and the vulnerability. The article does say this:

> The attacks work when routers use weak administrative passwords and are vulnerable to CSRF attacks.

Which implies that a cross site request is being made. So e.g. you put a hidden form in a netf1ix.com page whose action is at some URL on the router. The user ends up accidentally posting data to that URL which is not affected by CORS and same-origin.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#152

Post by chooseaname »

ghaff wrote: post #62
jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

I daresay people aren't going to like this answer but, you ultimately have to align the interests of the manufacturers and the consumers. Which probably means some sort of subscription model and even a requirement that the subscription be current to function. I know. Yuck. But the only other real possibility is to legislate that such updates be made available for N years as part of the purchase conditions.

Or increase the initial price enough to cover the N years it is expected to be in service. If you make a 5 year router, charge for that. If you make a 10 year router, charge for that. But don't charge for a 5 year router and drop it after 2.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#153

Post by abawany »

djsumdog wrote: post #143
hackbinary wrote: post #13

Earlier quoted context omitted.

What do you expect from companies that sell kit at $50/£50/€50? You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Then again, I buy stuff that can be flashed with OpenWRT ...

Kits are different. Every router kit I've seen doesn't come with any software. Some come with a blank SD card and you can load what you want on it. Here's a tutorial I wrote for one kit I got: https://battlepenguin.com/tech/using-the-banana-pi-bpi-r1-as... but then I learned the hardware itself could fail into an insecure state, and there was no way to deal with it in software: https://battlepenguin.com/tech/banana-p…

I wonder if the GP meant 'kit' as in the UK-English sense, i.e. equipment and not the literal kit with no software.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#154

Post by nly »

LinuxBender wrote: post #104
nly wrote: post #7

It's times like this i'm glad my home router is a x86 mini PC running Arch Linux + iptables + Unifi (Complete with DNS MITM forcing all DNS out of my apartment over TLS)

I do something similar. Fanless PC (but I do have a heppa filter pointed at it for hot days) running CentOS 7 and El-Repo 5.2.x kernel. I enable power management on everything except for the network cards and disable most other devices on it. On UPS it can run about 3 hours. I have unbound DNS and iptables to intercept all DNS requests destin for the internet, so I can block some ads. I null route the DoH servers and…

>I have unbound DNS and iptables to intercept all DNS requests destin for the internet

dnsmasq (caching) + stubby for me

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#155

Post by penagwin »

lone_haxx0r wrote: post #131
paggle wrote: post #99

Earlier quoted context omitted.

Would you also say that Uber doesn't violate taxi laws or AirBNB doesn't violate zoning laws, and it's just the Uber drivers and AirBNB hosts who are using the products to violate the law? What's your responsibility when you hand someone a loaded gun and it goes off?

> What's your responsibility when you hand someone a loaded gun and it goes off? Zero, as long as the person: (1) Knew it was loaded (2) Voluntarily accepted to receive the gun.

> Zero, as long as the person:

In this analogy the gun going off broke a law. So you voluntarily handed somebody a loaded gun - who then committed a crime with that gun.

Obviously context matter - but you can bet the police will be asking why you gave that gun to them.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#156

Post by chopin »

jjeaff wrote: post #137
spartas wrote: post #118

Earlier quoted context omitted.

>Of course, in reality, this CVE seems almost un-exploitable in the wild, anyway. How will an exploiter get to the login page in the first place? They'd have to know your network password and be in your physical vicinity, or your ISP would have to send traffic to your router's login page from the Internet. Nope. Not at all. Most router attacks these days are malicious JavaScript (like in ads and trackers) that send H…

Would this not also require some sort of exploitable CORS vulnerability?

CORS prevents the JS from seeing the result but it doesn't prevent the sending of the request.

This is one of the reasons my internal network is not 192.168.1.1/24 and the router is not 192.168.1.1.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#157

Post by triangleman »

Correct me if I'm wrong, but in order to perform this attack you need to be connected to the router's LAN in order to access the admin page, right? So you would need to gain access to the WiFi or attach a computer to the router via Ethernet. This cannot be exploited over the internet, unless perhaps the user enables the admin page via WAN.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#159

Post by abawany »

msla wrote: post #23
giancarlostoro wrote: post #17

Earlier quoted context omitted.

There's also just you know, installing Custom Firmware if you're determined enough.

I'll never use vendor firmware again. If the router doesn't support OpenWRT, it's a time bomb waiting to go off, as this article shows; plus, of course, OpenWRT has sufficient additional functionality that that alone makes it worthwhile. And once again, we're all reminded of the divide between people who know how to do things like this and people who don't, and how the people who do know have an advantage in life.

I bought a couple of Netgear AC1600 routers and installed DD-WRT/Kong firmware on them right away (clicked the PayPal contribution link and paid up - it is worth it). They work well and update quite frequently.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#160

Post by [deleted] »

iforgotpassword wrote: post #100
eloff wrote: post #95

I'll think twice before buying D-link again. They've just tarnished their brand irrevocably for me, even though my router is not affected - I had to turn it over and compare version numbers to be certain, and I don't want to have to track exploits and check version numbers to have peace of mind. What manufacturer can I buy next time with a good security record?

One where you can wipe the original firmware and install OpenWRT.

[deleted]
Post reply on HN