cool article - I do think the easy fix is port forwarding?
TCP backdoor 32764 – how we could patch the Internet (or part of it)
11–20 of 22 posts
Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)
#12I guess this is yet another reason not to rely on firewalls and outdated notions of "internal" and "external" networks for any kind of real security. Increasingly, it seems that firewalls are doing less to improve actual security, while continuing to hinder legitimate network connectivity and the deployment of new protocols.
I think you're conflating firewalls and NAT. The idea of "internal" and "external" networks still apply in a non-NAT environment but what takes some getting used to is that with full end-to-end connectivity, you're back to an implicit "default-allow" policy where NAT created an implicit "default deny". The answer is to have a default deny firewall rule on your border router (your home gateway appliance), and then allow services as needed.
Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)
#13Earlier quoted context omitted.
Yeah, I tried but with my external IP: $ telnet [redacted] 32764 Trying [redacted]... telnet: connect to address [redacted]: Connection refused telnet: Unable to connect to remote host Does this mean my router has no backdoor? Is it clever enough to avoid detection?
Are you running one of the affected hardware models?
No, but I have a fairly uncommon router (not ISP supplied) so I was curious if it also had a backdoor. It doesn't respond on LAN so it seems my DrayTek Vigor 2750N is backdoor-free for now...
Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)
#14I'm disappointed that this wasn't taken to its logical conclusion: use the backdoor to remote-patch affected routers.
Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)
#15Reminds me of the backdoor in D-Links routers: http://www.devttys0.com/2013/10/from-china-with-love/
Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)
#16Earlier quoted context omitted.
Are you running one of the affected hardware models?
No, but I have a fairly uncommon router (not ISP supplied) so I was curious if it also had a backdoor. It doesn't respond on LAN so it seems my DrayTek Vigor 2750N is backdoor-free for now...
That just means it's free of this particular backdoor.
Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)
#17I guess this is yet another reason not to rely on firewalls and outdated notions of "internal" and "external" networks for any kind of real security. Increasingly, it seems that firewalls are doing less to improve actual security, while continuing to hinder legitimate network connectivity and the deployment of new protocols.
I think you're conflating firewalls and NAT. The idea of "internal" and "external" networks still apply in a non-NAT environment but what takes some getting used to is that with full end-to-end connectivity, you're back to an implicit "default-allow" policy where NAT created an implicit "default deny". The answer is to have a default deny firewall rule on your border router (your home gateway appliance), and then all…
Everything he said applies to a typical legacy corporate network that has a centralised default-deny firewall on front of it (but no NAT).
Host-based firewalls are much more flexible and have many security advanteges.
Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)
#18I'm disappointed that this wasn't taken to its logical conclusion: use the backdoor to remote-patch affected routers.
Jail is fun!
Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)
#19Earlier quoted context omitted.
No, but I have a fairly uncommon router (not ISP supplied) so I was curious if it also had a backdoor. It doesn't respond on LAN so it seems my DrayTek Vigor 2750N is backdoor-free for now...
That just means it's free of this particular backdoor.
Hence "for now...". A new backdoor could surface tomorrow.
Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)
#20Can we use the exploit to actually apply this patch?