Gateway For Hackers

The device that connects us to the Internet is dangerously vulnerable, security experts say. And while there are some signs of impending improvements, not much has happened in the past several years, while the threats have grown

It is generally accepted in IT that the weakest link in the security chain is the fallible and frequently careless human.

But a close second, many experts say, is the router – the device that connects people to the Web, sometimes called “the backbone of the Internet”, which is dangerously vulnerable to skilled hackers.

Those experts have been issuing alarms for some time, but they say that, so far, things have not changed much. Dan Geer, chief information security officer at the venture capital firm In-Q-Tel and an adviser to US intelligence agencies, speaking to a conference in Cambridge, Mass., more than a year ago, said most routers are almost comically insecure, given that they have, “drivers and operating systems amounting to snapshots of the state of Linux, plus the lowest-end commodity chips extant at the time of the router’s design.”

The only way to fix the problem, he said, would be to, “unplug all the devices, throw them in the dumpster and install all new ones.” Even that wouldn’t fix it either, because the new ones are, “likely to have the same vulnerability spectrum that made this possible in the first place,” he said.

Jim Gettys, a systems architect, said last year that he had inventoried the age of the packages inside a number of routers, “and they are three to four years old on Day One. And without an update stream, you start with existing vulnerabilities, and it just gets worse from there.”

Bruce Schneier, encryption guru and CTO at Resilient Systems, wrote more than a year ago in a blog post that, “the computers in our routers and modems are much more powerful than the PCs of the mid-1990s,” and warned that if security vulnerabilities in them are not fixed soon, “we're in for a security disaster, as hackers figure out that it's easier to hack routers than computers.”

Such security holes can allow hackers to access files, install malware on a network or use a victim’s security cameras to spy on him, without needing access to the computer hardware.
In a more recent interview with Network World this past April, Schneier said basically the same thing Geer had said a year earlier: “Do you know the way you patch your home router? You throw it away and buy a new one. And that is going to be a freakin' disaster … Low cost, binary blobs, no one knows how they work, there's no one to update them, lots of vulnerabilities, and we're just stuck with it.”
And even if updates are available, they are too difficult to install for the average user, said Lawrence Munro, director at Trustwave.
“The key issue is that upgrading is almost always a manual process that is likely beyond the skill level of a home-user,” he said, “and patches aren’t available quickly in many cases.”
“The key issue is that upgrading is almost always a manual process that is likely beyond the skill level of a home-user.”
Indeed, last December, US-CERT, part of the Department of Homeland Security, warned broadband router manufacturers about a vulnerability called “Misfortune Cookie” that been patched more than 10 years ago, but was still present on many deployed devices.

Researchers at Check Point’s malware and vulnerability group, who came up with the name, noted that, “if your gateway device is vulnerable, then any device connected to your network – including computers, phones, tablets, printers, security cameras, refrigerators, toasters or any other networked device in your home or office network – may have increased risk of compromise.”

Mark Stanislav, senior security consultant at Rapid7, noted this week that in a contest at last year’s Def Con, hackers were able to demonstrate 15 zero-day vulnerabilities in more than a half-dozen of the most common Small Office/Home Office (SOHO) routers, including models from Asus, Netgear, DLink, Belkin, Linksys, Actiontec and Trendnet.
Not surprisingly, the contest was titled, “SOHOpelessly Broken.”
If it really is this bad, however, it would seem there would be more stories about disastrous takeovers of networks. Yet while mainstream media regularly report on major hacks, there are few, if any, headlines about router compromises.
“(Automatic firmware updates) can create new problems, especially if the user is unaware of the firmware being updated.”
That, Stanislav said, is probably in part because the average consumer may not even know what a router is. And, “the impact to an individual or their home network isn't necessarily easy to determine without a very specific review of how their device was configured, what vendor it's from, and what firmware it's running,” he said.
“It’s a much more layered and nuanced story than, ‘Company X was hacked, your data is now a risk.’”
Robert Siciliano, online safety expert for Intel Security, agreed. “If the flaw is too complicated for mass media to break down for the general public, they avoid discussing it,” he said.
Munro agreed, but said it is also because the media don’t find it that exciting – at least yet. Remotely hacking a car and causing it to crash catches public attention much more than explaining how a router is vulnerable.
Gettys said he thinks it is because, “it hasn't yet hurt in the pocket book at sufficient scale in the US,” but warns that the hurt is coming.
“People have not realized just how insecure these devices are, or what mischief this can cause for the customers and others – they are being increasingly used as part of botnets to attack others,” he said.
“People have not realized just how insecure these devices are, or what mischief this can cause for the customers and others.”

If there is any promising news to report, it is that there seems to be a growing awareness among developers and manufacturers that there is a problem.
“IoT (Internet of Things) devices in general are starting to focus more on easy firmware updates – automated processes that don't require user intervention, and overall longevity of hardware updates,” Stanislav said.
“This will, ideally, trickle down into the SOHO router market eventually. As design patterns and technical challenges are overcome, disseminating updates quickly will become easier for manufacturers.”
Gettys said he is hearing behind the scenes that there may be some improvements, “in not-yet-announced products; but I leave that to the manufacturers and service providers announcements to come.
“But even with these glimmers of hope, I'm discouraged, as the economic foundation of the problem has not changed,” he said, adding that changes in the law making the manufacturers of routers liable for security breaches is the only solution.

“The idea that someone can ship a product and not have any liability for even basic maintenance and upgrade of the software it contains for its expected lifetime must change,” he said. Without it, “new entrants who do a better job won't see a reward, and will have higher costs”
Stanislav said he has seen some vendors, “take a more cloud-based approach, where updates are an ongoing process that require less user intervention. But that can create new problems, especially if the user is unaware of the firmware being updated.
“We saw some outrage in 2012 for this type of auto-upgraded firmware from Linksys. This is a balancing act that vendors are still figuring out how to weigh,” he said.
Until major improvements occur, experts collectively recommend a number of steps consumers can take that won’t solve the problem entirely, but will make them less of a target than the average user:
•    Change the default password to one that is unique, long and complex.
•    If it is impossible to upgrade your router, buy a new one that does allow it. According to Munro, “the open-source community has offered alternatives for users by creating projects such as OpenWRT and Tomato, which provide open-source firmware to replace the vendor’s on common hardware platforms.” But, implementing them, “requires a reasonable level of IT skill,” he said.
•    Make sure that uPnP (Universal Plug and Play) is off.
•    Read the manual, and turn off or disable other features you may not need.
•    If your Internet service provider offers a combined router/modem, this could pass some of the responsibility for hardware updates onto it.
If you have the expertise, install OpenWRT. “But that’s not something grandma and grandpa will be capable of,” Gettys said.

CSO Online

 

« Has The US Become Complacent About Resisting Cyber Attacks?
Cyber War Pre-emption Is The Key to Defense »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

AusCERT

AusCERT

AusCERT is the premier Computer Emergency Response Team (CERT) in Australia and a leading CERT in the Asia/Pacific region

Parasoft

Parasoft

Parasoft is an independent software testing and software quality assurance tool and solution vendor.

Exonar

Exonar

We enable organisations to better organise their information, removing risk and making it more productive and secure.

Dracoon

Dracoon

DRACOON is market leader in the German-speaking region for secure enterprise file sharing.

National Cybersecurity Preparedness Consortium (NCPC) - USA

National Cybersecurity Preparedness Consortium (NCPC) - USA

The mission of the NCPC is to provide research-based, cybersecurity-related training, exercises and technical assistance to local jurisdictions, counties, states and the private sector.

CYRail

CYRail

CYRail project will analyse threats targeting Railway infrastructures and develop innovative attack detection and alerting techniques.

Resistant AI

Resistant AI

Resistant AI protects against evolving online fraud. We connect the dots to provide a new layer of trust and performance for our clients’ systems.

Moviri

Moviri

Moviri combines security technology engineering, intelligence expertise and our data science DNA to help companies manage digital risk end-to-end.

Lancera

Lancera

Lancera provides growth accelerating Software Development, Web Presence and Cybersecurity Solutions with a focus on customer happiness.

Advantex Network Solutions

Advantex Network Solutions

Advantex Network Solutions are a leading provider in Mitel, IT Solutions, Networking, and iP surveillance.

Zuul IoT

Zuul IoT

Zuul take an asset-centric approach to OT security, enabling security teams to protect the critical IIoT/IoT devices that are at the foundation of critical business functions.

Port443

Port443

Port443 specialises in providing Security Orchestration, Automation and Remediation (SOAR) "as a service".

Solcon Capital

Solcon Capital

Solcon Capital is a forward-looking, technology-focused investment firm that is committed to identifying and investing in the most promising areas of innovation and development in the tech industry.

Radix Technologies

Radix Technologies

Radix offer end-to-end device management solutions, consolidating all the organization devices, processes and stakeholders into one easy-to-use management platform.

The Hacking Games

The Hacking Games

The Hacking Games' Mission is to inspire, educate and mobilise a generation of ethical hackers to make the world a safer place.

CoNetrix

CoNetrix

CoNetrix is a full service computer networking, software development, and security and compliance firm built on the principles of integrity, innovation, and initiative.