Wireless Router Backdoor Identified

[thesugarat]

Arstechnica.com

By: Sean Gallagher

A Hacker has found a Backdoor to wireless combination router/DSL modems that could allow an attacker to reset the router’s configuration and gain access to the administrative control panel. The attack, confirmed to work on several Linksys and Netgear DSL modems, exploits an open port accessible over the wireless local network.

The Backdoor requires that the attacker be on the local network, so this isn’t something that could be used to remotely attack DSL users. However, it could be used to commandeer a wireless access point and allow an attacker to get unfettered access to local network resources.

Eloi Vanderbeken described the Backdoor in a PowerPoint posted with the code to Github. In his illustrated report, he explained how over the Christmas holiday he was trying to get access to the administrative console of his family’s Linksys WAG200G wireless DSL gateway wirelessly—mostly so he could limit how much bandwidth the others in the house were using. But Vanderbeken had previously turned off wireless access to the administration web console (and had forgotten his administrative password).

Performing a scan, he found that the router responded to messages over an unusual TCP port number: 32764. A search of the web found other Linksys and Netgear router owers had found the same service, but there was no documentation for what it did.

So Vanderbecken downloaded a copy of the Linksys firmware and commenced reverse-engineering the binary MIPS code. What he found was a simple interface that allowed him to send commands to the router without being authenticated as the administrator. On his first attempt to brute-force the interface, the router flipped its configuration back to factory settings, causing his family members to all lose Internet access at the same time.

After some additional testing, Vanderbecken found that the interface allowed him to execute a number of commands directly against the router, including a command-line shell. Using the commands he discovered, he was able to write a script that allowed him to turn wireless access to administration on and reset the web password, and published the script (with his cartoon report on the Backdoor) to Github.

Soon, confirmations that the Backdoor worked with other models of Linksys and Netgear wireless DSL modems came flooding in. A commenter on Hacker News noted that the Backdoor might effect wireless routers with DSL modems from SerComm, which manufactured many of Linksys’ older DSL modems. A list of SerComm devices from various vendors matches up with the router-modems reported as vulnerable thus far.

http://nakedsecurity.sophos.com/2014/01/03/gaping-admin-access-holes-found-in-soho-routers-from-linksys-netgear-and-others/

[Foxtrot]

What has this to do with the Mark V ? :x

[thesugarat]

Really? You have no sense of imgaination as to what that vulnerability could possibly be used for with regards to not just a Pineapple user but to anyone with Kali and an Alfa???

Have a Mark 5 or whatever. Use Reaver/Bully/Wifite/WPA2 Rainbow tables/whatever to gain access to a WiFi router. Once inside the network you begin to assess the vulnerabilites of the network (nmap infusion) to include scanning the router you just came in on. If the router has a good username and password you can't get in to the managment page. But, if it's vulnerable to that security flaw you run a simple script aimed at port 32764 and it will turn on remote management over WiFi and set the password to a value you choose. Then you have managment access to the router and can do what you like to the settings.

I suppose you were simply pointing out the obvious that this isn't directly related to, or even currently a feature in, the Mark 5. But I'm pointing out that it could be if someone did some digging and determined the method was compatible.

[Foxtrot]

You didn't mention anything. You just copied/pasted stuff into the box lol :D

But yeah, that could be pretty fun to mess with, I checked my router wasn't vulnerable, win!

[thesugarat]

Yeah I could have put a summary at the top pointing out what I thought it would be good for but I had just read it and didn't think about it... :)