Backdoor in the TP-Link routers

http://sekurak.pl/tp-link-httptftp-backdoor/

by conductor • 13 years ago

89 25 13 years ago

conductor• 13 years ago

Related (root shell with hardcoded credentials): http://websec.ca/advisories/view/root-shell-tplink-wdr740

dschulz• 13 years ago

    Firmware Version: 3.12.4 Build 100910 Rel.57694n
    Hardware Version: WR741N v1/v2 00000000

it works :-/

networked• 13 years ago

TP-Link TL-WDR4300 can run OpenWrt [1], a highly modular Linux distribution meant primarily for routers. If you have one of those routers and you're at all familiar with Linux should really consider upgrading to OpenWrt. Once you've got the web UI set up administering it becomes very similar to configuring "normal" routers.

Unfortunately, stock firmware that comes with a lot routers has just been no good even if it lacked gaping security holes like this. Fortunately, there are community-developed FOSS alternatives that offer a better user experience; I imagine that having more eyes on the source also helps their security. I use TomatoUSB [2] on my main router (Asus RT-N66U) and OpenWrt on the "experimental" one (TP-Link TL-MR3020) and can highly recommend both distributions.

[1] http://wiki.openwrt.org/toh/tp-link/tl-wdr4300

[2] http://tomatousb.org/

thejosh• 13 years ago

OpenWRT is amazing.

TPLink routers are great for custom firmware, I use to run DD-WRT but now run OpenWRT.

OpenWRT takes a little longer to get setup but once you do it runs perfectly and doesn't require any changes (I've been running mine for over a year without a hitch, before that years with ddwrt).

tuananh• 13 years ago

OpenWrt is much better IMHO because of the package management. ddwrt fails short in term of stability.

dwang• 13 years ago

I like Gargoyle firmware, which is based on OpenWrt. It has a simpler interface with QoS ready to go. The experimental version 1.5.9 has CoDel built in. So far the router seems to be handling VoIP better than the Asus RT-N16 running Shibby's TomatoUSB firmware.

https://www.gargoyle-router.com

sbirarda• 13 years ago

Been using Gargoyle on my WDR4300 for about a month.

Was turned off by the look at the beginning after coming from DD-WRT, but I'm really happy with it so far - especially after getting QoS setup.

jhenkens• 13 years ago

A thumbs up for OpenWrt. I had been running a D-Link DIR655 before I got my WDR4300 setup with OpenWRT. Moving to OpenWRT fixed a good amount of problems I had been having with zeroconf announced services on my local zeroconf services. Netatalk, specifically, would only work for the first hour or so on the DIR655, but with OpenWRT on the WDR4300 it works perfectly.

The configuration is really quite fantastic, and you can do pretty much anything you could want.

deanclatworthy• 13 years ago

More specifically, http://www.dd-wrt.com/ is fantastic, based on the OpenWRT kernel. I use it on all my routers now. I've been using it on my routers since 2006.

I was having major issues after two years, only last week, with an old Buffalo Wireless-N router. I switched over to DD-WRT last week and all was cured, and I'm getting better wireless performance.

felixfurtak• 13 years ago

I wonder if this is limited to LAN side or WAN. WAN would be very worrying indeed.

lunixbochs• 13 years ago

You need access to the HTTP server to hit that URL, which means it won't work over LAN unless you enabled remote management. Don't enable remote management on your router :)

newman314• 13 years ago

Also, newer builds of openwrt and cero have CoDel built in which should help address bufferbloat.

subway• 13 years ago

I know it really isn't relevant to the vulnerability, but it bugs the crap out of me to see somebody running commands as root when they don't need to... Does this bother anyone else?

rytis• 13 years ago

It doesn't bother me. Sometimes it's just more convenient not having to type sudo with every command. Especially if it's a throw away VM/host that you're experimenting with. YMMV.

UnoriginalGuy• 13 years ago

As I keep the root account disabled (for interactive login), yes, it bugs me too.

But my inherent laziness is exactly why I keep it disabled. If I left it enabled I'd constantly just su instead of thinking about what it is I am doing and sudo only the relevant bits.

Glyptodon• 13 years ago

My RT-N16 died just past warranty - something with the power; it'd only power on maybe 1 out of 25 times of sticking the adapter plug in. :/ Until that happened I'd been quite a fan and it ran custom firmware quite contentedly.

Currently I'm running a Netgear Centria WNDR4700 (it was a freebie for various reasons) and it has the lovely habit of storing user names and passwords in plain text (file share user names and passwords are displayed in plain text, and they're always the same as login names and passwords so far as I can tell). Unfortunately I'm not aware of any custom firmwares for it. :(

I have a TP-LINK TL-WDR3500 buried in my closet. I hadn't realized it might work with custom firmware. The physical ports being 10/100 would still be annoying, but it might be worth looking into flashing it. Glad I saw this post. =)

wlk• 13 years ago

I just ordered this router knowing about this backdoor. I'm planning to install OpenWrt as soon as it arrives, which I recommend to anyone, as it was pointed in other comments.

dazzawazza• 13 years ago

This is why I keep a pfSense router between my LAN/DMZ and any consumer or telco boxes. It's just not worth the risk.

TP-Link make money by selling fast cheap boxes. They cut corners on the firmware and testing.

Other manufacturers may be more expensive but I don't trust they aren't also cutting corners.

mvip4• 13 years ago

The major vuln aside -- are they seriously running Apache the router? "/usr/bin/httpd" sure looks to me like Apache (but could of course be anything). Heard of Nginx or Lighttpd (or countless other lightweight web servers)?

nodata• 13 years ago

Why care? If it runs, it runs.

mvip4• 13 years ago

Yes, until it runs out of memory and you need to reboot it.

Backdoor in the TP-Link routers

Related Stories