Complete, Persistent Compromise of Netgear Wireless Routers

http://shadow-file.blogspot.com/2013/10/complete-persistent-compromise-of.html

by Hoff • 13 years ago

179 69 13 years ago

shadow-file.blogspot.com

Glyptodon• 13 years ago

I have a WNDR 4700 and I can't replicate as described. However, I've also never trusted the stupid thing since it stores passwords in clear text (or at least is happy to display them in clear text on one of its admin pages).

dgesang3• 13 years ago

Even major browsers store/show passwords in clear text, can it be that wrong? ;)

graue• 13 years ago

That's different. Browsers need to show your password to external websites to prove to others that you're you. This requires storing the actual password. They expose saved passwords in the UI because if they didn't, it would create a false sense of security. There's always going to be some way to get the saved passwords, or the feature wouldn't work.

The router admin interface only needs to check your password. It can do that by storing only a cryptographic hash, not the password itself.

xtreme• 13 years ago

Browsers need to store the passwords in plaintext, because they need to populate the password field when you visit that website. However, you can store them encrypted using a master password and decrypt them once per session.

bigiain• 13 years ago

A browser has to be able to supply clear-text passwords to websites, so strong hashing and discarding the clear-text won't work in their use-case. Your router only need to authenticate your password, so it _should_ be using bcrypt/scrypt/pbkdf2 to hash the password and not storing it anywhere in clear-text.

girvo5• 13 years ago

I had fun freaking out my not-so-tech-savvy-but-exceedingly-paranoid (tin foil paranoid) uncle: He bet me $50 I couldn't crack his WiFi password. He let me use his iMac that was already connected.

I hopped onto the Admin page for the router. Had a password, which make sense. I submitted a test password, and there was no page-refresh or network activity... hm. Must be just in the Javascript...

Sure enough, it was obfuscated, but the password was in the damned HTML and easy enough to find. I got $50, and the priceless look of horror on my uncle's face.

I then explained to him that physical access to a computer usually equals "Game Over" ;)

MichaelGG• 13 years ago

But you didn't have physical access to the router. Setting aside that you could probably dump it out of memory if you had root on the OSX box, the router shouldn't have coughed it up so easily if it was supposed to be secure.

uptown• 13 years ago

Exploit doesn't appear to work on a WNDR3700v2. I'm hoping it doesn't, as this has been the only router I've ever liked after years of dealing with complete garbage.

zdw• 13 years ago

This, along with bufferbloat [1], is why you run OpenWRT or another similarly modern, fully open source distro on your home routers.

Right now, the best supported devices are ath9k's, so things like the Buffalo WZR-* models are ideal.

The WNDR 4700 model specifically doesn't have good support for 3rd party firmware [2] due to it's use of NAND flash in an unsupported manner, so if you have that model you're kind of sunk at this point.

1. http://www.bufferbloat.net

2. http://wikidevi.com/wiki/Netgear_WNDR4700

mbell3• 13 years ago

If you want a more hardened setup I recommend pfsense, a freeBSD based firewall/router disto [0]. It'll run on any number of mini/nano boards and several companies sell prebuilt boxes. It can run as a wifi AP as well but I find that a separate AP works best.

[0] http://www.pfsense.org/

eksith3• 13 years ago

I've found pfSense really shines on old PC hardware since the embedded boxes I've tried it on tend to slow a bit. Something with a still functioning HD and at least 256Mb memory does pretty well with it.

scott_karana• 13 years ago

I've found pfsense to be extremely quirky, though it works pretty well. If you can wrap your head around the weird way it's all presented, the CARP and XMLRPC sync between clusters works flawlessly.

That said, when you bring their strange "packages" into the mix, all hell can break loose. So be careful.

mcpherrinm• 13 years ago

What do you use as a separate AP? My cursory searching indicates there exist enterprise-grade APs requiring a controller device, overkill for my apartment, or I use your standard bestbuy device like we're wanting to be avoiding in this thread.

thelambentonion• 13 years ago

Anyone looking into prebuilt pfSense boxes would also do well to check out Ubiquiti's EdgeRouter Lite [0]. I was initially looking at getting an ALIX kit [1] for my home router, but the ERL offered much better performance for roughly half the price. I haven't ordered one yet, but I will as soon as I have a day or two to sit down and properly configure it.

[1] http://store.netgate.com/Ubiquiti-EdgeMAX-EdgeRouter-Lite-P1...

[2] http://store.netgate.com/ALIX2D2-Kit-Black-Unassembled-P187C...

moreentropy• 13 years ago

Pfsense is in no way more hardened than a OpenWRT box. Both are vastly superior to the stock firmware on any soho router available. OpenWRT and pfsense come from different backgrounds, OpenWRT was intended as a replacement firmware for consumer wifi routers, while pfsense wanted to be a secure and easy to use firewall appliance on x86 hardware.

We use both, OpenWRT on cheap TPLink consumer routers as a VPN router in home and branch offices, and a bunch of virtualized pfsense firewalls for network security in our hq and datacenter rack.

If you're after real routers as in routing protocols like bgp and ospf and not security devices, both are not of much use. this is where vyatta, a open source Debian based router distribution is better suited.

Wireless performance of openwrt depends on the hardware it is running on, but It's generally not great compared to proprietary gear from ubiquity and mikrotik. Both make dirt cheap wireless gear and routers that can match and outperform Cisco routers that cost 10x more. Wireless ISPs everywhere rely on those vendors.

tedunangst2• 13 years ago

For a project that claims to be "Spreading the word to correct basic assumptions regarding goodput and good buffering on the laptop, home gateway, core routers and servers", there is remarkably little info I can actually find on the bufferbloat.net web site. I even clicked the Help link, only to discover it's a link to the redmine documentations. Thanks.

ChuckMcM• 13 years ago

So has anyone used any of the open hardware alternatives, like routerboard.com ? Seems like having the schematics and the firmware would be a reasonable place to be.

voltagex_• 13 years ago

I looked into these kind of things but I'm in an odd position where I need an ADSL2+ chipset of a certain kind (Broadcom with good noise filtering) because of the state of my phonelines.

I was looking into running an ADSL modem in full-bridge mode (you'd be surprised how many of these modems don't support that anymore) + a routerboard or mirotik product, but when you add up the cost and configuration time it just wasn't worth it.

I'm currently running a Billion 7800VDPX, which I now have the GPL sources to (after some prodding). When I finally have some time to sit down and risk bricking my device, I'll have a look at getting OpenWRT working (although at last glance they were never going to support ADSL).

tl;dr: open hardware alternatives aren't easy enough to drop in yet, or they're not really open - http://wiki.mikrotik.com/wiki/Manual:License

jasiek• 13 years ago

Ah, this just illustrates how much hardware companies suck at building software.

camkego• 13 years ago

This post, and other recent ones like it, indicate to me the importance of running a port scan and making sure no management abilities are exposed over the WAN side of these devices. Any suggestions on good, fast online port scanners?

hughesey• 13 years ago

There's one at http://viewdns.info/ if you're only after common ports.

rogerbinns• 13 years ago

In addition to management, a bunch of these can serve up files to the WAN side. On Netgear devices it is in a USB storage section.

I do scans from cellular devices (Fing on Android and iOS, is passable for popular ports) and my laptop (nmap) when out and about.

nwh• 13 years ago

http://portscan.me/ will execute an nmap scan on the request address and print it back. Even works fine with curl.

greglindahl2• 13 years ago

One alternative to underpowered routers running OpenWRT or pfsense is to use a beaglebone black as your router. It's got well-supported wifi devices with antennae available, and you're not compromising on clock or ram.

tux19682• 13 years ago

Except the BBB only does 10/100 Ethernet so can't really operate as a modern router. The advantage of say an OpenWRT modded D-Link DIR-825, is it includes a gigabit router that handles internal traffic while the cpu handles the firewall and vpn to the outside world. Because local traffic is handled by completely separate silicon inside the router, CPU and ram is not a constraint.

greglindahl2• 13 years ago

I live in a small apartment surrounded by neighbors with wifi networks. 100mbit is plenty for the wireless portion of my network, and the wired portion doesn't need a firewall. Sounds like your constraints are very different.

lmz• 13 years ago

Doesn't that separate silicon handle switching, not routing?

ce42• 13 years ago

Well, there are also more powerful options, e.g Buffalo's WZR-HP-AG300H, which has 128MB RAM / 32MB flash / Gigabit Ethernet and two radios. Not to forget: Power consumption is should also be taken into consideration for an always on device.

holyjaw• 13 years ago

I like that this was technical and informative, but still talked down to people like me who aren't at all knowledgable with how infosec works. Great read; wish I could find more like it.

sillysaurus2• 13 years ago

Which part did you feel was talking down to you? I need to know in order to improve my own writing.

LukeShu• 13 years ago

I don't think he meant "talk down" in a negative way. I think he was trying to say that it clearly explained things to someone who doesn't know about the topic (while still being full of details to someone who does).

girvo5• 13 years ago

Question: I have Cable internet here in Aus (100mb/10mb) and I like my connection, but we have to use Telstra's silly modem, and they refused to activate any other one on the network.

So, lets assume I don't trust this AP and Modem to be secure (fair enough assumption in my opinion) -- the best way would be to perhaps build my own Wireless AP running pfsense, on a BeagleBone Black or similar?

    Cable -> Telstra Modem w/out Wireless -> pfsense AP -> Network

Would that be the most secure way to handle that situation?

tedunangst2• 13 years ago

Since pfsense won't run on a beaglebone, that's a non starter. I also have my doubts as to a beaglebone's ability to reliably push 100mb of traffic.

girvo5• 13 years ago

Ah, that was just an admittedly poorly-researched example. I basically just meant a board that'll run open-source code.

cbrauchli• 13 years ago

If you have a Netgear WNDR3700v2 or a WNDR3800, check out Cerowrt [1]. The latest stable build, 3.7.5-2, has been exceptionally stable for me, and fast. I would highly recommend it.

1. http://www.bufferbloat.net/projects/cerowrt

chojeen• 13 years ago

Do companies like Netgear not have a team whose only purpose is to try to break their own products? I thought that was a primary source of employment for infosec types.

Complete, Persistent Compromise of Netgear Wireless Routers

Related Stories