'Contagious' wi-fi virus created by Liverpool researchers

http://www.bbc.co.uk/news/technology-26352439

by choult • 12 years ago

23 19 12 years ago

bbc.co.uk

Derpdiherp2• 12 years ago

Interesting, but it still relies on the default username and password on the router. I think this points at a glaring hole in router security, why aren't password and username changes forced on the first bootup of the device? Having the password as "changeme" is not good enough for your everyday user, they are very unlikely to ever use them without being forced so will plain not know they are meant to at all.

sp332• 12 years ago

I don't think most routers work that way anymore. WPS has weaknesses, but it's still better than having the same password on every device.

maxerickson• 12 years ago

If I have it right, WPS (wifi protected setup, right?) results in sharing the password (i.e., in practice it is only ever used with PSK and attacks recover the key).

Conceptually, device bonding seems like the right way for consumers but WPS doesn't do it very well.

Derpdiherp2• 12 years ago

Possibly, although I have never been given a WPS enabled device from an ISP, nor have any of my family ( have to love being tech support ). Come to think of it though I have seen routers in the past with what can only be randomly generated passphrases though, which is a step in the right direction at least. My current router was not one of those though.

lewispollard• 12 years ago

FWIW, the last few routers I've had (supplied by UK ISPs) have had random admin passwords set by default, printed onto a sticker.

mikeash• 12 years ago

It's amazing that this isn't done by everyone. But of course roughly nobody cares about security (and those who do can change the password themselves), so why not save the 5 cents per unit that it would cost.

bazzargh• 12 years ago

The random admin passwords would be great if they weren't also leaving in backdoors.

https://wikidevi.com/wiki/Xmlset_roodkcableoj28840ybtide https://github.com/elvanderb/TCP-32764

Luyt• 12 years ago

Also, even if the credentials are 'admin/admin' or 'admin/password', by default the administration interface is not reachable from the WAN side of the router. Or at least, I've never seen a consumer grade router that was open to management from outside.

giantrobothead• 12 years ago

The last few routers I've used have an option for remote management, but that option is disabled by default, as it should be.

daeken• 12 years ago

Most router administration pages are CSRFable, meaning it's trivial to exploit them from the "outside" via those on the inside.

ds9• 12 years ago

Right, it's all based on this lack of configuration, and could be avoided by users. It's alternately amusing, annoying and irksome to me that the researchers propose to fix the situation with a "product that could be installed in wi-fi access points to prevent this kind of hijacking - without requiring the user to take responsibility".

That is the wrong approach. User education is hard, and lacks incentives for the gear makers, but adding new layers (maybe proprietary, maybe with vulnerabilities of their own) is the wrong approach. The autoconfiguration features on some routers are an example.

Equally bad is the "dumbing down" imperative that in recent years has made interfaces more opaque, restrictive and stupid. "Click this big, colorful icon and we'll do it all for you, so you don't have to think!" -- and then interface makers try to cope with users being more ignorant than ever -- failing to perceive the cause and effect relationship.

The right approach is giving controls for all the functionality, status displays to show what is happening, explaining in plain terms what each control is for, giving step by step instructions for the essentials, and making the default configuration safe. (In the case of a router, this would mean no WAN connection until you configure the device.)

tfinniga• 12 years ago

Seems like a worm, not a virus.

Technically correct, the best kind of correct.

forcer• 12 years ago

I think it makes nice story but I would be very surprised if such a virus could spread. You have many router brands and versions and you would need to develop and test your firmware on many of those to make sure it can spread. Also, correct me if I am wrong but not many routers have easy way of uploading new firmware.

Xylakant• 12 years ago

Well, base your virus partially on DD-WRT or any other open source router OS and you're in the game. Consumer routers usually have a button "upload new firmware" somewhere in the administrative web UI.

_b8r02• 12 years ago

You do know that there's more than one hardware platform for routers, right?

wydok• 12 years ago

It's an episode of Doctor Who!

zwieback• 12 years ago

Terrible article, I expected more from the BBC. Basically "stuff you should be afraid of but we won't explain how it works or provide links to the original work."

Here's the link to the research, which is primarily concerned with methods of detecting AP-AP viruses, the actual Chameleon virus seems to be just some kind of proxy to test spread and detection of real viruses.

http://jis.eurasipjournals.com/content/2013/1/2

'Contagious' wi-fi virus created by Liverpool researchers

Related Stories