Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
Networking Security Hardware IT

Remote Linksys 0-Day Root Exploit Uncovered 133

Posted by samzenpus
from the protect-ya-neck dept.
Orome1 writes "DefenseCode researchers have uncovered a remote root access vulnerability in the default installation of Linksys routers. They contacted Cisco and shared a detailed vulnerability description along with the PoC exploit for the vulnerability. Cisco claimed that the vulnerability was already fixed in the latest firmware release, which turned out to be incorrect. The latest Linksys firmware (4.30.14) and all previous versions are still vulnerable."
This discussion has been archived. No new comments can be posted.

Remote Linksys 0-Day Root Exploit Uncovered

Comments Filter:
  • WRT54GL (Score:5, Informative)

    by markdavis (642305) on Monday January 14, 2013 @04:43PM (#42585785)

    Yes, you would think the summary would at LEAST say *WHICH* router it affects, since Linksys has lots of different models. It is the WRT54GL.

    I *love* that router and have probably 30 of them. Low power draw, real antenna, wall mountable, etc. My recommendation- install Toastman Tomato on it. They never crash, freeze, freak out, not work with certain devices, etc. Rock solid stuff.

    Strangely, the WRT54GL is STILL BEING SOLD!

    • Re:WRT54GL (Score:5, Informative)

      by Synerg1y (2169962) on Monday January 14, 2013 @04:47PM (#42585825)
      People still run their 54gl's stock???

      Repeat after me: d-d--w-r-t [dd-wrt.com]

      Turns your router into something more like one of those fancy enterprise cisco routers. The 54gl is dd-wrt's 1st platform I believe (too lazy to look it up), so compatibility is bound to be around 100%.
      • Re:WRT54GL (Score:5, Funny)

        by YodasEvilTwin (2014446) on Monday January 14, 2013 @04:49PM (#42585839) Homepage
        Wait, are we pronouncing the hyphens or not?
      • by Anonymous Coward

        A couple years back, dd-wrt had its own security issues [dd-wrt.com] which was not, in my oipinion, publicized as widely as it should have been.. I remember some internal debate with some people saying it wasn't that big a deal so no need to big issue warnings/press releases. They thought posting it on the web site was enough.

        Hopefully they're better at getting the word out now.

        • Re:WRT54GL (Score:4, Interesting)

          by Synerg1y (2169962) on Monday January 14, 2013 @05:18PM (#42586153)
          Sure, every network anything has had security issues and will. Imho, remote web management is only useful to a very few select users, to get back home, ssh is the way to go... which you'd set up in web management :)

          There was also a vulnerability late last year that revolved around a specific service. The scope is different though, you can turn off a router service inconveniencing yourself till a patch is released... the article didn't provide enough detail on what's affected on the linksys firmware leading me to suspect stock firmware, stock settings... aka the most vulnerable of the vulnerable users group.
      • Repeat after me: http://www.openwrt.org/ [openwrt.org]

        Turns your router into a Linux box. That routes too. And more. And let you tinker with it, too. ;)

        • by shoor (33382) on Monday January 14, 2013 @07:02PM (#42587173)

          Recent openwrt distros have a problem with the classic wrt54gl in that it doesn't have enough memory. I know because it happened to me. It installs, but when you try to change configuration, it bricks and you need to ground pin 15 to get it to reflash something. From the openwrt site:

          "In a test with OpenWrt 10.03.1-rc6, the OS will install but LuCI will be unable to update settings because there isn't enough flash left free."

          Old enough versions should work, but I'm happy with my tomato install.

          • by drinkypoo (153816)

            Another vote here for tomato. Tomato makes me happy. I have it on a buffalo and two linksyses and they all work, WDS actually works, everything works.

      • Re: (Score:3, Insightful)

        by Anonymous Coward

        You say DDWRT, I say Tomato.

      • by leenks (906881)

        Shock, horror: the majority of all routers run stock firmware...

        • Re:WRT54GL (Score:5, Interesting)

          by clarkn0va (807617) <apt.get@gAAAmail.com minus threevowels> on Monday January 14, 2013 @10:15PM (#42588383) Homepage

          The WRT54GL is the minority of all routers.

          For those who don't know, the L in WRT54GL stands for Linux. This routers was differentiated from the contemporary revision WRT54G only in that it ran the Linux-based firmware. While subsequent revisions of the WRT54G featured less and less capable hardware, the WRT54GL maintained its original configuration of flash and RAM, allowing it to run third party firmwares such as dd-wrt, openwrt, and Tomato.

          To the average consumer, the WRT54GL looked exactly like the significantly less expensive WRT54G and its prolific variants, but to the power user and professional, it held much greater potential and warranted the higher price tag. These pros and power users generally have no use for stock firmwares, and are only interested in the open nature of the hardware platform, and are therefore willing to pay the premium (although personally I preferred the more capable and less expensive ASUS WL-520gu. I guess legend status has its privileges).

          So yes, it is shocking to those who are familiar with the platform to learn that any significant portion of WRT54GL is running stock firmware in the wild.

          • Re:WRT54GL (Score:5, Insightful)

            by dutchwhizzman (817898) on Tuesday January 15, 2013 @12:42AM (#42588957)
            You are forgetting that a lot of people bought it because "the guy that knows computers" said it was "the best model", never understanding why and how to take advantage of the added value of the GL over the budget model. The amount of home computer equipment that gets bought on recommendation of either the sales guy, the neighbour kid or the relative that works in IT is staggeringly high. Those people will most likely still be running stock firmware, probably a relic version at that.
          • by Lothsahn (221388)
            While what you say is true, it's not just the WRT54GL that's likely affected. It's highly likely that WRT54G/WRT54GS v1-v4 are also affected.

            The WRT54GL router uses nearly identical firmware to the v1, v2, v3, and v4 models of the WRT54G and WRT54GS router. In fact, the specs on a WRT54G/WRT54GS v4 are nearly identical to a WRT54GL--same chipset, RAM, and flash.

            A lot of these were manufactured and sold, and I bet the vast majority are still running stock.
      • by antdude (79039)

        From what I read, the third party firmware upgrades looks complex from their documents and easy to brick. :(

        • by Nyder (754090)

          From what I read, the third party firmware upgrades looks complex from their documents and easy to brick. :(

          I don't find them that complex and the easy to brick warnings are for the idiots that do not bother to read thru the instructions first and get an understanding of the whole process before proceeding. Most things that cause bricking is from doing stupid crap during the process, like not paying attention to the step you are on and not understanding the step you are on.

          I find the DD-WRT's instructions to be good. Way better then the instructions I've had to hack my various consoles over the years.

          • by antdude (79039)

            LOL. I am not good in following instructions. I tend to break stuff easily hence why I am a SQA tester. :P If I had another router, then I could try it but I don't want to risk bricking it and have no Internet connection.

    • Re: (Score:1, Flamebait)

      by morcego (260031)

      It is really odd. WRT54GL is target to people who will flash it with custom firmwares. Why would use one of those with stock firmware? If you are not going to hack it, just buy another model (better and/or cheaper).

      Anyone running stock on a WRT54GL deserves to be hacked.

    • Re:WRT54GL (Score:5, Informative)

      by VValdo (10446) on Monday January 14, 2013 @05:09PM (#42586057)

      I agree it's bad form not to put the router models in the summary. But from the press release [defensecode.com]...

      Exploit shown in this video [youtube.com] has been tested on Cisco Linksys WRT54GL, but other Linksys versions/models are probably also affected.

      (emphasis mine)

      Incidentally, re: the GL model of the Linksys-- the "L" I'm pretty sure stands for Linux, and was the model that was in response [wikipedia.org] to everyone reinstalling dd-wrt and other firmware...

      • Most Liniksys routers these days run vxWorks. Now that doesn't mean that this vulnerability couldn't be above the OS/driver level and thus still applicable, or that the code isn't broken in the same way, but the GL model is something of an anomaly these days running their Linux firmware. They switches to vxWorks some time ago for most things. They claim it was to use less memory (and they did cut the RAM in their devices), Linux types claim it was to avoid having to GPL things.

      • Re: (Score:3, Informative)

        by formfeed (703859)

        Incidentally, re: the GL model of the Linksys-- the "L" I'm pretty sure stands for Linux, and was the model that was in response [wikipedia.org] to everyone reinstalling dd-wrt and other firmware...

        The WRT54GL was in response to the people being unable to run Linux on the newer revisions of the WRT54G, after Linksys "updated" the WRT54G by reducing the memory in the newer models. They basically restored the specs. of the original router and sold it for a premium.

    • by Anonymous Coward

      DefenseCode seems to think it affects more models than just the WRT54GL. From their post:

      "Exploit shown in this video has been tested on Cisco Linksys WRT54GL, but other Linksys versions/models are probably also affected."

    • Stupid link talks about WRT54GL only.

      To quote the original page [defensecode.com]:
      Exploit shown in this video has been tested on Cisco Linksys WRT54GL, but other Linksys versions/models are probably also affected.

    • by andydread (758754)
      I have one of these with stock firmware and its rock solid. I shall be updating immediately.
      • by markdavis (642305)

        >I have one of these with stock firmware and its rock solid. I shall be updating immediately.

        I used my WRT54GL for many months (years ago) on the stock firmware and did not find it to be reliable. I had upgraded the stock firmware to their latest and it didn't help.

        Once I changed to Toastman Tomato, it became one of the most reliable pieces of equipment I own... instantly. PLUS Tomato gave it tons of additional functionality.

        Don't be afraid of installing third-party Linux firmware, it is the best thing

    • by scdeimos (632778)
      From the "Upcoming Advisory" page, http://www.defensecode.com/article/upcoming_cisco_linksys_remote_preauth_root_exploit-33 [defensecode.com]:

      Exploit shown in this video has been tested on Cisco Linksys WRT54GL, but other Linksys versions/models are probably also affected.

    • by Nyder (754090)

      Yes, you would think the summary would at LEAST say *WHICH* router it affects, since Linksys has lots of different models. It is the WRT54GL.

      I *love* that router and have probably 30 of them. Low power draw, real antenna, wall mountable, etc. My recommendation- install Toastman Tomato on it. They never crash, freeze, freak out, not work with certain devices, etc. Rock solid stuff.

      Strangely, the WRT54GL is STILL BEING SOLD!

      I thought the point of the WRT54GL was to install DD-WRT on it. I don't know about anyone else here, but that is what I did.

  • I'm fine. (Score:5, Funny)

    by drunkennewfiemidget (712572) on Monday January 14, 2013 @04:44PM (#42585793) Homepage

    I'm pretty sure my Linksys router doesn't have that vulnerabil -- HA JUST KIDDING, WHO WANTS MY CREDIT CARD NUMBER?

  • WRT54GL? (Score:3, Informative)

    by Anonymous Coward on Monday January 14, 2013 @04:46PM (#42585811)

    Just gotta ask: have they tried it on any OTHER models? Because that's an OLD OLD router that shouldn't even be running cisco/linksys firmware anymore. Tomato, ddwrt, and openwrt all support it, all have support for it and much improved kernel and userspace versions.

    Additionally though the number of different arm processors and SoC arches they're running in their hardware makes me question the odds of a common exploit across all of them, especially since this isn't even a router support the new 'Cisco Cloud' configuration garbage.

    Anyway, what do the rest of you think, some wanna-be 'security' company trying to make a name for themselves scaremongering?

  • Zero day? (Score:5, Insightful)

    by arth1 (260657) on Monday January 14, 2013 @04:48PM (#42585831) Homepage Journal

    What's zero-day about this exploit?
    It was found during testing, and there are no exploits in the wild.

    As such it fails BOTH tests for being a zero day exploit:
    - The company must not know the details of the exploit
    - It must be in the wild

    Stop using the phrase "zero day" about just any exploitable bug. Call them security vulnerabilities, which is what they are.

    • Re: (Score:3, Funny)

      by Anonymous Coward

      What's zero-day about this exploit?
      It was found during testing, and there are no exploits in the wild.

      As such it fails BOTH tests for being a zero day exploit:
      - The company must not know the details of the exploit
      - It must be in the wild

      Stop using the phrase "zero day" about just any exploitable bug. Call them security vulnerabilities, which is what they are.

      zero day sounds cool man, it's like black ice and cyberspace all over again man...far out... ...peace.... //tech journalist -68

    • by Synerg1y (2169962)
      An unpatched security vulnerability at that. You'll have just as much luck with this as getting people to understand the difference between a hacker and a cracker... and that's using the already warped definition of hacker from the media: goodddd luck.
      • A hacker is someone who isn't particularly good at golf. A cracker is...who you calling a cracker motherfucker?
    • by flonker (526111)

      I agree. My first thought on reading the headline and summary was that Cisco claimed it was fixed, so DefenseCode released it into the wild.

    • by Anonymous Coward

      I always thought the overuse of "zero-day" was more of a scare tactic by all parties involved (reporters want you to care, malware authors/researchers want us to fear, companies want us to fear for slightly different reasons). As I was pondering its use in this story, however, I think now that a significant reason might be the following: "Zero-day" implies that the company behind the affected product hasn't had time to fix it yet - that it's not their fault, because they haven't had time to fix it yet. Aft

    • by PRMan (959735)
      1. Cisco didn't know about it until this week. 2. It CAN be exploited in the wild. The video proves it. Zero-day exploit.
    • Re:Zero day? (Score:5, Interesting)

      by AmiMoJo (196126) * <[ten.3dlrow] [ta] [ojom]> on Monday January 14, 2013 @05:42PM (#42586383) Homepage

      The term "remote" is also a bit misleading, in that it looks like you need to be on the local network already to use this vulnerability. In the video their IP address is 192.168.1.1. Far less serious than being able to get root from the internet or without having to authenticate a wifi connection first. In fact I bet 95% of affected routers have the default web interface password anyway.

      The main people who should be worried are people with open access wifi or LAN ports, such as cafes and hotels.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        In fact I bet 95% of affected routers have the default web interface password anyway.

        Yes, with the user/pass as admin/password or admin/admin! :-0

  • by loxfinger (571135) on Monday January 14, 2013 @05:05PM (#42586001)
    The Department of Homeland Security needs to tell everyone to uninstall their Linksys routers until this is fixed, a la Java.
  • by jht (5006) on Monday January 14, 2013 @05:07PM (#42586027) Homepage Journal

    So it's a vulnerability in the WRT54GL (and maybe the related routers) running mainly older firmware - it's a pretty old router model as are its cousins. And from watching the exploit video, it's a local vulnerability - not one you can exercise against the WAN port. So it looks like not such a big deal. After all, 98% of those just have the default password anyways.

    If the more advanced gear (like the RV routers and such) have this issue then I might be concerned. But I don't have enough info yet to worry or not.

    • by omnichad (1198475)

      Only if it's being used to run a cheap free wi-fi hotspot for a small business and managed not to catch fire running the default firmware. A WRT54GL would do just fine as a wi-fi hotspot on DD-WRT, but doubt it could handle the load on stock.

    • by gl4ss (559668)

      yeah the thing I was trying to find from skimming the article and video was just exactly that..

      is it exploitable from outside network? if it's not, why are you calling it remote? if it is why are you demoing from local subnet?

      a true remote exploit through the ip stack(or if it had something open) would be a big big deal..

  • by Raystonn (1463901) on Monday January 14, 2013 @05:23PM (#42586207)
    Unless you have remote administration enabled, this exploit is only achievable from a system within the local network. This attack is not an internet threat.
    • Re: (Score:2, Interesting)

      by Anonymous Coward

      Unless you have remote administration enabled, this exploit is only achievable from a system within the local network.

      A web browser on the local network opens a malicious webpage. Now, what?

    • XSS?

  • Stupid question, but by "Default installation" do they mean that the default user/pass needs to be unchanged? 70 million routers is a lot.. even if only 1% uses remote administration.
    • by gl4ss (559668)

      I don't think they mean that.
      because that would be just too stupid.

      they probably mean that it's running the default services like dhcp to the local subnet.

  • Appliances need a system for automatic updates. The average person does not periodically look for updated firmware for their router, toaster, television, thermostat, etc. If it is connected to the internet, it needs an automatic update system.

    (Yes, I know this router is old - I'm just speaking in general)

    • by bobbied (2522392)

      No, not a good idea. You can offer automated updates if the user opts into them, but the user must make that choice.

      I'm not installing *anything* that doesn't at least give me the *option* to review updates before they get installed. If I choose to automatically update my windows machines, so be it. If it just phones home and installs updates, I'm not going to use the thing. I can see it now, some company decides to disable a whole family of equipment by issuing a bum software load, either on purpose or

    • by unitron (5733)

      Appliances need a system for automatic updates...

      No they don't, they're appliances.

      They're supposed to be built properly at the beginning.

  • The vulnerability itself was discovered during a Cisco Linksys product security evaluation for a client

    has the kind of money to poney up for a security evaluation of this magnitude and buys freakin' crappy a$$ Linksys?

  • by vencs (1937504) on Monday January 14, 2013 @05:57PM (#42586543)
    says that, Huawei also reported its routers face a similar vulnerability.

    ---
    Protest online. Save the Planet.
    • by grcumb (781340)

      Huawei also reported its routers face a similar vulnerability.

      You should win the Internets for the day, but tragically your post is too far down to get noticed....

      ... And worse, some copy-catting smartass with an acute sense of irony just copied and pasted it way up top.... Oh, hang on - that was me. 8^)

  • That would have been semi helpful. Some inkling. My WRT110 has a little setting called 'allow remote admin'. I hope we're talking about that non-issue.

  • I run Shibby's builds on my Linksys E4200... Can't recommend them enough:
    http://tomato.groov.pl/?page_id=164 [groov.pl]

  • And its BS like this that I do not trust other companies any more than I have to for security.

    So my router was made by me with wifi and all for less than $200 and uses pfsense. If there's a security risk I'm sure there will be a patch unlike some dlink and linksys problems. What happened when my last dlink router had a 0day exploit? dlink's public answer was "I'm sorry, we don't support your 2.3 year old router anymore, but if you buy our new shiniest router ever it has the firmware update to fix that ex

  • Fritz boz (Score:4, Interesting)

    by 1s44c (552956) on Tuesday January 15, 2013 @06:03AM (#42589891)

    I highly recommend getting a fritz box. The amount of stuff they can do is really cool.
    The model I have is a NAS server, Media server for my blu-ray player, a PBX for cheap SIP calls, an answering machine for SIP or land line calls, a DECT phone base station, A print server for my USB printer, a VDSL modem, and a 4 port gigabit switch. All that in a small low power box.

    Also you can update the firmware fairly easily although it does trash all your settings.

    No I don't work for them.

Real Users find the one combination of bizarre input values that shuts down the system for days.

Working...