NetGear Also Has Remote Access Wide Open 215
Glenn Fleishman writes "On the heels of Linksys's WRT54G problem of not allowing remote access to be disabled in certain cases and firmware, BugTraq published this report that NetGear's WG602 access point has a hidden password that provides remote and local administrative control. Unlike Linksys's, where turning the firewall on (which is on by default, but a researcher found new units in which it was off when taken out of the box), the NetGear hole cannot be disabled. The backdoor seems to have been created by the vendor that packaged the device for NetGear."
huh? (Score:4, Insightful)
Undocumented = bad though,
Re:huh? (Score:4, Informative)
Re:huh? (Score:2)
Besides which, the network diagram on NETGEAR's support page tells you to put a firewall box between the WG602 and the Internet. (On the other hand the user manual shows a direct connection).
Don't you mean.. (Score:5, Funny)
Fixed in new firmware, available here: (Score:5, Informative)
Re:Fixed in new firmware, available here: (Score:3, Interesting)
That's all nice and well, but the average user isn't going to upgrade at all. A good deal of them never even set the admin password in the first place.
Take the guy in my apartment, for instance. I'm using his wireless. His AP is totally open--default SSID and all. I know he doesn't care, but what if he were a business? There's no way he's going to upgrade firmware if he can't even set a simple password.
Re: (Score:2)
Awesome! (Score:5, Funny)
Super! Now I just have to downlo
[CONNECTION DROPPED, REMOTE SIDE 0WN3D]
linked properly for the lazy (Score:5, Informative)
Re:Fixed in new firmware, available here: (Score:3, Informative)
"WG602 Firmware Version 1.7.14
Bug Fixes
Fixed: Lost connections during heavy traffic
Improved system reliability under heavy traffic
Fixed illegal user access the WEB configuration utility.
Known Bugs and Feature Limitations
WPA is not supported.
Wireless Bridging and repeating functions are not supported. "
It's a feature, not a bug. (Score:5, Informative)
Personally I think the number of people using such browsers is probably so small that there is no justification for this "feature", but since Slashdot isn't likely to change, URLs should be submitted as proper links and not just plan text.
Re:It's a feature, not a bug. (Score:2, Informative)
Re:It's a feature, not a bug. (Score:2)
Re:It's a feature, not a bug. (Score:3, Interesting)
Instead of " " why don't they put in a "<wbr>"???
This way, it would still wrap long text but wouldn't put those ugly spaces in when it doesn't need to wrap!
(Grabs patent application...)
Re:Fixed in new firmware, available here: (Score:3, Funny)
Now if they only had a grammar checker!
Re:Fixed in new firmware, available here: (Score:2, Funny)
How To Make a Clickable URL
1. Type <a href = "">
2. Insert the URL between the quotation marks.
3. To the right of the closing angle bracket, type the text you'd like the link to say.
4. Finish with </a>
Done.
P.S. No ...Profit!!! jokes, please.
Re:Fixed in new firmware, available here: (Score:5, Funny)
Thanks, just downloaded and upgraded.
(Off topic: was anyone else disappointed that the "super" login didn't make the web control panel reveal easter eggs? I mean, you just had to try it while you were upgrading, right?)
Re:Fixed in new firmware, available here: (Score:2)
Re:Fixed in new firmware, available here: (Score:2)
Re:Fixed in new firmware, available here: (Score:5, Informative)
(You can find it yourselve by just taking similiar steps as in the securityfoces article.)
NOT fixed in new firmware! (Score:3, Informative)
Does Netgear really think the security community is that stupid? They should be ashamed.
Re:remove space in URL (Score:3, Interesting)
Its surprising that slashdot hasnt already added this basic feature.
One wonders what the internal policies are ... (Score:5, Insightful)
Re:One wonders what the internal policies are ... (Score:2)
Re:One wonders what the internal policies are ... (Score:2, Insightful)
Stupid user messes up the router.
They phone tech support "i can't get onto my routers access page, i changed and lost the password"...
"two seconds sir, prove this is your ip"
they run some tests to check its whos on the phone..
"there you go sir, your new password is ******, you may now change the settings again"....
You ever tried to talk to a noob thru flashing the firmware on their router over the phone?
Re:One wonders what the internal policies are ... (Score:5, Insightful)
Re:One wonders what the internal policies are ... (Score:5, Interesting)
There is no reason to create an administrative backdoor for this purpose when there's a readily-accessible password reset feature built into the device.
Sure there is. The reset button will nuke the configuration, the logs, and whatever else state is there, thus confounding debugging by the tech support. A single password is stupid, though. What's needed is something that requires the router s/n, the router's idea of the date, and a passcode generator from cisco. Give the aforementioned info to cisco TS and they can generate a 1 or 2 hour passcode for your router. You could also add a switch to enable this feature on the router itself, but that may not be practical.
Re:One wonders what the internal policies are ... (Score:3, Interesting)
No, you cannot justify this. Even if there was some kind of two-hour password,
Re:One wonders what the internal policies are ... (Score:2)
Re:One wonders what the internal policies are ... (Score:5, Insightful)
I'm not convinced. This is only a concern in cases where you're having technical problems, AND you somehow forgot your password. The danger of having a backdoor easily outweighs the potential benefits. Even with a special password generator from NetGear -- you're still talking security through obscurity. I want to set up my router, make sure it's secure, and forget about it! I don't want to keep checking online to see if you can download N3tg34r_PwG3n.exe yet... and you know it's going to show up eventually.
Half the time you have any technical issues, the tech support is just going to tell you to do a hard reset anyway....
Even if they gave you one of those paperclip-hole style buttons that would reset all your passwords to your device's serial number (or to enable some other backdoor), this would still be dangerous in a lot of situations. Suppose you're running an internet cafe -- you can't always trust the people sitting around your router!
Either way, I don't think this backdoor was installed for tech support reasons -- it doesn't even seem to have been installed by NetGear themselves. Hopefully some more details will come out soon... and hopefully some heads will roll.
It's funny; I just read that new story by the AdTI guy explaining how Linux wasn't safe to use because it depended on "trust". Hah! How nice for the corporate world to step forward and show that *they* can be trusted.
Re:One wonders what the internal policies are ... (Score:3, Insightful)
Personally, all of this makes it MORE COMPLEX than it has to be. Assume physical "control" of the device and ensure that only people with physical access can trigger the pinhole reset or whatever. Why? Because if someone has physical control of your router/box, you've got more serious problems at hand. The problem with the grandparent is that there's TOO MUCH FUCKING COMPLEXITY. You think tech support is hell now? Wait until you have to call supp
Re:One wonders what the internal policies are ... (Score:2)
Physical access generally means security access. Why not build this into
Physical access should NOT mean access (Score:2)
You're making some big assumptions here, for one that "employees" are the onl
Re:Physical access should NOT mean access (Score:2)
Do they lock their fusebox?? Routers should be locked away to, if they're in a public area. As newer buildings are built that account for networking, this should be less of a problem. For now, just stick it in the ceiling is often an effective solution.
But I do agree that a button that only resets the password is asking for trouble. Hell, any time I change ANY setting on my router
Re:One wonders what the internal policies are ... (Score:5, Funny)
Re:One wonders what the internal policies are ... (Score:4, Informative)
Re:One wonders what the internal policies are ... (Score:2, Insightful)
They are actually not that bad an idea IF implemented properly. It is a fact of tech support that some hapless user will lock themselves out of their own box.
I think the best solution [intel.com] I've seen is from Intel for their 530T/535T series switches, where you can download a software utility that will generate a default password for your switch when you enter in the MAC address of the switch's management module. This password ONLY works from the console (requiring physical access to the switch, or root acces
Re:One wonders what the internal policies are ... (Score:4, Insightful)
I believe that's "give them a bonus and a company car."
These back doors are not trojans installed by disgruntled employees, but there by company policy.
I'm always astounded when others are astounded by the existence of back doors in things. Pretty much anything that takes a password has a backdoor in it. Phone systems, voicemail systems, even those telephone entry systems on apartment buildings; all got back doors. Tech support is hard enough already without having to deal with unknown passwords. Some are better than others, though. Sentex telephone entry systems have back door passwords that are a hash of the unit's serial number, and only Sentex tech support has access to the program that generates them. Not that one usually needs the backdoor; most Sentex units I see still use the factory password "000000"...
Just another reason (Score:2, Insightful)
They never thought to check this before distributing it, and now they suffer because of poor quality control. Is the outsourcer going to suffer? Maybe, or maybe they will just move on to the next contract. We shall see.
Re:Just another reason (Score:4, Insightful)
It isn't even really outsourcing in the sense that Dell oursources its video cards to ATI, its cpus to Intel and its CD drives to LG, which is all perfectly legitimate. Would you really expect Dell to make its cpus and capacitors?
You buy stuff and market it.
z-com is the actual manufacturer and they sell their products to marketers. Netgear just buys the stuff and resells it.
Just like you could go to z-com and have them slap some stickers on stuff for you to resell. Or Giant. Or whoever makes Levis and Calvin Klien jeans in China. Or. .
This isn't about "outsourcing." This about a marketing firm getting stuck with some bad product.
KFG
Re:Just another reason (Score:2, Insightful)
Re:Just another reason (Score:2, Interesting)
Who said anything about taking them off the hook? As the marketer it is Netgear that is directly responsible to their customers.
As the manufacturer it is z-com that is responsible to its customers, in this case, Netgear. There is a hierarchy of customers here in which Netgear in in the middle. The man in the middle is often the one to get squashed.
This seems to indicate that NetGear should require a "no backdoors inside" guarantee on such contracts.
Yes,
The problem of convinience (Score:5, Insightful)
For example firewalls:
Question 1: how do you know the box firewall you bought is secure and no backdoors?
Answer: normally you do not.
Question 2: Why do majority ofpeople buy those instead of making their own?
Answer: Because it is a lot more convinient
So instead of spending time to build something, most people want to just get something that works and thus have to just trust the vendors, as they do not have the skill/time/inclanation/will etc to do it themselves.
Re:The problem of convinience (Score:5, Insightful)
Answer: Normally you do not.
Question 2: Why do the majority of people buy those instead of manufacturing their own?
Answer: Because it is a lot more convenient.
Any piece of hardware can have a backdoor in it, really. If anything, you're probably safer buying the system all in one piece, because:
1) A packaged system built by a respected company is likely to be far better reviewed and tested than something you assemble/install yourself.
2) If it has a hole, you know exactly whom to blame (and perhaps sue for damages, if exploited).
Re:The problem of convinience (Score:3, Insightful)
I have a better answer... Because 99.9% don't realize there could be a security problem with it. I don't worry about security when I buy a washing machine or a TV, and that's about how most people view "box" devices.
Also, I would add that it's more than convience, since most people wouldn't be able to configure a computer to be a firewall if their life depended upon it. Maybe a custom
Re:The problem of convinience (Score:4, Informative)
Smoothwall [smoothwall.org] is exactly that, a custom Linux distro with boot-from-cd install that only requires you to hit "enter" a couple dozen times to turn any old 2 nic pc into a pre-configured modern firewall with internal NAT and DHCP.
I use it and find it very handy (lots of old PC hardware about)
Re:The problem of convinience (Score:2, Insightful)
Answer: normally you do not.
Question 2: Why do majority ofpeople buy those instead of making their own?
Answer: Because it is a lot more convinient
So instead of spending time to build something, most people want to just get something that works and thus have to just trust the vendors, as they do not have the skill/time/inclanation/will etc to do it themselves.
No one has the time to examine every line of every piece
taiwan, eh? (Score:5, Funny)
This number, surprisingly enough, is also the total amount of wooden furniture shipped from Malaysia [mtc.com.my] to Bahrain in 1998. Conpsiracy! Conspiracy!
Re:taiwan, eh? (Score:2)
Conspiracy indeed!
Re:taiwan, eh? (Score:3, Funny)
Oh, nevermind.
Possibilities. (Score:5, Interesting)
Re:Possibilities. (Score:2, Informative)
Re:Possibilities. (Score:5, Informative)
"The only way to clear the BIOS password is with a Master Reset Password provided by Dell for that Model No. and they will not give you the master unless you can give them the name. address and telephone of the registered owner. However the password is universal for all laps with the same model no., so if you know someone who is a registered owner, you can call Dell and get the master."
Reference [experts-exchange.com] here. That being said, the master for an Inspiron 5000 is BLVJCH. Booyah!
Re:Possibilities. (Score:3, Interesting)
Re:Possibilities. (Score:2)
(asking because I have a Latitude CPi in exactly that situation)
Re:Possibilities. (Score:2)
So, in the spirit of making that site almost as useful as the open Google groups, here's some no-hassle username/passwords [bugmenot.com] to bypass it.
--
Re:Possibilities. (Score:2)
Packaged network boxes (Score:3, Interesting)
My FVS318 does NTP to a hard-coded destination, and there's no way to turn this off or change the NTP sync server that I've found. I've always kind of wondered what else it does or was capable of doing.
Re:Packaged network boxes (Score:2)
Makes those old 486 machines running Linux.. (Score:3, Insightful)
Which ones of the consumer products are safe? I'm running a D-Link wireless right now.Yes the encryption is on.
"Do the Right Thing. It will gratify some people and astound the rest." - Mark Twain
Re:Makes those old 486 machines running Linux.. (Score:2)
Personally, I think the Linksys WRT54G is the best value. It's cheap ($100) and it runs Linux on it AND you can get a shell on the box and install whatever software you want.
Re:Makes those old 486 machines running Linux.. (Score:2)
It's also a waste of electricity. For the geek, you're better off buying either a mini-ITX system or a hackable router (ie, WRT54G).
Netgear WG302 (Score:4, Informative)
WG602v2 also reported to be exempt (Score:2)
WGR614 (Score:4, Informative)
Too easy (Score:3, Funny)
All your basestation are belong to us?
Man, takes all the fun out of these jokes when it's so easy.
it's called metamoderation (Score:2)
Then metamoderate...
Take my advice (Score:4, Informative)
Good grief... (Score:5, Interesting)
That was the last straw. No more firmware based routers unless I make them myself, or use exsisting ones as wireless switch and really try to lock it down or use third party firmware.
learning how to make a linux router / NFS will be handy anyhow
Re:Good grief... (Score:2, Insightful)
Re:Good grief... (Score:2)
a motion with intent to file claim is just to let the defendant know, or for lack of a better term, Get their attention on the matter.
I didn't realize there was an update at the time of my origional post. Either way, a
Re:Good grief... (Score:2, Troll)
Re:Good grief... (Score:4, Informative)
Re:Good grief... (Score:3, Interesting)
The installation is a snap and the default installation is good enough for 99% of "normal" internet users.
Good grief... INDEED! (Score:3, Insightful)
It's cheap consumer electronics. Return it and get one that does not have this issue, then resume your life. No story here, move along.
Well, at least it's only an access point (Score:5, Insightful)
Re:Well, at least it's only an access point (Score:2)
Re:Well, at least it's only an access point (Score:2)
They would have to be quite near, unlike with the Linksys which is open to both near and far.
they published the password? (Score:4, Interesting)
I don't believe in security through obscurity, but I also don't believe in publishing backdoor passwords. It's not like it has any educational value (unlike looking at some exploits, which helps programmers learn how to write code that's not vulnerable).
Re:they published the password? (Score:2)
Fine, they could mail it to you if you send in your registration card or something. They didn't just tell you, they told everyone.
I'm curious what you will do with this information -- what can you do that you couldn't do before? Perhaps I am overlooking something.
The purpose of a password is to limit access. If everyone knows the password, it might as well not exist.
Two, it allows me to test if I'm vulnerable.
If you've got
Re:they published the password? (Score:3, Informative)
Well, I used it to verify whether I was vulnerable. I was. I'm glad to observe it. I've downloaded the new firmware and hope to be safe. They couldn't contact me via registration card because I NEVER send in those things. They're just marketing gimmicks used as an opt-in.
Moreover, the script kiddies will manage to get this information whether or not it's publicly posted. This way, I have it as well as them.
Can you believe it? (Score:2)
WG602v2 with firmware 2.0rc5 (Score:4, Informative)
Whew!
Re:WG602v2 with firmware 2.0rc5 (Score:2)
Man... (Score:4, Interesting)
i've even seen this happen on a thinkpad, and i would have thought ibm of all people to know better. i've seen this on a few venders before but i cant remember exactly which ones, has anyone else seem this happen before?
Provides convenient excuse for content access (Score:3, Funny)
Easter Eggs (Score:2)
I was shocked when I heard of easter eggs in my Handspring/PalmOne Treo 600 phone! Characters suddenly start appearing on the phone display by pressing a combination of keys...
The Linksys problem was a false report (Score:4, Informative)
No, it wasn't... (Score:3, Informative)
They also have beta firmware up on that link you posted to fix the problem.
Customer return..... (Score:2)
WAP54G also had SNMP issues in 1.08 (Score:2, Informative)
at least the linksys... (Score:2)
I know the password. (Score:2)
NOT A PROBLEM (Score:3, Informative)
If you don't immediately check for upgrades when you open a box and haven't with this hardware, though, perhaps you deserve to get 0wn3d?
Re:No backdoors with BSD! (Score:5, Funny)
You should try my pick-up line: Excuse me miss, but does this rag smell like chloroform?
Works every time.
Re:How very timely... (Score:2)
Re:How very timely... (Score:4, Informative)
If 11Mbps is sufficient for your needs, you could by a 802.11b wireless card that uses the Prism 2.5 chipset. This chipset can function in hostAP mode. At home I use Netgear MA311 in an older Dell functioning as my wireless access point, internet gateway and firewall. Instead of WEP, I use IPSec, and only authorized IPSec traffic is allowed (and thus no leaching from my Kazaa loving neighbour).
You might need to flash the firmware, though, which you can find here [star-os.com].
If you want a secure, easy and hassle free gateway, just install OpenBSD [openbsd.org].
Re:How very timely... (Score:2)
Re:I have a Netgear router. (Score:2)
Re:Vendor will soon have legal problems. (Score:2, Interesting)
If I were a cynical bastard I might add that Netgear benefits twice from outsourcing its production...