Broadband Tech > Security > Security > Home DSL Routers At Risk Of CSRF Attack

said by DarkReading :

A deadly attack typically associated with Websites can also be used on LAN/WAN devices, such as DSL routers, according to a researcher who this week demonstrated cross-site request forgery (CSRF)vulnerabilities in devices used for AT&T's DSL service.

Nathan Hamiel, a consultant and founder of security think-tank Hexagon Security Group, discovered a CSRF vulnerability in the Motorola/Netopia 2210 DSL modem that, among other things, could let an attacker insert malware onto the victim's computer or recruit it as a bot for a botnet. "CSRF is one of the only vulnerabilities that can be either completely innocuous or completely devastating," Hamiel says.

The vulnerability isn't isolated to Motorola/Netopia DSL modems. It affects most DSL modems because they don't require authentication to access their configuration menu, he says. "I can take over Motorola/Netopia DSL modems with one request, and I can do it from MySpace and other social networks," Hamiel says. The attack uses HTTP POST and GET commands on the modems, he says.

CSRF vulnerabilities are nothing new; they are pervasive on many Websites and in many devices. "CSRF, in general, is a very old issue," says Hamiel, who blogged about the hack this week. "Most of the vulns found today are old. That's the point: Nobody seems to learn lessons anymore."

A CSRF attack on a DSL router could be launched from a social networking site, Hamiel says, using an image tag on a MySpace page, for example. "Everyone who viewed my MySpace page with AT&T DSL and the Motorola/Netopia DSL modem would be owned," he says.

What can users do? "This could be mitigated if the user just enters a password for the device, which, nobody does," Hamiel says.

said by DarkReading :

...among other things, could let an attacker insert malware onto the victim's computer or recruit it as a bot for a botnet.

said by mysec:

This is not to downplay the fact that many don't secure their modem, but the examples and language used to assume the inevitable are a bit alarmist.

said by La Luna:

As with many other vulnerabilities, the non educated user is often the victim.

How many times have we seen people here who haven't changed the default passwords for their modem or router? I can only imagine how many people don't even know a configuration access page exists.

said by La Luna:

As with many other vulnerabilities, the non educated user is often the victim.

How many times have we seen people here who haven't changed the default passwords for their modem or router? I can only imagine how many people don't even know a configuration access page exists.

said by NormanS:

Every router I have ever purchased came with instructions; if only a printed sheet describing how to access the manual as a .pdf document on the included CD-ROM.

..., and many have the password printed on the router itself.

said by Smokey Bear:

A lack of easy understandable information and education are fatal for "Joe the plumber". The majority of the regular visitors of boards like DSLR or my own board know about risks and how to protect themselves. Joe don't, he don't visit our boards, many times even don't know about the existance. And expressions like "CSRF Attacks" deliver him a bad headache and taste because he just don't understand.
...
It is a real problem and there is no easy solution. We all ("professionals and experts") should evaluate ourselves again and again and thinking about ways how to help Joe.

The evolution went from changing local DNS servers in the operating system (for both Windows and Mac!) to changing DNS server settings in ADSL modems/routers/cable modems.

The malware described by Symantec goes a step further - it installs a rogue DHCP server on the network.

The victim has to execute the trojan (or get it installed through an exploit, for example through a vulnerability in their browser).

So, let's see what really happens here. The "social engineering" part has been seen million times - an unsuspecting user visits a web site with a movie on it, however, he needs to download a new codec in order to view it. On Windows, that new codec is typically a PE executable, for Mac the bad guys prepared a DMG archive (DMG files are like ISOs). The user is then prompted to install the package and during this process he will have to supply the administrator credentials. Yep, it's game over from this point in time (and the attack is exactly the same as on Windows - keep in mind that these users *will* willingly supply these credentials.

said by Smokey Bear:

Shame on the vendors, to save some bucks today it is common practice to deliver manuals as a pdf on a CD-Rom instead of supplying their products with a printed manual.

said by NormanS:

Is it really any more difficult to read the docs in a .pdf file on a CD-ROM than on paper? It isn't like Smith & Wesson shipping the manual to the pistol in a .pdf doc on a CD-ROM. (How many gun owners will take their laptop to the range!)

said by Smokey Bear:

Reading straight from an already printed manual is easy, comfortable, and save a lot of sheets and ink.