dslreports logo
 
    All Forums Hot Topics Gallery
spc
uniqs
51
Mele20
Premium Member
join:2001-06-05
Hilo, HI

Mele20 to Daniel

Premium Member

to Daniel

Re: Raising Awareness: Another CSRF Attack (Linksys)

How would some attacker get my router password? I can't even get it. I've been locked out of my router's interface since last summer when I enabled UPnP and didn't know that I had to then retype the password twice due to a bug in the Linksy. Consequently, the password was reset to something random. Even if my password did work how would the attacker get it? Ask me for it? So, this is just something that affects gullible users?

Daniel
MVM
join:2000-06-26
San Francisco, CA

Daniel

MVM

said by Mele20:

How would some attacker get my router password? I can't even get it. I've been locked out of my router's interface since last summer when I enabled UPnP and didn't know that I had to then retype the password twice due to a bug in the Linksy. Consequently, the password was reset to something random. Even if my password did work how would the attacker get it? Ask me for it? So, this is just something that affects gullible users?
Since you appear to be in too much of a rush to read either the thread or the linked article, the attack works by using default passwords. As far as getting into your router goes, I suggest you spend 45 seconds resetting it and reconfiguring it. For all you know someone else could be in control of your router, which is markedly...sub-optimal.

Anonymooose
@giantlogic.net

1 recommendation

Anonymooose

Anon

that would be too freakin easy

Grail Knight

Premium Member
join:2003-05-31
Valhalla

1 edit

Grail Knight

Premium Member

PEBUAK

Edit* Seriously though she has been told before to reset that router but does not want to due to using some beta firmware that she failed to back up if I remember the story correctly.

For all she knows that router is being controlled by the CIA.

La Luna
Fly With The Angels My Beloved Son Chris
Premium Member
join:2001-07-12
New Port Richey, FL

La Luna

Premium Member

said by Grail Knight:

PEBUAK
heh....
Mele20
Premium Member
join:2001-06-05
Hilo, HI

Mele20 to Daniel

Premium Member

to Daniel
said by Daniel:
said by Mele20:

How would some attacker get my router password? I can't even get it. I've been locked out of my router's interface since last summer when I enabled UPnP and didn't know that I had to then retype the password twice due to a bug in the Linksy. Consequently, the password was reset to something random. Even if my password did work how would the attacker get it? Ask me for it? So, this is just something that affects gullible users?
Since you appear to be in too much of a rush to read either the thread or the linked article, the attack works by using default passwords. As far as getting into your router goes, I suggest you spend 45 seconds resetting it and reconfiguring it. For all you know someone else could be in control of your router, which is markedly...sub-optimal.
You are right that I didn't have time to read everything and you didn't say this only involves some idiot who leaves the password as "adminstrator". Geez...you made this sound scary when it is just another stupid idiot who shouldn't have a computer or a router if they can't even be bothered to change a password! A dim bulb like that probably can't even find their way to a porn site which would be the only reason they would get a computer.

As far as my problem, considering that the bug in the router firmware caused an instant RANDOM password to be chosen the moment I failed to type the password two times after I enabled UPnP would indicate that someone trying to get into my router would have to spend a lot of time cracking the random password. Linksy told me it is impossible to crack it. I can't crack it and I've tried every suggestion from various sources. Yes, the solution is to do a factory reset which then makes me unable to use Ping Plotter because Linksy never bothered to make beta firmware to correct the Ping Plotter and other problems caused by the last official firmware version in the USA. They did issue the beta firmware in Europe as official firmware but told me the USA users are too stupid to need the firmware so the last official version of the firmware for USA users is horrible.

Thus, I have beta firmware which I would have find again on the internet. Linksy won't send it to me and told me that USA users are not intelligent enough to use it. I prefer to leave the router as is until I have to get into it. It is an older router (4 years, 4 months) and might not even take a firmware flash again. I'm not going to risk that unless I absolutely have to get into the router.

Bink63
Namedrop THIS
Premium Member
join:2002-10-06
Everywhere

1 recommendation

Bink63

Premium Member

said by Mele20:

As far as my problem, considering that the bug in the router firmware caused an instant RANDOM password to be chosen the moment I failed to type the password two times after I enabled UPnP would indicate that someone trying to get into my router would have to spend a lot of time cracking the random password. Linksy told me it is impossible to crack it. I can't crack it and I've tried every suggestion from various sources. Yes, the solution is to do a factory reset which then makes me unable to use Ping Plotter because Linksy never bothered to make beta firmware to correct the Ping Plotter and other problems caused by the last official firmware version in the USA. They did issue the beta firmware in Europe as official firmware but told me the USA users are too stupid to need the firmware so the last official version of the firmware for USA users is horrible.

Thus, I have beta firmware which I would have find again on the internet. Linksy won't send it to me and told me that USA users are not intelligent enough to use it. I prefer to leave the router as is until I have to get into it. It is an older router (4 years, 4 months) and might not even take a firmware flash again. I'm not going to risk that unless I absolutely have to get into the router.
You do realize that a factory reset only puts the router's settings back to factory defaults, but doesn't roll back the firmware to a previous version, right?

Your firmware will remain the same version, unless you flash it to a different version.

Regards,

Randy

Grail Knight

Premium Member
join:2003-05-31
Valhalla

Grail Knight to Mele20

Premium Member

to Mele20
Is the firmware you are using in this list?

»ftp://ftp.linksys.com/internat ··· irmware/
Mele20
Premium Member
join:2001-06-05
Hilo, HI

Mele20

Premium Member

said by Grail Knight:

Is the firmware you are using in this list?

»ftp://ftp.linksys.com/internat ··· irmware/
No, the first beta firmware I got was there and later Linksy said it was made official in Europe but not in the USA. I got a more recent beta firmware. I can find it again probably but I don't want to mess with the router unless I have to....I have a bad feeling about doing a factory reset on it. (Plus, my APC UPS with a new battery as of 8/2007 is acting strangely and putting the computer into standbye for no reason and if it did that during a firmware flash....ugh. APC told me to try a manual recalibration of the unit which is a hassle, and I can't use the computer during that time, so I haven't done it yet).

Grail Knight

Premium Member
join:2003-05-31
Valhalla

Grail Knight

Premium Member

Another user already has informed you that a reset to defaults does not roll back the firmware you have.

It is even true for my lowly Mp3 player. I can reset it a million times and the same firmware version I was using before resetting is still there.

If it was me I would have reset that router and been done with it by now. You should have made a backup of the firmware.
Mele20
Premium Member
join:2001-06-05
Hilo, HI

Mele20

Premium Member

A factory reset resets the firmware also. Linksy told me this.
SNUSA
join:2008-02-20
USA

SNUSA to Mele20

Member

to Mele20
Mele20,

Had the same problem enabling pnp on linksys. (I have the most current firmware on the router too.) Resetting & re-flashing the router works fine. If I recall, there is another way. I think that I gained access back by entering root or admin as the user ID in the routers web gui. Can't remember though. This is a secondary router behind another router at work, so I can't check the model, (seasonal business) but I bet it's the same one. Might have used (user & password fields): root / root, root,admin, admin,root or root,ORIGINAL PASSWORD. Something got me back in. (First time, before I realized there was a bug, I reset the router. Second time I just got lucky, having recently used dd-wrt firmware on another router.
Mele20
Premium Member
join:2001-06-05
Hilo, HI

Mele20

Premium Member

It's a known, common problem but I found that out AFTER it happened to me. There was NO prompt to type the password twice after I made the change to enable UPNP. There are a lot posts around the internet from folks with this router and this problem and posts at this site too. I tried entering "admin", "administrator" and several other words and numbers that I was given by others that "frequently" worked...none worked for me.

Over at Linksy web site forums, I found others with the same router posting, just at the time I posted, with the same problem. They had to finally do a factory reset and that reset the firmware also. Some of them had beta firmware like me. I had a copy of it...I don't know where it went...but the beta firmware I use is about three years old and I have gotten a new hard drive, and cloned the old drive to the new, but I don't see this firmware. It may be somewhere on the drive. I couldn't find my favorite application exe file a few days ago. I almost panicked as the vendor no longer exists ...but I did have it burned on a CD...didn't think to burn the router firmware.

EGeezer
Premium Member
join:2002-08-04
Midwest

EGeezer

Premium Member

losing passwords

SupportInfo.xls.zip
3,437 bytes
Excel formet
SupportInfo.html.zip
904 bytes
HTML format
You and others might find this handy - A template I use for critical login info, since I don't use password "vaults" for such purposes.

Alter as desired, use - or not. type in the information on the computer or just print out a blank form and enter with pen(cil).

NetFixer
From My Cold Dead Hands
Premium Member
join:2004-06-24
The Boro
Netgear CM500
Pace 5268AC
TRENDnet TEW-829DRU

NetFixer to Mele20

Premium Member

to Mele20

Re: Raising Awareness: Another CSRF Attack (Linksys)

said by Mele20:

A factory reset resets the firmware also. Linksy told me this.
The Linksys CSR who told you this is either very ignorant, or is just feeding you a line of BS to get you to go away. I have been doing computer and network support for over 40 years, and I have yet to see a Linksys (or any other brand) SOHO router magically find its original (overwritten) firmware and use it to overwrite the existing firmware when doing a hardware factory reset. If your Linksys can do this it is indeed a magical device.

Grail Knight

Premium Member
join:2003-05-31
Valhalla

1 recommendation

Grail Knight to Mele20

Premium Member

to Mele20
Come on Marilyn from all the time you have spent talking to various CSRs and then posting how many of the times they have been wrong does it not make sense you were fed wrong info from Linksys.

Other members here are telling you that you will not lose your firmware by resetting your router. I know this is the case as I said from my lowly Sansa Mp3 Player and I know I can do it with my router which is also a Linksys. I only did not mention my router in my other post because another member stated the facts of resetting your router.

Jerm
join:2000-04-10
Richland, WA
·Ziply Fiber

Jerm to Mele20

Member

to Mele20

*sigh*

said by Mele20:

I've been locked out of my router's interface since last summer ... you made this sound scary when it is just another stupid idiot who shouldn't have a computer or a router ... I have a bad feeling about doing a factory reset on it ... the beta firmware I use is about three years old
I'm sorry Mele20 but you really should consider updating your firmware. I use pingplotter all the time and have no issues with it.

Secondly, I'm not sure where all the FUD in this thread is comming from - but this exploit HAS NOTHING AT ALL TO DO WITH DEFAULT USERS/PASSWORDS.

It is simply stating if a user is *already logged* into the router (that has a default IP address) and then clicks that link it will execute. Also because there was no timeout on the login session for earlier Linksys revisions this exploit could be used (perhaps) at a later time. This is all completely regardless of what user name and password is on the router.
Mele20
Premium Member
join:2001-06-05
Hilo, HI

1 edit

Mele20

Premium Member

said by Jerm:
said by Mele20:

I've been locked out of my router's interface since last summer ... you made this sound scary when it is just another stupid idiot who shouldn't have a computer or a router ... I have a bad feeling about doing a factory reset on it ... the beta firmware I use is about three years old
I'm sorry Mele20 but you really should consider updating your firmware. I use pingplotter all the time and have no issues with it.
I said that I am using the latest beta firmware . It is about three years old. Where do I find non-existent more recent beta firmware for this router? The most recent official (2004) firmware does not work with Ping Plotter's TCP engine. The last official firmware for this router was issued about one year after it was put on the retail market.

I can't use the ICMP engine now as my ISP and many, many sites block ICMP echo return. TCP must be used. When I was beta testing Ping Plotter Pro before it first came out and Pete put in the new TCP engine, I couldn't use Ping Plotter unless I removed the router as the router kept Ping Plotter Pro from showing the hops and names. I would see hop one only. Pete went and bought the very Linksy router I have and tested with it and had the same problem I was seeing. Pete got some software that would allow him to enter my computer remotely (this was before support personnel were doing this like so many do now) and I installed the software and he was in and out of my computer on several occasions gathering data so he could get his new Ping Plotter Pro to work right on XP with WinPcap and also with my router with its problems.

He is the person who actually found me the beta firmware that works with WinPcap that has to be used on XP and works with the Ping Plotter Pro TCP engine. Both the Ping Plotter developer and I notified Linksy of the problem. Linksy refused to make the beta firmware official and they never have issued any firmware, that I am aware of, since that beta that I use. The last time I called Linksy, and my router was three and one-half years old, I was told that Linksy does not support products that are older than two years and mine was too old for them to help me or even answer a brief question. I was referred to their site instead. Of course, I had first gone to their site and read what help was there before I called and I was not asking for lengthy step by step support just for an answer to a question.
mikenolan7
Premium Member
join:2005-06-07
Torrance, CA

1 recommendation

mikenolan7

Premium Member

Mele: I have done a LOT of testing with various NAT routers and OpenWRT. I can assure you that a factory reset on a Linksys router will not reset the firmware to the original version. That doesn't guarantee that you won't experience any problems, but they won't be due to the firmware being reset. I'll even make you a guarantee. I have a number of factory refurbished WRT54GS's from my testing that I don't use any more. If you brick your router, I will mail you one (with the latest Linksys firmware loaded), and you can mail me your brick after you receive it. The bricks can almost always be recovered.

Make your own choice about resetting your router, I'm not trying to encourage you either way. I just don't want you to feel your security is compromised, because I am certain that you received bad information from the Linksys rep.

If you prefer, I will even mail you the WRT54GS before you reset your router, so you have no down time concerns. You can then mail me back either router. Please feel free to respond by IM, if that is more comfortable for you.
Mele20
Premium Member
join:2001-06-05
Hilo, HI

Mele20

Premium Member

Thank you, but I like the router I have (although I wish it did dhcp properly). It is a wired one. I don't want a wireless one although eventually, when this one dies, I guess I'll have to get a wireless one since I don't see many wired ones anymore and none in the stores here. There is a fourth version of this wired Linksy router that is current but I see a great number of warnings on the internet to not get it. Ver 1-3 were so-so to ok..current ver 4 is awful from what users say. Supposedly, the version I have is considered the best version. So, I don't want to risk problems with it. It works fine and unless/until I have to get into the interface I will leave it as is.
33591094 (banned)
join:2002-11-19
Canada

33591094 (banned) to Mele20

Member

to Mele20

Re: Raising Awareness: Another CSRF Attack (Linksys)

said by Mele20:

A factory reset resets the firmware also. Linksy told me this.
It does not, and LOOK! Yet another thread derailed by mele.