back to article New claim: D-Link router exposes unprotected config controls to web – DNS hijackers, ahoy!

D-Link router DSL-2740R, and possible more like it, are allegedly vulnerable to DNS hijacking – which hackers can exploit to lure victims to dodgy websites and servers. According to Bulgarian security researcher Todor Donev, the flaw lies in certain builds of ZyXEL's ZynOS firmware, which is used in network hardware from TP- …

  1. This post has been deleted by its author

  2. Long John Brass
    WTF?

    Colour me shocked

    When will they learn; When will they stop rolling thier own shitty interfaces & builds

    If they got alongside the WRT guys, we could have a secure & up to date build on these trice damned boxes.

    But Noooo .... The drooling lickspittles have to nail down our ability to get a decent WRT distro on the boxes; while simultaneously allowing the window licking scipt kiddies in through the front door.

    1. Christian Berger

      Hardware vendors usually don't have the whole product in mind

      For them the firmware is just some kind of component they can source cheaply.

      Plus the chipset vendors often have pre-made or largely pre-made images available for their chipsets.

      1. John Robson Silver badge

        Re: Hardware vendors usually don't have the whole product in mind

        Because OpenWRT is *so* expensive.

        Frankly give a prototype of your router to the OpenWRT team and they'll port the code for you - then all you need to do is flash it and ship it, never need to think about upgrades again - which matches the amount of effort hey want to put in, and exceeds the effort they do put in...

    2. phuzz Silver badge

      Re: Colour me shocked

      But D-Link weren't rolling their own interface, they were borrowing (presumably buying) one from Zyxel.

  3. Tom Chiverton 1

    " expose their internal web servers to the open internet "

    No. Just no. This wasn't even a good idea 15 years ago in the 20th century.

    Maybe GCHQ and the NSA payed them to do it ?

  4. Chairo

    ISP DNS

    I stopped quite a while age using the DNS service of my ISP. Since then my connection got noticeably more stable and reliable. Unfortunately most of these cheap router boxes don't support using a different DNS other than specified over DHCP, so I had to change the setting on my devices themselves. I suppose this should also be a good workaround for having a router with hijacked DNS.

    1. John Robson Silver badge

      Re: ISP DNS

      But how often do you check?

      I don't use an ISP supplied router - I use the BT modem and PPPoE from a linux box.

      I appreciate that that isn't within most people's grasp, and assume that my WAPs are as bad as the routers, but at least they're not directly connected to the internet.

      1. Mad Chaz
        Alien

        Re: ISP DNS

        I was going to say something among those lines. Makes me glad the only way to get into my router involves ssh on the right network interface.

        What's really sad is this is the kind of stupid mistakes any kind of even 1/10th decent quality assurance would have found. I mean how hard is it to just run a port scan ONCE on the firmware before you burn it on thousands of devices? Hell, there are websites that'll do it for free for any idiot who wants to just try.

        Doesn't even involve making sure your webpage doesn't let you change things without first entering the default username/password.

        When are we going to make these people to issue recalls? No, a firmware update no one will install doesn't cut it. Force them to take the kit back and feel the financial pain.

        Alien, because it's colder then it as any right to be here, these people are stupid and I don't want to live on this planet anymore.

        Makes me want to bang my head against a wall.

        1. DropBear

          Re: ISP DNS

          Makes me glad the only way to get into my router involves ssh on the right network interface.

          Makes me glad the only way to get into my router involves ssh from a single, specific IP address. Obviously, that's not what make it secure - that's what ssh does. But it certainly does not hurt it any, and it does make it quite nice and quiet... ;)

  5. Version 1.0 Silver badge

    Supported?

    This sounds like an easy bug to fix IF it's still supported but that depends on what "supported" means to them. For most vendors "supported" translates to "still listed on the web site" - I would expect that nothing will be done to fix it - just throw it out and buy a new one ... isn't that the way the world works these days?

  6. This post has been deleted by its author

  7. John H Woods Silver badge

    Sale of Goods Act

    (IANALBIPOOTI) If I had one of these, I would be sending it back to the *seller* for a refund or replacement. We need to establish that routers that have vulnerabilities like these are simply not fit for purpose; any more than an ostensibly secure door lock than can be opened with a bit of judicious jiggling.

  8. This post has been deleted by its author

  9. Max Normal
    Facepalm

    Awesome.

    Guess what router I've got at home....

    Are D-Link going to fix it, or does anyone have a suggestion for a *cheap* ADSL router?

  10. Anonymous Coward
    Anonymous Coward

    Was that the GCHQ/NSA back-door ?

  11. Max Normal

    An update for this:

    D-Link will not allow me to submit a support query on their site as to whether they're going to fix this as my router is out of warranty...

    The only option to contact them is via a premium rate phone line.

    Future hardware purchases will be guided by this outstanding commitment to customer service!

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like