back to article Netgear prodded into patching SOHOpeless broadband router

Yet another vulnerability in a SOHO broadband router that flew under the radar is starting to cause trouble in the wild. The authentication bypass in Netgear's WNR1000v4 device is documented here by Compass Security and in more detail by Shellshock Labs here. The short version, from Compass, is this: “an attacker can access …

  1. Ralph B

    July to October

    The delay in fixing this was probably not in implementing the actual code change, but in agreeing with the various national security agencies about what the replacement backdoor URL(s) should be called. There's certainly a process for this "compliance" stuff.

    1. dogged
      Stop

      Re: July to October

      Take off the tinfoil hat. One look at how the vulnerability works will tell you this in is not evil, it's just incompetence.

      1. Roger Lipscombe
        Big Brother

        Re: July to October

        That's the best kind of evil: plausible deniability.

  2. Lee D Silver badge

    You know, I get that there's no such thing as a secure system, but the sheer number of TRIVIAL classes of attacks that are successful on even top-end branded commercial products is just scary.

    It's like nobody ever even tried to think "What if someone wanted to get into the device?" and tried out a couple of ways of doing so.

    I don't expect a device to be perfect but when the bypasses are as trivial as "own a model of your own, find out the success page URL, splat that across the Internet and then anyone can get in to any router", companies really need to sit up and pay attention to at least THAT CLASS of security bugs, if not a proper security audit.

    Similarly predictable default password, XSS to enable password reset or admin access, etc. Netgear, Cisco,etc. are big enough and ugly enough to sort their junk out before it leaves the factory for these kinds of things. It's not like a secure login process to an internal website is a rare thing, or even that all their models differ so much that they can't use standard libraries or the same code to do so.

    I don't expect "secure against all attacks" but I at least expect "secure against a 10 year old with ten minutes of playing about with similar models".

    1. Ian Michael Gumby

      @Lee

      Which 'commercial' routers are vulnerable?

      The truth is that these routers that are the most vulnerable are the consumer grade routers.

      I made the serious investment into Meraki hardware when I got a call from my local ISP that my wi-fi router was pawned while I was working overseas.

      Now I couldn't fix it right away, but I was able to locate a vendor and purchase the kit so it was at my SOHO when I got home on my leave. Is it perfect? No, but it also let me find every other pawned routers in the area that was clogging up the airwaves.

      The bottom line, when you run a SOHO, you need to take things like security a bit more seriously.

  3. paulf
    FAIL

    No surprise with Netgear

    When they EOL top of the range routers within a year of release the only surprise is that they're bothering to put out a patch at all. I can only assume bad publicity does focus minds in these companies so good on El Reg for the SOHOpeless campaign.

    I bought a DGND3700 v1 back in 2011 that went into EOL 9 months later despite it still having various bugs in the ADSL modem part of the firmware. Cost was about £120 so not exactly a cheap landfill router flung out for "free" by an ISP. Only constant nagging at support about it got a solution through a Beta version of the firmware (still not published on their website) which mostly fixed the problem.

    As a result, that was my last Netgear product which is a shame. Oddly they still fling out occasional security updates to their SPARC NAS boxes even though they're older than my router.

    1. aftermath99

      Re: No surprise with Netgear

      Me too!

      What do you buy now instead? Anyone have recommendations?

      1. PMJ

        Re: No surprise with Netgear

        I've been looking around and am buying a DrayTek 2860N. Expensive but I can't take the hassle of dealing with Netgear problems any more.

        1. Martin an gof Silver badge

          Re: No surprise with Netgear

          I've been looking around and am buying a DrayTek

          Ditto - though not that exact model. I've installed a few Drayteks recently and they do seem to be reasonably reliable if all the usual precautions are taken. Interesting that I've yet to spot Draytek being mentioned in articles listing vulnerabilities. Probably doesn't mean they're immune (just as likely means I haven't looked hard enough), but can't be bad that they don't populate the headlines.

          M.

        2. Timbo

          Re: No surprise with Netgear

          "I've been looking around and am buying a DrayTek 2860N. Expensive but I can't take the hassle of dealing with Netgear problems any more."

          I used to always use Netgear, but after a series of issues, I swopped over the Draytek - I had Vigor 2600's and 2800's in use.

          However, they used to get very hot, and would drop out or lock up on numerous occasions requiring a power cycle. In the end, I had to use a mains timer to shut the Drayteks off maybe twice a day, (when they were unlikely to be in use much - so lunchtimes and overnight) in order to ensure they were a bit more reliable. In one case, I had to run a USB-powered fan over one of the 2800's, as it became very warm. (I replaced it with another 2800 and that did the same thing - so not likely to be a router fault).

          One thing I did like was the options in the router admin section - full featured and very configurable.

          Their UK website also has plenty of functionality to upgrade/downgrade the router OS as well.

      2. paulf
        Thumb Up

        Re: No surprise with Netgear

        @aftermath99

        I've not had to replace it yet so not investigated in anger. I probably ought to on the assumption it's almost certainly not secure! I was freed from the crappy ADSL firmware side two years ago when I went FTTC so now its Ethernet WAN port plugs into the BT Openreach VDSL modem (which has been pretty flawless). I suppose that's the really frustrating thing - I've always found Netgear hardware to be pretty solid (in my experience - YMMV) but the software is left to bit rot within 12 months of launch.

        I was going to say that although I've not bought one myself I keep hearing good things about DrayTek's products when this kind of thing comes up on El Reg, although they are expensive. I see two others have also commented positively about DrayTek so they're top of my list when the Netgear does go pop.

      3. Bronek Kozicki

        Re: No surprise with Netgear

        I'm using FireBrick, but they are more like firewalls with WAN port (as many as you want, if you bother with VLANs) and LAN ports (ditto) supporting all the usual broadband protocols, rather than your regular broadband routers. They only have 4 physical RJ45 ports, do not have WiFi (buy AP instead) and they require external modem(s) in bridge mode. On the other hand, the things you can do with routing, firewall rules and logging ... you probably cannot do with anything else (in this price class - custom machine aside). Also, their firmware is updated by the vendor automatically (if you want that).

      4. pmb00cs

        Re: No surprise with Netgear

        I have a Draytek 2860n which I upgraded to from a draytek 2820n when I went to FTTC. The VDSL modem works (you do need to set the VLAN tag, to 1 if I recall correctly, but would need to check, to get it working without the openreach modem) Happy with both of them, gave the 2820n to my folks (Still on ADSL) and it's still running fine.

      5. James O'Shea

        Re: No surprise with Netgear

        "Anyone have recommendations?"

        It depends entirely on the level of control you want/need. I have an ancient (seven years old...) Apple AirPort Extreme wireless access port. It has three Gigabit Ethernet LAN ports and a Gigabit Ethernet WAN port. It runs 802.11n. It has a single USB 2 port. It is controlled by Apple's AirPort Utility software, and does NOT have access via a HTML page. It is still supported by the latest APU version, though I use an earlier version 'cause Apple, in its infinite wisdom, removed some features from the latest version. Because there is no access via a webpage, a lot of common attacks fail from the get-go. You _must_ have some version of the APU or you can't access an APE. Furthermore, the first thing that shows up when you connect to a new APE for the first time is the login page... and you _must_ change the password. (Yes, you can go back to the default, by reseting the APE either by software or by using the paperclip hole hardware method; the first time you connect to it after reseting, you have to change the password. Again.) You are also invited to change the name of the device. And, yes, the wireless system supports WPA2 and requires a wireless key which should be different from the access password for the device. It's beginning to show signs of age, mostly dropouts and weird dead zones, and one of the LAN ports works when it feels like it, so it's been replaced by a nice shiny new APE. This one uses the same software, also has three Gigabit LAN and one Gigabit WAN port(s), and still has the single pitiful USB 2 port. However, it has dual channel 802.11ac and full IPv6 support. The pitiful USB 2 port supports printers and external hard drives, and the APU software will configure printer or disk sharing, so you can have a NAS by just adding an external drive (or more than one, if you use a hub) so long as you're willing to live with the pitiful performance of the USB 2 port. (Yo! Apple! USB 3 exists!) Allegedly there can be problems with external drives larger than 3 GB. I have not encountered such problems, but that doesn't mean that they don't exist for some people. There is a Windows client and a iOS client, but not, so far as I know, Linux or Android clients, so those using Linux or Android probably can't set up an APE. They can, however, access one, including accessing any drives or printers connected to the pitiful USB 2 port.

        Basically, Apple supports their hardware for a Very Long Time (I'm given to understand that APEs much older than my old 802.11n unit are still supported, but don't have one handy to test) and forces you to at least consider security and can't be attacked using standard methods as it simply doesn't have HTML access. On the other hand, Apple is Apple and loves to delete features because they can, and that USB 2 port really annoys me. (What? You noticed that already?) if you want the freedom to hack the box and install your own custom system and generally roam wild, go elsewhere. If you just want something which plugs into your network and quietly works and is hard for unauthorized persons to get into, while delivering good speed and NAS capabilities, then an APE may be the box for you.

        Note that the AirPort Express is an entirely different device, and probably isn't what you're looking for unless you want to stream music over your network the Apple way and only the Apple way.

      6. Ian Michael Gumby
        Boffin

        @ aftermath99 Re: No surprise with Netgear

        How much do you want to spend?

        I went with Meraki (now owned by Cisco)

        It wasn't cheap, but it has better security and I can set it up to take advantage of better security and isolating things like my TV and other consumer wi-fi appliances away from my corporate world.

        I don't know if I would recommend it for a consumer unless they were doing things like banking, investing, or corporate work from the home office.

    2. Jay 2

      Re: No surprise with Netgear

      2 years ago I attempted to replace my clunky old DG834Gv4 with first an DGND4000 then a D6200. Both went back as the firmware was bugged; WiFi would cut out if no wired device was on. Netgear support confirmed it was a bug, and suggested I roll back to a US-only firmware. When I pointed out I was in the UK, he suggested I send it back for a replacement... even though it would have the same buggy firmware.

      So after over 10 years of Netgear products, I jumped ship to Linksys and an X3500. That too had buggy firmware, but at least they eventually fixed it. Though the front end is just horrible. So when that goes I'll have to look elsewhere, maybe something that can run DD-WRT/OpenWRT.

  4. JQJ

    New firmware available.

    A new firmware is available: http://kb.netgear.com/app/answers/detail/a_id/29959

    HTH.

    JQJ.

    1. Benno

      Re: New firmware available.

      At the top of that page, it lists 8 models, yet at the bottom - 6...

      Wtf?

  5. PMJ

    So Hopeless Routers

    I've got a DGN2200 it has caused problems ever since I upgraded the firmware. DNS and DHCP is flaky and the interface is very slow.

    I tried their top of the range modem/router and it was faulty so it went back.

    Yesterday I upgraded the firmware on my DGN2200 and it bricked it. Eventually I was able download the firmware through my MiFi modem and get it working again. However, it is even more flaky and all the parts of the admin page are all showing 404. Maybe that's their new security strategy - make sure that nobody can access the router.

    Anyway, that's it! It's going in the skip along with the Netgear Wireless Access Point (which has to be rebooted every few days) and I'm replacing them with DrayTek business class devices which are expensive but I can't afford to waste any more time with crappy Netgear SoHo products.

    1. Lee D Silver badge

      Re: So Hopeless Routers

      +1 for DrayTek.

      As someone who was reluctant to move on from my WRT54G for many years (that followed me through 5 house moves and four ISP's), the DrayTek was reassuringly good. I went for a Vigor 2860Vn+ in the end.

      I'm able to QoS off my Chromecast so it can't consume the airwaves, route my analog phone through SIP services, load balance between VDSL/ADSL, 3G and Ethernet connections, run all kinds of SSIDs over 2.4 and 5GHz, integrate with everything and even add in extra wireless points without having to configure them. It's a miniature version of the stuff I play with in work, just as powerful, and has every feature imaginable.

      I'm just waiting for Virgin to tack on IPv6 support (which the router supports fully) and I'll be a perfectly happy bunny.

    2. BlartVersenwaldIII

      Re: So Hopeless Routers

      Make that a +2 for DrayTek, I've been using them at home since the halcyon days of the V2600 with the hideous "stingray" modem and have just upgraded to the 2860ac. Expensive but supports word & dog and should have a minimum five-year lifetime that should be blissfully free of random crashes and wireless dropouts if the rest of their kit is anything to go by.

      That said I do sometimes worry with a closed source router OS whether the only reason it never has embarrassing vulns like this published is because of their relatively small market share... but the lack of support for ADSL/VDSL modems in most open-source routers limits their utility for most people in the UK.

      This bug with the auth page though... it's just silly. Can anyone with a netgear router verify that repeatedly hitting http://<ROUTER-IP>/SUDO_make_me_a_sandwich.html has the desired effect?

      1. Anonymous Coward
        Anonymous Coward

        Re: So Hopeless Routers

        ADSL(2): Get a Draytek Vigor 120 and use it as a modem. Then you can use an old PC/laptop or a small embedded router with your OS of choice on it.

        VDSL/FTTC: Either use the BT provided modem or swap it out for a Draytek Vigor 130. BT will stop supplying modems at the end of this year. Then add your router.

        These for example: http://linitx.com/product/linitx-apu-1d-3nicusbrtc-pfsense-embed-firewall-kit-black/14130 come with pfSense already installed. I've deployed rather a lot of them. There are loads of other permutations.

        Tomato/OpenWRT - Just add a modem on the front!

  6. Missing Semicolon Silver badge

    Draytek? Hmm

    They are deeply weird. Unusually, they seem to not be unix-based, running some kind of Draytek-only router system. The 2930 in the office is a pain to confure, only having 20 slots for inbound NAT, for example, and having no link from the firewall to the NAT specification. A major issue is that the passwords are limited to 16 characters!

    1. Lee D Silver badge

      Re: Draytek? Hmm

      Stop using the old junk, or at least update the firmware.

  7. Bluto Nash

    Ubiquiti EdgeRouter Lite. Full featured, CLI or GUI, fast, small, relatively cheap. Very supportive community. Granted, you still need a modem.

    1. This post has been deleted by its author

  8. psychonaut

    draytek vpn

    its built in vpn is shit. dont bother trying. tried on 2 different models, 1 the other day and the other about 2 years ago.

    2 years ago, i could not for the life of me get its built in vpn server / client to connect to the dns on the network. after much talking with their support, it ended up being a firmware bug that they were sorting out. i mean ffs, fling it out, dont bother to test it.

    the recent one killed the bandwidth to 0.25mb. ripped it out and used softether instead, got 20 mbs.

    otherwise, they are pretty good i have to say!

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like