Control panel backdoor found in D-Link home routers A group of embedded-device hackers has turned up a vulnerability in D-Link consumer-grade products that provides unauthenticated access to the units' admin interfaces. The backdoor means an attacker could take over all of the user-controllable functions of the popular home routers, which includes the DIR-100, DI-524, DI-524UP …
I would have ensured a back door existed in an incredibly common driver binary for DD-WRT and received endless amusement watching people installing it to escape the other firmware I nobbled some time ago.
Is your router secure?
... although these things are normally litigated in the US, does anyone have any insight into whether the existence of a deliberately introduced massive security flaw (into a device whose function is partly to implement security between the WAN and the LAN) could count as the goods being unfit for purpose in the UK? Any law students fancy a go at a UK test case?
I can't see that it was really known three years ago. Translating the last few lines of the Russian post gives:
And there is an interesting line in the elf-binaries Web server:
xmlset_roodkcableoj28840ybtide
(Try reading it backwards)
To sum up - friends, colleagues, tell me where to find the list of users / passwords?
So it looks as though he had not followed up the lead, at least not publicly ;-)
Given that most of these devices DO support WPA2, which supports AES as well as TKIP. These have not been compromised and most of the talk about WPA2-PSK cracking has been in the same old problems: weak passwords. As for the WPS button, which IS handy so I don't have to carry wound my standard-limit WPA key around, especially to devices where entering the key is difficult, I just make sure to use it carefully so that the device is most likely to be seen first, and I check my client tables afterwards in case of intruders.
Accidentally breached a neighbour's WPA protected router. I was using Netgear wireless adapter's interface and clicked on the neighbour's SSID and suddenly was in. Backtracked and discovered that if I flipped the Netgear interface between WPA and no security the neighbour's router was accessible. I could, if I wanted, use their internet and change settings in their D-Link (as it turned out to be) router.
This was a couple of years ago and the ISP has stopped issuing that D-Link model.
Not really surprised. If at least d-link followed wifi standard properly, it would be a huge improvement. The number of dlink routers I've seen that "work fine on the old laptop", but for some reason the latest shinny laptop or tablet they got just can't connect to it would be funny if it wasn't so sad.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
