administrative login credentials in plaintext?
Cybersecurity researchers from Trustwave’s SpiderLabs have
discovered multiple security vulnerabilities in some router models
from two popular manufacturers—D-Link and Comba Telecom—that
involve insecure storage of credentials, potentially affecting
every user and system on that network.
Researcher Simon Kenin told The Hacker News that he discovered a
total of five vulnerabilities—two in a D-Link DSL modem typically
installed to connect a home network to an ISP, and three in
multiple Comba Telecom WiFi devices.
These flaws could potentially allow attackers to change your device
settings, extract sensitive information, perform MitM attacks,
redirect you to phishing or malicious sites and launch many more
types of attacks.
“Since your router is the gateway in and out of your entire network
it can potentially affect every user and system on that network. An
attacker-controlled router can manipulate how your users resolve
DNS hostnames to direct your users to malicious websites,” Kenin
says in a blog
post[1] published today.
similar vulnerability (CVE-2017-5521) in at least 31 models of
Netgear routers, allowing remote hackers to obtain the admin
password of the affected devices and potentially affecting over one
million Netgear customers.
D-Link WiFi Router Vulnerabilities
The first vulnerability resides in the dual-band D-Link DSL-2875AL
wireless router, where a file located at https://[router ip
address]/romfile.cfg contains login password of the device in
plaintext and can be accessed by anyone with access to the
web-based management IP address, without requiring any
authentication.
DSL-2877AL models and leaks the username and password the targeted
router use for authenticating with the Internet Service Provider
(ISP).
According to the researchers, a local attacker connected to the
vulnerable router or a remote attacker, in case of the router is
exposed to the Internet, can obtain victims’ ISP credentials just
by looking at the source code (HTML) of the router login page at
https://[router ip address]/index.asp.
“The following username & password are used by the user to connect
to his ISP, leaking this info could allow an attacker to use those
credentials for himself and abuse the ISP,” the advisory for the
flaw explains.
“On top of that, bad security habits of password reuse could
possibly allow an attacker to gain control of the router itself.”
January, but the company released Firmware patches on September 6,
just three days prior to the full disclosure of the issues.
Comba Wi-Fi Access Controller Vulnerabilities
Out of three, the first vulnerability impacts the Comba AC2400 WiFi
Access Controller, leaking the MD5 hash of the device password just
by accessing the following URL without requiring any
authentication.
https://[router ip
address]/09/business/upgrade/upcfgAction.php?download=true
password is 61d217fd8a8869f6d26887d298ce9a69 (trustwave). MD5 is
very easy to break, if SSH/Telnet is enabled, this could lead to a
full takeover of the filesystem of the device,” the advisory
reads.
Point (version A02,0202N00PD2).
One of these flaws also leaks MD5 hash of the device username
and password through the source code of the web-based management
login page, while the other one leaks credentials in plaintext
stored in an SQLite database file located at https://[router ip
address]/goform/downloadConfigFile.
Researchers attempted to contact Comba Telecom multiple times
since February this year, but never succeeded in receiving a
response.
All the three vulnerabilities discovered in Comba Telecom
routers are unpatched at the time of writing, and it remains
unknown whether the company has any plan to address them or
not.
References
- ^
blog post
(www.trustwave.com) - ^
31 models of Netgear routers
(thehackernews.com)
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/37HyKgE3GFM/router-password-hacking.html