get ready to be shaved," as the old Spanish saying goes. What I'm trying to say is that we should be aware of the problems arising in other countries that use technologies similar to ours. More precisely, as my colleagues in Mexico pointed out in the Spanish version of this blog, I'm talking about incorrectly customized broadband routers delivered to new users, which cause unnecessary security weaknesses.
Unluckily for us, the Mexican issue is not an isolated one. Here in Spain we have quite an accute problem, especially in ADSL routers. I recently read in Bandaancha that it's no longer necessary to trojanize the computers in order to make DDoS attacks. Incorrectly preconfigured ADSL routers can be used as additional zombies on the wild, replying to DNS queries from the WAN side. At least for the moment, no profit can be made from it, but the attackers gain the ability to remotely manage routers. What if they include a sniffer in a vanilla firmware that reports back to a botnet any logged data? This is not as easy as using traditional methods, but it's still a chance.
I was concerned after reading it, but I didn’t think it was strange at all. We have a long-term, unresolved problem. It started when the first ADSL lines appeared. Simply put, ISPs couldn't cope with the growing demand of ADSL lines, so there was no time for them to worry about security. A lack of both know-how and capability of foreseeing future issues have not helped either. Until today, the number of broadband users has been increasing, and the security problems in the routers that the clients receive from ISPs remain unresolved.
To summarize, most ADSL routers for home clients still come with these security flaws:
Unluckily for us, the Mexican issue is not an isolated one. Here in Spain we have quite an accute problem, especially in ADSL routers. I recently read in Bandaancha that it's no longer necessary to trojanize the computers in order to make DDoS attacks. Incorrectly preconfigured ADSL routers can be used as additional zombies on the wild, replying to DNS queries from the WAN side. At least for the moment, no profit can be made from it, but the attackers gain the ability to remotely manage routers. What if they include a sniffer in a vanilla firmware that reports back to a botnet any logged data? This is not as easy as using traditional methods, but it's still a chance.
I was concerned after reading it, but I didn’t think it was strange at all. We have a long-term, unresolved problem. It started when the first ADSL lines appeared. Simply put, ISPs couldn't cope with the growing demand of ADSL lines, so there was no time for them to worry about security. A lack of both know-how and capability of foreseeing future issues have not helped either. Until today, the number of broadband users has been increasing, and the security problems in the routers that the clients receive from ISPs remain unresolved.
To summarize, most ADSL routers for home clients still come with these security flaws:
- Poor wireless preconfiguration
- Default users
- Lack of proper remote management
- Lack of automatic updates
Yet it seems that computers are still regarded as the most vulnerable target, ignoring the poor router configuration factor. It's important to keep in mind that, today, routers are not that different from PCs; they feature their own CPU, ROM, RAM and, usually, embedded GNU/Linux OS. Cable providers have had a more thoughtful approach when deploying network devices, as the users aren’t supposed to configure the router by themselves. They come already configured out-of-the-box, with DHCP hosted at the cable ISP.
I think that those who should worry the most are ISPs offering ADSL services. Sure, there are daring users who might, unwittingly, misconfigure their routers, but those are the minority. Most home users don’t change their router’s settings. Problems like DNS Amplifictation shouldn't exist, because all that’s needed to avoid them is proper configuration and remote management. Today, no one would expect a mail administrator to configure the company MTA in an open relay. Such behavior would be considered unprofessional, to say the least. Why shouldn’t the same apply to network engineers?
Is it possible to solve the problem remotely with some kind of massive firmware upgrade and reconfiguration, or is the system fatally wounded and the routers need to be entirely replaced, much like what happened with SECA/NAGRA? I'm afraid the latter is more likely to happen, with the added problem that the cost is considerably higher than that of sending one million bug-free smartcards. So why do they keep installing flash memories on the routers? It may be worth going back to the good-old mask ROM much cheaper and with a nice retro look.
Álvaro Ramón
S21sec labs
