Is Your Biggest Cyber Vulnerability Your Router?

Is Your Biggest Cyber Vulnerability Your Router?

TheBestVPN found vulnerabilities in several big name routers.

Internet routers could be affected by a major security flaw that could let hackers infiltrate your home network.

Research from TheBestVPN found vulnerabilities in routers from some of the biggest device manufacturers around today, including those from NetGear, D-Link and ZTE.

The research team found that all three contained software flaws that could allow malicious access, which TheBestVPN says could result in, "a complete takeover of your router".

The team says that the hack process is relatively straightforward, with the criminals simply needing to create a page with a basic JavaScript or html form. When a user clicks on this or lands on the webpage, external functionalities can be launched, allowing personal data can be exploited.

Craig Young, a computer security researcher for Tripwire’s Vulnerability and Exposure Research Team (VERT), says TheBestVPN is describing a multiple cross-site request forgery (CSRF) attack.

"The premise of CSRF is that an attacker can trigger a victim’s web browser to make HTTP requests to another web site without the target site recognizing that the request was forged," Young said. "In this case, the targeted web site would most likely be the web page for controlling router settings, but it could also be a server used for media streaming or file sharing. In most cases, a CSRF attack requires that the victim is logged into the vulnerable web site, but routers often have vulnerabilities which can be triggered by unauthenticated HTTP requests."

Since the devices are older, Young wonders if a security fix will be made available.

“A quick Google search indicates that these are all older devices which raises an interesting question of whether security fixes will be made available," Young said. "For a successful CSRF attack, the attacker needs to locate the victim’s router to relay an attack. An advanced user can thwart unsophisticated attempts to exploit these bugs by simply using a less common router address like 10.9.8.7 instead of 192.168.0.1. A more complete fix however would be to actively disable the HTTP management interface of the router so that it cannot be attacked.”

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.