Is Your Biggest Cyber Vulnerability Your Router?

TheBestVPN found vulnerabilities in several big name routers.

• By Sydny Shepard
• Aug 21, 2018

Internet routers could be affected by a major security flaw that could let hackers infiltrate your home network.

Research from TheBestVPN found vulnerabilities in routers from some of the biggest device manufacturers around today, including those from NetGear, D-Link and ZTE.

The research team found that all three contained software flaws that could allow malicious access, which TheBestVPN says could result in, "a complete takeover of your router".

The team says that the hack process is relatively straightforward, with the criminals simply needing to create a page with a basic JavaScript or html form. When a user clicks on this or lands on the webpage, external functionalities can be launched, allowing personal data can be exploited.

Craig Young, a computer security researcher for Tripwire’s Vulnerability and Exposure Research Team (VERT), says TheBestVPN is describing a multiple cross-site request forgery (CSRF) attack.

"The premise of CSRF is that an attacker can trigger a victim’s web browser to make HTTP requests to another web site without the target site recognizing that the request was forged," Young said. "In this case, the targeted web site would most likely be the web page for controlling router settings, but it could also be a server used for media streaming or file sharing. In most cases, a CSRF attack requires that the victim is logged into the vulnerable web site, but routers often have vulnerabilities which can be triggered by unauthenticated HTTP requests."

Since the devices are older, Young wonders if a security fix will be made available.

“A quick Google search indicates that these are all older devices which raises an interesting question of whether security fixes will be made available," Young said. "For a successful CSRF attack, the attacker needs to locate the victim’s router to relay an attack. An advanced user can thwart unsophisticated attempts to exploit these bugs by simply using a less common router address like 10.9.8.7 instead of 192.168.0.1. A more complete fix however would be to actively disable the HTTP management interface of the router so that it cannot be attacked.”