Some Netgear routers vulnerable to hackers R7000 R6400 R8000

Some Netgear routers vulnerable to hackers R7000 R6400 R8000
Posted by Homer J Simpson on 13 Dec, 2016 01:19
http://laptops.reviewed.com/news/own-one-of-these-routers-it-may-be-vulnerable-to-hackers?utm_source=usat&utm_medium=referral&utm_campaign=collab

Netgear Statement;

http://kb.netgear.com/000036386/CVE-2016-582384

#1 Reply
Posted by Ampera on 13 Dec, 2016 02:50
At least it's a router buggering up instead of an IoT device.

It's all the computerized garbage that gets screwed over. It used to be your printer was attached to your LPT port and you used it, not you have to install an update every month to fix it, if your lucky enough to still have updates for the thing.

This is why we can't have nice things...

#4 Reply
Posted by Monkeh on 13 Dec, 2016 16:43
The affected list should be pre-emptively amended to include every model of garbage router they make - safer that way, and likely to be accurate..

#6 Reply
Posted by DimitriP on 13 Dec, 2016 19:52
I can't get my R7800 to behave the way the article describes ...I guess mine is "broken".

#7 Reply
Posted by KE5FX on 13 Dec, 2016 22:50
I don't understand how this would be exploited externally. Going by what's on the kalypto.org page, the exploit is triggered by accessing the internal NAT address of the router, e.g. http://192.168.xxx.xxx/cgi-bin/;telnetd$IFS-p$IFS’56789? . I guess the concern is that a malicious page might issue a redirect to an address like that?

#8 Reply
Posted by Ampera on 14 Dec, 2016 00:31
Quote from: KE5FX on 13 Dec, 2016 22:50
I don't understand how this would be exploited externally. Going by what's on the kalypto.org page, the exploit is triggered by accessing the internal NAT address of the router, e.g. http://192.168.xxx.xxx/cgi-bin/;telnetd$IFS-p$IFS’56789? . I guess the concern is that a malicious page might issue a redirect to an address like that?

Netgear says any old webpage you go to can execute arbitrary commands on the router's (I'd assume bash) interface. This is bad as this may be able to allow external traffic normally not allowed to access the network to just waltz right in. Sky's the limit with this one.

#9 Reply
Posted by stj on 15 Dec, 2016 04:26
routers, like phones, are things you should replace the badly written / spyware infested firmware on as soon as you take them out of the box!

#11 Reply
Posted by Ampera on 15 Dec, 2016 06:40
The only really good routers are PFSense boxes. Everything else is a monetary compromise, it's only a matter of how much of one.

#12 Reply
Posted by R005T3r on 15 Dec, 2016 13:45
Okay,

I've followed the instructions in the link provided above by the letter, using a linux shell and a specifically installed browser. First of all, the browser say "404 file not found" and second using the telnet command the shell says "Connection Refused" This mean, my router even if it's listed above, it's not vulnerable to this.

So, before installing the beta firmware, check if your router is actually vulnerable. If not, wait until the firmware is fully tested and relased!

#13 Reply
Posted by madires on 15 Dec, 2016 14:06
Quote from: TwoOfFive on 13 Dec, 2016 16:45
NETGEAR is now on my list of, never buy from, along with Sony, Apple, and more.

Actually you would need to add ALL well known manufacturers of SOHO routers. They all had/got major security issues. Either get a router supported by OpenWrt or go for a PC based pfSense (or some other open source firewall/router). Other options are AVM Fritzbox or a professional SOHO router, like LANCOM. Both had only a few issues so far, and both companies provide updates for more than just 2 years (about 5-10 years).

#14 Reply
Posted by madires on 15 Dec, 2016 14:19
And we got another exploit kit attacking about 160 routers from different manufacturers via malvertising:
https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices
So much for blocking ads is bad (for the websites earning money that way). Serving malvertising is worse.