Popular Home DSL Routers At Risk Of CSRF Attack

A deadly attack typically associated with Websites can also be used on LAN/WAN devices, such as DSL routers, according to a researcher who this week demonstrated cross-site request forgery (CSRF) vulnerabilities in devices used for AT&T's DSL service.

Nathan Hamiel, a consultant and founder of security think-tank Hexagon Security Group, discovered a CSRF vulnerability in the Motorola/Netopia 2210 DSL modem that, among other things, could let an attacker insert malware onto the victim's computer or recruit it as a bot for a botnet. "CSRF is one of the only vulnerabilities that can be either completely innocuous or completely devastating," Hamiel says.

The vulnerability isn't isolated to Motorola/Netopia DSL modems. It affects most DSL modems because they don't require authentication to access their configuration menu, he says. "I can take over Motorola/Netopia DSL modems with one request, and I can do it from MySpace and other social networks," Hamiel says. The attack uses HTTP POST and GET commands on the modems, he says.

CSRF vulnerabilities are nothing new; they are pervasive on many Websites and in many devices. "CSRF, in general, is a very old issue," says Hamiel, who blogged about the hack this week. "Most of the vulns found today are old. That's the point: Nobody seems to learn lessons anymore."

CSRF flaws in home routers have been exposed before, such as the Router Hacking Challenge by hacker PDP, notes Robert ("Rsnake") Hansen, principal with SecTheory. "Using CSRF to exploit routers, while not new, is an ever-present attack that few vendors appear to be protecting against sufficiently," he says.

A CSRF attack on a DSL router could be launched from a social networking site, Hamiel says, using an image tag on a MySpace page, for example. "Everyone who viewed my MySpace page with AT&T DSL and the Motorola/Netopia DSL modem would be owned," he says.

Home users aren't the only ones at risk of a CSRF attack on a DSL router, he says. Enterprises, too, could be hacked this way. "Let's say we have Wells Fargo corporate...They have thousands of Wells Fargo home mortgage branches with five or more people working at them. They typically go with an ISP for Internet service, maybe they use a VPN connection back to the corporate office, maybe they just have some routing enabled," he says. "They may have a DSL because of their size. If one of their machines gets compromised, now an attacker has a box on the Wells Fargo network."

What can users do? "This could be mitigated if the user just enters a password for the device, which, nobody does," Hamiel says.

Trouble is, not many home users even try to log into their DSL modems. "I know people who have never even logged in to their DSL modem. The tech came out and hooked it. They were surfing the Web, and they were happy," he says. "It's not like AT&T can send a tech out to everyone's house to change the thing and instruct the user on it."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message