Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/9/2019
05:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Verizon Patches Trio of Vulnerabilities in Home Router

One of the flaws gives attackers way to gain root access to devices, Tenable says.

Verizon has patched a trio of vulnerabilities in a router commonly used by millions of customers of the company's Fios bundled Internet access, phone and TV service.

The flaws, in Verizon's Quantum Gateway routers, if exploited, could give attackers complete control over and visibility into all devices connected to it, a researcher from security vendor Tenable reported Tuesday.

The most significant of the three flaws is a command injection flaw (CVE-2019-3914) because it allows an attacker to gain root access to the router, Tenable's security researcher Chris Lyne wrote in a blog Tuesday. An attacker can trigger the vulnerability "by adding a firewall access control role for a network object with a crafted name," he said.

In most cases an attacker would need local network access and be authenticated to the router's administrative Web application interface in order to perform the command injection. An attacker with that kind of access would then be able to configure the router for remote administration so the flaw can be exploited remotely.

The command injection flaw allows an attacker to create back doors on the router, record information and to access other devices on the same network. By exploiting it an attacker could modify security settings on the device and change firewalls rules. They could also take advantage of the flaw to sniff network traffic for banking credentials and passwords to online accounts.

Proof of exploit code for the vulnerability is available. "The exploit can be launched by providing either a plaintext password or a salted password as a command line parameter," Lyne said.

Of the three flaws that Lyne uncovered, one in fact allows an attacker to get the password by using a password sniffer to intercept login requests. That flaw (CVE-2019-3915) results from the fact that HTTPS is not used on the Web administration interface thereby giving attackers a way to replay login requests.

The third flaw (CVE-2019-3916) that Lyne discovered gives attackers a way to retrieve the value of a password salt simply by visiting a URL in a Web browser.

The type of attack enabled by the flaws doesn’t require an advanced skill set. "An attacker with an intermediate level of skill could exploit these flaws," Lyne says in comments to Dark Reading.

Verizon has issued a firmware update patching the three flaws, which are present in routers that the company supplies to new customers of its Fios service. "Users should disable remote administration on their routers and also change the router’s administrator password, so that it is different than the one" that comes with the device, Lyne notes.

Users can verify if they have the latest router firmware from Verizon by logging into the router's web interface and clicking on "System Monitoring." The firmware version that is displayed should be 02.02.00.12, which is the latest version, he says.

Small and home office routers have become ripe targets for criminals because of how easy they are to break into and use for spying on people, stealing data and launching DDoS attacks and spam at others. Adding to the lure is the fact that people have begun connecting a growing number of devices—such as IP cameras, storage devices, DVRs, and thermostats—to these devices in recent years.

Just last week, security researchers reported on a campaign where attackers are changing DNS settings on thousands of home routers so traffic to them is routed through malicious servers. Last year, a threat group believed to be sponsored by a nation-state infected some 500,000 routers and network-attached storage devices with a stealthy, modular malware packaged dubbed VPNFilter.

Many small and home office routers are relatively easy to crack because of inherent security deficiencies and seldom updated or maintained once installed. So vulnerabilities in them can persist for a long time.

Research that security vendor Avast conducted last year showed that 60% of users globally have never once updated the firmware on their routers, leaving them potentially exposed to basic attacks. In addition to using compromised routers to launch DDoS attacks, criminals are increasingly using them for cryptomining and spam forwarding as well, the Avast research showed.

"The router is the central hub of all Internet activity and a prime target for cybercriminals," Lyne says. In this particular instance, the vulnerabilities impacted home routers. "But we’re increasingly seeing targeted attacks against both consumer and business routers because they are rarely, if ever, updated," he notes.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/12/2019 | 10:48:58 AM
Re: Boiling this down
Agree on remote admin - I never manage the router from remote anywhere and ONLY do it at home at my desk.  The very idea invites hacking anyway.  Kinda like keeping the front door closed but unlocked.  Do it at your risk but most home routers have users who don't know the first thing about mostly anything. 
username007
100%
0%
username007,
User Rank: Strategist
4/10/2019 | 8:47:02 AM
Boiling this down
So lets boil this down. Routers are not really impacted by this and it takes extra work to make these exploits work. Since the default configuration does not allow for any of this to happen remotely, and by-and-far the majority of these are home routers (i.e. not public businesses), what exactly is the threat vector here... an angry teenager?

Let us get real for a minute. Are the vulnerabilities real? Of course they are but we have to take into consideration when these will actually be an issue. If a person has to be socially engineered to turn on these remote features, that means those people can be engineered to do a lot of other things too. The use cases seem stretched and if someone has access to the admin password it is expected that they can do admin things.

Adding the bit about small offices at the bottom muddies the waters here and really pulls into question why even mention it. Most users are not turning on remote admin capabilities, and those that do should be understanding the risks involved.
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16649
PUBLISHED: 2019-09-21
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the...
CVE-2019-16650
PUBLISHED: 2019-09-21
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the se...
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.