Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/9/2019
05:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Verizon Patches Trio of Vulnerabilities in Home Router

One of the flaws gives attackers way to gain root access to devices, Tenable says.

Verizon has patched a trio of vulnerabilities in a router commonly used by millions of customers of the company's Fios bundled Internet access, phone and TV service.

The flaws, in Verizon's Quantum Gateway routers, if exploited, could give attackers complete control over and visibility into all devices connected to it, a researcher from security vendor Tenable reported Tuesday.

The most significant of the three flaws is a command injection flaw (CVE-2019-3914) because it allows an attacker to gain root access to the router, Tenable's security researcher Chris Lyne wrote in a blog Tuesday. An attacker can trigger the vulnerability "by adding a firewall access control role for a network object with a crafted name," he said.

In most cases an attacker would need local network access and be authenticated to the router's administrative Web application interface in order to perform the command injection. An attacker with that kind of access would then be able to configure the router for remote administration so the flaw can be exploited remotely.

The command injection flaw allows an attacker to create back doors on the router, record information and to access other devices on the same network. By exploiting it an attacker could modify security settings on the device and change firewalls rules. They could also take advantage of the flaw to sniff network traffic for banking credentials and passwords to online accounts.

Proof of exploit code for the vulnerability is available. "The exploit can be launched by providing either a plaintext password or a salted password as a command line parameter," Lyne said.

Of the three flaws that Lyne uncovered, one in fact allows an attacker to get the password by using a password sniffer to intercept login requests. That flaw (CVE-2019-3915) results from the fact that HTTPS is not used on the Web administration interface thereby giving attackers a way to replay login requests.

The third flaw (CVE-2019-3916) that Lyne discovered gives attackers a way to retrieve the value of a password salt simply by visiting a URL in a Web browser.

The type of attack enabled by the flaws doesn’t require an advanced skill set. "An attacker with an intermediate level of skill could exploit these flaws," Lyne says in comments to Dark Reading.

Verizon has issued a firmware update patching the three flaws, which are present in routers that the company supplies to new customers of its Fios service. "Users should disable remote administration on their routers and also change the router’s administrator password, so that it is different than the one" that comes with the device, Lyne notes.

Users can verify if they have the latest router firmware from Verizon by logging into the router's web interface and clicking on "System Monitoring." The firmware version that is displayed should be 02.02.00.12, which is the latest version, he says.

Small and home office routers have become ripe targets for criminals because of how easy they are to break into and use for spying on people, stealing data and launching DDoS attacks and spam at others. Adding to the lure is the fact that people have begun connecting a growing number of devices—such as IP cameras, storage devices, DVRs, and thermostats—to these devices in recent years.

Just last week, security researchers reported on a campaign where attackers are changing DNS settings on thousands of home routers so traffic to them is routed through malicious servers. Last year, a threat group believed to be sponsored by a nation-state infected some 500,000 routers and network-attached storage devices with a stealthy, modular malware packaged dubbed VPNFilter.

Many small and home office routers are relatively easy to crack because of inherent security deficiencies and seldom updated or maintained once installed. So vulnerabilities in them can persist for a long time.

Research that security vendor Avast conducted last year showed that 60% of users globally have never once updated the firmware on their routers, leaving them potentially exposed to basic attacks. In addition to using compromised routers to launch DDoS attacks, criminals are increasingly using them for cryptomining and spam forwarding as well, the Avast research showed.

"The router is the central hub of all Internet activity and a prime target for cybercriminals," Lyne says. In this particular instance, the vulnerabilities impacted home routers. "But we’re increasingly seeing targeted attacks against both consumer and business routers because they are rarely, if ever, updated," he notes.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/12/2019 | 10:48:58 AM
Re: Boiling this down
Agree on remote admin - I never manage the router from remote anywhere and ONLY do it at home at my desk.  The very idea invites hacking anyway.  Kinda like keeping the front door closed but unlocked.  Do it at your risk but most home routers have users who don't know the first thing about mostly anything. 
username007
100%
0%
username007,
User Rank: Strategist
4/10/2019 | 8:47:02 AM
Boiling this down
So lets boil this down. Routers are not really impacted by this and it takes extra work to make these exploits work. Since the default configuration does not allow for any of this to happen remotely, and by-and-far the majority of these are home routers (i.e. not public businesses), what exactly is the threat vector here... an angry teenager?

Let us get real for a minute. Are the vulnerabilities real? Of course they are but we have to take into consideration when these will actually be an issue. If a person has to be socially engineered to turn on these remote features, that means those people can be engineered to do a lot of other things too. The use cases seem stretched and if someone has access to the admin password it is expected that they can do admin things.

Adding the bit about small offices at the bottom muddies the waters here and really pulls into question why even mention it. Most users are not turning on remote admin capabilities, and those that do should be understanding the risks involved.
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19040
PUBLISHED: 2019-11-17
KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
CVE-2019-19041
PUBLISHED: 2019-11-17
An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by th...
CVE-2019-19012
PUBLISHED: 2019-11-17
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or ...
CVE-2019-19022
PUBLISHED: 2019-11-17
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git r...
CVE-2019-19035
PUBLISHED: 2019-11-17
jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file.