Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/9/2019
05:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Verizon Patches Trio of Vulnerabilities in Home Router

One of the flaws gives attackers way to gain root access to devices, Tenable says.

Verizon has patched a trio of vulnerabilities in a router commonly used by millions of customers of the company's Fios bundled Internet access, phone and TV service.

The flaws, in Verizon's Quantum Gateway routers, if exploited, could give attackers complete control over and visibility into all devices connected to it, a researcher from security vendor Tenable reported Tuesday.

The most significant of the three flaws is a command injection flaw (CVE-2019-3914) because it allows an attacker to gain root access to the router, Tenable's security researcher Chris Lyne wrote in a blog Tuesday. An attacker can trigger the vulnerability "by adding a firewall access control role for a network object with a crafted name," he said.

In most cases an attacker would need local network access and be authenticated to the router's administrative Web application interface in order to perform the command injection. An attacker with that kind of access would then be able to configure the router for remote administration so the flaw can be exploited remotely.

The command injection flaw allows an attacker to create back doors on the router, record information and to access other devices on the same network. By exploiting it an attacker could modify security settings on the device and change firewalls rules. They could also take advantage of the flaw to sniff network traffic for banking credentials and passwords to online accounts.

Proof of exploit code for the vulnerability is available. "The exploit can be launched by providing either a plaintext password or a salted password as a command line parameter," Lyne said.

Of the three flaws that Lyne uncovered, one in fact allows an attacker to get the password by using a password sniffer to intercept login requests. That flaw (CVE-2019-3915) results from the fact that HTTPS is not used on the Web administration interface thereby giving attackers a way to replay login requests.

The third flaw (CVE-2019-3916) that Lyne discovered gives attackers a way to retrieve the value of a password salt simply by visiting a URL in a Web browser.

The type of attack enabled by the flaws doesn’t require an advanced skill set. "An attacker with an intermediate level of skill could exploit these flaws," Lyne says in comments to Dark Reading.

Verizon has issued a firmware update patching the three flaws, which are present in routers that the company supplies to new customers of its Fios service. "Users should disable remote administration on their routers and also change the router’s administrator password, so that it is different than the one" that comes with the device, Lyne notes.

Users can verify if they have the latest router firmware from Verizon by logging into the router's web interface and clicking on "System Monitoring." The firmware version that is displayed should be 02.02.00.12, which is the latest version, he says.

Small and home office routers have become ripe targets for criminals because of how easy they are to break into and use for spying on people, stealing data and launching DDoS attacks and spam at others. Adding to the lure is the fact that people have begun connecting a growing number of devices—such as IP cameras, storage devices, DVRs, and thermostats—to these devices in recent years.

Just last week, security researchers reported on a campaign where attackers are changing DNS settings on thousands of home routers so traffic to them is routed through malicious servers. Last year, a threat group believed to be sponsored by a nation-state infected some 500,000 routers and network-attached storage devices with a stealthy, modular malware packaged dubbed VPNFilter.

Many small and home office routers are relatively easy to crack because of inherent security deficiencies and seldom updated or maintained once installed. So vulnerabilities in them can persist for a long time.

Research that security vendor Avast conducted last year showed that 60% of users globally have never once updated the firmware on their routers, leaving them potentially exposed to basic attacks. In addition to using compromised routers to launch DDoS attacks, criminals are increasingly using them for cryptomining and spam forwarding as well, the Avast research showed.

"The router is the central hub of all Internet activity and a prime target for cybercriminals," Lyne says. In this particular instance, the vulnerabilities impacted home routers. "But we’re increasingly seeing targeted attacks against both consumer and business routers because they are rarely, if ever, updated," he notes.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/12/2019 | 10:48:58 AM
Re: Boiling this down
Agree on remote admin - I never manage the router from remote anywhere and ONLY do it at home at my desk.  The very idea invites hacking anyway.  Kinda like keeping the front door closed but unlocked.  Do it at your risk but most home routers have users who don't know the first thing about mostly anything. 
username007
100%
0%
username007,
User Rank: Strategist
4/10/2019 | 8:47:02 AM
Boiling this down
So lets boil this down. Routers are not really impacted by this and it takes extra work to make these exploits work. Since the default configuration does not allow for any of this to happen remotely, and by-and-far the majority of these are home routers (i.e. not public businesses), what exactly is the threat vector here... an angry teenager?

Let us get real for a minute. Are the vulnerabilities real? Of course they are but we have to take into consideration when these will actually be an issue. If a person has to be socially engineered to turn on these remote features, that means those people can be engineered to do a lot of other things too. The use cases seem stretched and if someone has access to the admin password it is expected that they can do admin things.

Adding the bit about small offices at the bottom muddies the waters here and really pulls into question why even mention it. Most users are not turning on remote admin capabilities, and those that do should be understanding the risks involved.
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Pledges to Not Pay Ransomware Hit Reality
Robert Lemos, Contributing Writer,  6/21/2019
AWS CISO Talks Risk Reduction, Development, Recruitment
Kelly Sheridan, Staff Editor, Dark Reading,  6/25/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12888
PUBLISHED: 2019-06-26
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-12887. Reason: This candidate is a reservation duplicate of CVE-2019-12887. Notes: All CVE users should reference CVE-2019-12887 instead of this candidate. All references and descriptions in this candidate have been removed to preve...
CVE-2019-12280
PUBLISHED: 2019-06-25
PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element.
CVE-2019-3961
PUBLISHED: 2019-06-25
Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a users browse...
CVE-2019-9836
PUBLISHED: 2019-06-25
Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and earlier has an insecure cryptographic implementation.
CVE-2019-6328
PUBLISHED: 2019-06-25
HP Support Assistant 8.7.50 and earlier allows a user to gain system privilege and allows unauthorized modification of directories or files. Note: A different vulnerability than CVE-2019-6329.