D-Link routers found to contain backdoors
来源:互联网 发布:免费的域名是什么样 编辑:程序博客网 时间:2024/05/22 12:28
Known since 2010.
An easily exploitable backdoor that provides full control over the device has been discovered in several routers made by D-Link, potentially putting networks and user data at risk.
Security researcher Craig Heffner of Tactical Network Solutions discovered the backdoor by disassembling the version 1.13 D-Link firmware for the DIR-100 and discovered the alpha_auth_check function inside it.
After some detective work Heffner, who specialises in embedded systems, worked out that the function opens up a backdoor into popular consumer DSL and wireless routers.
By setting the user-agent identifier in a web browser to the string "xmlset_roodkcableoj28840ybtide", anyone can access the administrative web interface on certain D-Link routers, without authentication.
Heffner tried on a DI-524UP wireless router and confirmed that setting the user-agent to the above string provides full control over the device.
Spelt backwards, the string reads "Edit by Joel 04882 backdoor". At this stage, it is not known who Joel is. According to Heffner, the firmware appears to have been modifled by D-Link spin-off Alpha Networks, but it isn't known if the company inserted the backdoor.
Heffner believes several D-Link devices have the backdoor in their firmware, and listed the below models as likely to be vulnerable:
- DIR-100
- DI-524
- DI-524UP
- DI-604S
- DI-604UP
- DI-604 +
- TM-G5240
Several of the above D-Link routers have been or are sold in Australia currently, and iTnews was able to replicate Heffner's findings on a Dl-604 router.
Two models from Japanese vendor Planex are also listed by Heffner as being vulnerable, namely the BRL-04UR and BRL-04CW routers, as they use the same D-Link firmware.
The exploit has been know since at least 2010, when it was mentioned in Russian Internet forums. It has also recieived a mention on the Russian Incontact or VK social network after Heffner's blog post.
VK has around 228 million users currently.
iTnews has sought comment from Heffner and D-Link on the backdoor discovery, and will update the story when it becomes available.
Copyright © iTnews.com.au . All rights reserved.
关于对后门的分析文章
http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/
- D-Link routers found to contain backdoors
- Mysql To Charts(五)--routers文件
- VTKError:no override found for 'vtkImageMapper' 和Link to vtkInteractionStyle
- To use the default BatchConfigurer the context must contain no more thanone DataSource, found 2
- CMake Error: The source directory "D:/opencv" does not appear to contain CMakeLists.txt.
- IPSec Site-to-Site between routers over PIX
- JUNOS (Juniper) Flaw Exposes Core Routers to Kernel Crash
- Error: no override found for 'vtkPolyDataMapper'. 和Warning: Link to vtkInteractionStyle for default
- 3D Link
- D-Link路由器设置
- Routers & switches
- Linking Routers
- Hosting backdoors in hardware
- j-link出现CPU could not be halted;no sw-dp found;Too many errors to display
- How to validate output contain special string
- Link to Wangzhai
- Spring Link to db
- Link To Sql简单
- Android实例
- MDK V4.72/4.7 ULink2调试中的bug
- PreTranslateMessage作用和使用方法
- The Double life of Alf Bloggs
- 【贪心】tyvj P1260 最优分解方案
- D-Link routers found to contain backdoors
- 并发和竞态
- Unity3D使用SVN进行版本控制(unity3d3.5 or later)
- CAD的一些基本操作(快捷键)
- 终止正在运行的屏幕保护程序
- 一个fork的面试题
- vim基本操作
- 一个SQL Server转SQLite数据库的小工具(SQL Server To SQLite DB Converter)
- 配置管理(可参考用于hadoop集群部署)