10,000 Netgear Routers Hacked Via Zero-Day Flaw

More than 10,000 routers network manufacturer Netgear been hacked via a zero-day vulnerability for which no security update is made ​​available. That says Alexandre Herzog of the Swiss security company Compass Security. Through the vulnerability could allow an attacker without a valid password or user access to the admin panel.

The problem was reported to Netgear in July. In September, the network manufacturer announced that it had developed firmware for routers in which the problem was solved. It was, however, this is a beta version. Netgear did however not know when the final version would appear. On September 29, however, made another investigator same security issue known.Then Herzog decided Tuesday to place the vulnerability of details on the company website and Full Disclosure mailing list. Netgear user then let the mailing list know that he was hacked by the leak.

Herzog then asked for information from the victim, to step up the pressure on the Netgear. From the user's information appeared that his router was adapted so that all DNS requests were forwarded to the server of the attacker. The attacker would the user will have to send them to phishing sites or sites containing malware. Researchers from the Swiss security managed with a server that is to make up for the control of the infected routers compound was used. Then they found data indicating that more than 10,000 routers via the vulnerability were hacked, Herzog as late as compared Threat Post know.

The Swiss government GOVCERT would now be trying to get the server from the air and warned the providers of most victims. Which would are located mainly in the United States. To attack the vulnerability, the attack must be run from the internal network. In case the remote management is enabled, this can also be done directly from the Internet. Remote administration is not enabled by default. The problem is present in Netgear routers with the router firmware: N300_1.1.0.31_1.0.1.img and N300-1.1.0.28_1.0.1.img. This firmware is used among others in the WNR1000v4 Router.