Researchers Found More Than 60 Vulnerabilities In 22 Routers

Security researchers have in 22 popular routers discovered over 60 vulnerabilities allowing attackers to execute all kinds of attacks. It involves attacks like cross-site scripting, bypassing the authentication, increasing rights and UPnP-related vulnerabilities.

Through the attacks can be performed malicious scripts on the router, it is possible to fit a user can get administrative rights on DNS servers, open certain ports, passwords can be changed, is to inject malicious code and track of log data. The researchers argue that the manufacturers, including D-Link, Zyxel, Netgear, Belkin and Huawei, have now been informed, but to my knowledge there are no updates available.

Millions Of Routers Vulnerable To Criticism NetUSB Leak

A critical vulnerability in a component that "USB over IP" functionality to routers offers ensures that millions of routers at risk. Before warns security firm SEC Consult . The vulnerability is present in the NetUSB software of the Taiwanese Kcodes.

NetUSB via USB devices such as printers, external hard drives and USB sticks that are connected to a Linux-based embedded system, such as a router or access point, are accessible via the network. For this load a Linux kernel driver that starts a server on port 20005. Standard was the feature on all devices examined on SEC Consult.

Using the vulnerability, an unauthenticated attacker got on the local network to cause a buffer overflow resulting in a Denial of Service or in the worst case, the execution of arbitrary code. In some devices, it is also possible for a remote attacker to execute arbitrary code and thus take over the device.

The problem is a large number of manufacturers, including Netgear, TP-Link, Zyxel and D-Link and probably Western Digital, and Sitecom TRENDnet. The complete list of manufacturers in the advisory to find. Users are advised to install new firmware, if available. Other solutions are blocking port 20005, or disable "USB device sharing".

Serious Leak In Wi-Fi Networks Detected And Patched Hotels

A researcher has discovered a serious vulnerability in the Wi-Fi networks of hundreds of hotels allow an attacker the wifi gateway can completely take over and use to infect visitors with malware or attack the systems of the hotel. The vulnerability is in the ANTLabs InnGate, a popular Internet gateway for hotels, conference centers and other places that offer temporary wifi access.

A vulnerability allows the equipment ensure that a remote attacker full read and write access to the file system can get. This is easily done via rsync daemon that runs on TCP port 873 and no credentials required. Once an attacker connects to the rsync daemon, normally for synchronizing files and creating backups is used, it unlimited files on the file system read and write.

Thus, it is possible to upload a gebackdoorde version of each file or add a user with root privileges. The severity of the leak is increased because it is very easy to attack. Execute any Linux or Unix system with the rsync command can attack namely.Something as researcher Brian Wallace , who discovered the problem through a few keystrokes to do.
Attacks

Once an attacker has taken over the wifi gateway can he attack other users. In the past, there are targeted attacks discovered that users of Wi-Fi networks were notified that they had to update Flash Player instance. It then went to malware via the wifi gateway by the attackers was offered. Also, an attacker can modify files that users of the Wi-Fi network to download and replaced by malware.

It is also easy to intercept unencrypted communications from users. In addition, it was found that the WiFi gateways in some cases in Property Management Systems (PMS) were integrated. These systems are currently being used for hotel reservations, customer data, payroll and many more things. In addition, a PMS for and used by multiple locations. By integrating an attacker can attack the PMS itself. Through the PMS would then be possible to attack other hotel locations.

Wallace performed a scan on the Internet and discovered 277 vulnerable devices in 29 countries, including the Netherlands. ANTLabs yesterday released an update for the vulnerability. However, it is not known if that is installed already by all vulnerable hotels. System administrators can also prevent abuse of the vulnerability by blocking Internet access to the Rsync process

D-Link Routers Vulnerable To DNS Hijacking

Different routers network manufacturer D-Link contains a vulnerability which can modify a remote attacker without credentials the DNS settings of the devices. This allows the attacker to the movement of the hacked router running through its servers, reports PC World .

The vulnerability is in the ZyNOS router firmware, developed by manufacturer ZyXEL. In addition to D-Link's firmware is also used by other manufacturers, including TP-Link and ZTE. Through the leak is possible to get without a valid username and password to access the administration interface. The problem is both an administrative interface that is directly accessible via the Internet as an interface that is only accessible locally. In the latter case an attacker to perform a CSRF attack.

Once access to the interface, the attacker could change the DNS settings. The Domain Name System (DNS) is similar to the directory and translates among other domain names into IP addresses. The DNS hijacking an attacker can manipulate the movement of users. It is believed that the leak in the D-Link DSL-2740R and the D-Link DLS 320B. Both models are sold in the Netherlands, where the DLS 320B still being offered.

Researcher Todor Donev, who noticed the problem reported this to manufacturer D-Link, so there is no update available yet.Moreover, the DSL-2740R is a phased model. Donev opposes Threat Post that other models are vulnerable, but he does not have the resources to test all affected devices. Meanwhile, he has also put an exploit online to demonstrate the attack.