Ako imate ruter od One: tp link td854w vasite uredi se pod golema OPASNOST.
DECEMBER 2014
Misfortune Cookie lets bad guys hack 12 MILLION routers
Home office: mis.fortunecook.ie
This is a real bad one. A flaw in the web server software in the router can allow bad guys to remotely take over a vulnerable router with admin privileges. The buggy web server software is RomPager from AllegroSoft. It is found in routers made by D-Link, Edimax, Huawei, TP-Link, ZTE, ZyXEL and others. Testing by Check Point, which went public with the problem, found 200 different router models contained the bug. There are at least 12 million such devices in 189 countries across the globe according to Check Point. The bug was introduced in 2002 and fixed by AllegroSoft in 2005, but the updated version never made it to millions of routers. Read the last sentence again. Exploiting the flaw is easy, a bad guy just needs to send HTTP cookie files that corrupt memory. Turning off remote administration does not fix this. Many routers listen on port 7547 for commands using the TR-069 protocol (a.k.a Customer Premises Equipment WAN Management Protocol).
Check Point suggests making sure that your router is not listening on ports 80, 8080, 443 and 7547. This list, however, is not complete. One good way to test these ports is with Steve Gibsons Shields UP!service. Do a "User specified custom port probe" and in the white rectangle enter "80,443,7547,8080". See a sample of a perfect report. That said, The only real way to know if a router is vulnerable to this flaw is to check with the manufacturer. Good luck with that.
I say this often, but not often enough: do not to use a consumer class router.
DECEMBER 2014
Misfortune Cookie lets bad guys hack 12 MILLION routers
Home office: mis.fortunecook.ie
This is a real bad one. A flaw in the web server software in the router can allow bad guys to remotely take over a vulnerable router with admin privileges. The buggy web server software is RomPager from AllegroSoft. It is found in routers made by D-Link, Edimax, Huawei, TP-Link, ZTE, ZyXEL and others. Testing by Check Point, which went public with the problem, found 200 different router models contained the bug. There are at least 12 million such devices in 189 countries across the globe according to Check Point. The bug was introduced in 2002 and fixed by AllegroSoft in 2005, but the updated version never made it to millions of routers. Read the last sentence again. Exploiting the flaw is easy, a bad guy just needs to send HTTP cookie files that corrupt memory. Turning off remote administration does not fix this. Many routers listen on port 7547 for commands using the TR-069 protocol (a.k.a Customer Premises Equipment WAN Management Protocol).
Check Point suggests making sure that your router is not listening on ports 80, 8080, 443 and 7547. This list, however, is not complete. One good way to test these ports is with Steve Gibsons Shields UP!service. Do a "User specified custom port probe" and in the white rectangle enter "80,443,7547,8080". See a sample of a perfect report. That said, The only real way to know if a router is vulnerable to this flaw is to check with the manufacturer. Good luck with that.
I say this often, but not often enough: do not to use a consumer class router.
- 12 million home and business routers vulnerable to critical hijacking hack by Dan Goodin ArsTechnica Dec. 18, 2014
Quoting: "Determining precisely what routers are vulnerable is a vexing undertaking." - Misfortune Cookie crumbles router security: 12 MILLION+ in hijack risk by John Leyden The Register Dec. 18, 2014
- 12 Million Home Routers Vulnerable to Takeover by Michael Mimoso Kaspersky Lab Dec. 18, 2014
- Vulnerability Note VU#561444 from CERT. Not much of a response from router vendors
- VENDOR RESPONSES TO MISFORTUNE COOKIE
- Actiontec Modems, Routers and Gateways are NOT Vulnerable to the Misfortune CookieAttacks Dec. 19, 2014. Actiontec never included the RomPager web server on any of its modems, routers or gateways.
- [Unaffected] Security Notice on Misfortune Cookie Vulnerability Peplink routers are not affected because they do not use the RomPager software. Dec. 23, 2014
- What Routers Are Susceptible to the Misfortune Cookie? from FlashRouters, a company that ships routers with DD-WRT installed. They link to DD-WRT forums that say that DD-WRT does not use RomPager, instead it uses lighttpd. Dec 19, 2014
- ZyXEL Helps You Guard Against Misfortune Cookie Vulnerability They have released updated firmware for 11 of their routers. However, 49 models they consider too old (end of life is the term they use) will not be fixed.
- I could find nothing from Netgear, so I searched their support site (support.netgear.com/search/) in March 2015 for "misfortune" and came up with nothing. A search for "cookie" turned up results but not about the Misfortune Cookie issue.
- Allegro Software Urges Manufacturers To Maintain Firmware for Highest Level of Embedded Device Security Simply put, this is a "don't blame us" article. Quoting "In some cases, manufacturers continue to make and sell products with software components that are over 13 years old ... Allegro Software is a software component supplier to product manufacturers. Allegro Software does not have the ability to upgrade or patch our customer's manufactured products. If you have a product that is affected by the above security concerns, please contact the product manufacturer to obtain a firmware update."
многу загрижени некако за рутерите... а сигурна сум дека без проблем си се конектирате на отворени вифи мрежи и ги брцате USBињата кај ќе стигнете
