Masses of Broadband Routers Still Vulnerable to Directory Traversal Hack

One of Cisco Systems better known Penetration Tester’s, Kyle Lovett, has this week warned a UK security conference that more than 700,000 ADSL broadband routers from various different manufacturers and countries are still vulnerable to a Directory Traversal attack that was first uncovered in 2011.

A Directory Traversal attack is a form of HTTP exploit, which usually only requires a web browser to launch the assault and a bit of knowledge about where the files and directories are on the system being targeted. A hacker can then use the browser to access data in a directory other than the servers / routers root directory and, if successful, they would be able to view or possibly even execute restricted commands and files.

Successfully exploiting a Directory Traversal vulnerability is in many cases enough to give the attacker almost total control of a router, which means they can do everything from hijacking your DNS (website etc.) requests to snooping on your personal data and various other nasty things.

Lovett expanded upon the approaches first used here and then more recently here (CVE-2014-2962) in order to extract an important file called config.xml, which was present on most of the affected routers. As the name might suggest, the file contains a lot of configuration settings (e.g. login and password for the ADSL / ISP connection, wifi network password, client and server credentials for the TR-069 remote management and more).

The passwords hashes (encryption) listed in the above file were, on a lot of devices, apparently quite weak and this meant they were easy to crack. Naturally once somebody has the passwords for your device then it’s often game over. Worrying Lovett noted that some routers even allowed him to access the config.xml simply by typing the correct URL (no real hacking required), although he didn’t say which ones.

According to PC World, Lovett scanned the Internet using SHODAN and claims to have identified 700,000 routers that could be vulnerable to the same attack, including various models from ZTE (e.g. H108N and H108NV2.1), D-Link (2750E, 2730U and 2730E), Sitecom, FiberHome, Digisol and more. But the number could potentially be higher since SHODAN only revealed those that could be targeted remotely because their web-based admin interface was exposed to the Internet.

Interestingly most of the routers were running firmware developed by China-based Shenzhen Gongjin Electronics (aka T&W), which also does manufacturing work for Asus, Alcatel-Lucent, Belkin, ZyXEL and Netgear. So far the company has not responded to Lovett or any media requests for comment, which doesn’t inspire confidence.

One bit of good news is that most of the vulnerable ADSL routers are supplied by ISPs in South America and South East Asia, with only a few spotted in the USA and other European countries (most of the latter were third-party purchases and not ISP supplied). In other words those with ISP supplied broadband routers in the UK should be fairly safe, but there’s no guarantee.