{"id":5057,"date":"2014-01-07T13:12:39","date_gmt":"2014-01-07T13:12:39","guid":{"rendered":"http:\/\/www.ispreview.co.uk\/?p=5057"},"modified":"2014-01-07T13:14:46","modified_gmt":"2014-01-07T13:14:46","slug":"consumer-broadband-isp-routers-exposed-via-new-backdoor-exploit","status":"publish","type":"post","link":"https:\/\/www.ispreview.co.uk\/index.php\/2014\/01\/consumer-broadband-isp-routers-exposed-via-new-backdoor-exploit.html","title":{"rendered":"Consumer Broadband ISP Routers Exposed via New Backdoor Exploit"},"content":{"rendered":"

Broadband ISP customers that own\u00a0some models of Cisco, Netgear, Linksys or certain other routers could be vulnerable to a new backdoor exploit that allows a hacker to remotely input their own admin password and possibly gain full access to your network.<\/p>\n

<\/p>\n

The hack, which has been published by Eloi Vanderbeken<\/strong> on Github<\/a> (note: more details via Hacker News<\/a>), is increasingly believed to be common among devices that were physically manufactured, on behalf of the big router firms, by Sercomm<\/a>.<\/p>\n

Vanderbeken noted that many of these devices, such as for example Netgear’s DGN2000<\/strong> and DG834B<\/strong>, appeared to be listening on an undocumented service via TCP port 32764 <\/strong>(note: not all models will listen via this port over the Internet \/ WAN but some do).<\/p>\n

A little reverse engineering later and Vanderbeken found that he could send commands to the router via this port and without needing an administrator\u2019s password. At this stage his access was still limited but it didn’t take him long to figure out how to reset the admin password for full access.<\/p>\n

Backdoor confirmed in (LISTENING ON THE INTERNET<\/strong>):<\/strong><\/p>\n