#BlackHat: Researchers hijack Linksys router with JavaScript

Powered by SC Magazine
 

Multi-pronged attack on home routers.

A pair of researchers at last week's Black Hat conference demonstrated how a simple JavaScript app could be used to compromise a wireless router with little to no user interaction.

Network devices – such as routers, switches, printers and firewalls – can be hijacked to give a remote attacker full control of the network, Phil Purviance and Joshua Brashars, senior security consultants at AppSec Consulting, said during their presentation on Thursday. The attack method relied on JavaScript and cross-site request forgery, they said.

While demonstrations of hacking routers and other networked hardware is not new to Black Hat, this presentation was unusual because so much of the attack was automated. Its success hinged on social engineering, a modern browser supporting HTML5 and lax password security.

Typically JavaScript attacks are limited to the browser, but the researchers used a blended attack, which broke this constraint and could affect actual network devices and the network itself.

The two demonstrated their attack with a widely available, but older model small office/home office (SOHO) router from Linksys by Cisco. Attacking this made sense because users tend to ignore what is happening with their routers so long as the devices keep doing their jobs, Brashars said.

Purviance added that many enterprises have SOHO routers running smaller networks, which means attackers could use this method to piggyback onto the enterprise network.

“You've essentially turned these SOHO devices into a full-blown Linux attack framework,” Brashars said.

The blended attack would begin with a social engineering scam to lure the victim to a malicious website and execute a specially crafted JavaScript program, Brashars said.

The program then instructs the browser to scan the local network and list all connected devices. The next step launches a brute-force attack on one of the devices to crack its login information.

This becomes even easier if the password on the router hasn't been changed from the manufacturer's default.

Once the attacker has access to the router interface, it's relatively simple to  use HTML5 to launch a cross-site request forgery attack to download and install malicious firmware onto the router, granting full control over the device.

“We're replacing an operating system on a network device and taking complete control of it,” Purviance said.

To eliminate this attack opportunity, cross-origin resource sharing in HTML5 should be more restrictive, and embedded devices should have cross-request forgery protections on embedded devices, Purviance said.

Also, web browsers should not allow external processes from accessing local network addresses, and networked devices should be getting automatic updates instead of relying on users to manually install them.

Changing the router's administrator password to something strong and complex will also make it harder for the attack to succeed. Cisco is one of the few vendors that now force users to pick a new default password during initial set-up. In fact, the user has to manually disable the security policy in order to avoid changing the password, or to select a weak password.

But while some vendors have taken steps to increase the device's security, most have not, Brashars said.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


#BlackHat: Researchers hijack Linksys router with JavaScript
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 432

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 208

Vote