RealTek SDK Introduces Vulnerability In Some Routers 35
jones_supa writes: SOHO routers from manufacturers including at least Trendnet and D-Link allow attackers anywhere in the world to execute malicious code on the devices, according to a security advisory issued over the weekend. The remote command-injection vulnerability resides in the "miniigd SOAP service" as implemented by the RealTek SDK. Before someone asks, there is no comprehensive list of manufacturers or models that are affected. Nerds may be able to spot them by using the Metasploit framework to query their router. If the response contains "RealTek/v1.3" or similar, the device is likely vulnerable. For now, the vulnerable routers should be restricted to communicate only with trusted devices. HP's Zero Day Initiative reported the bug confidentially to RealTek in August 2013, but the issue was disclosed 20 months later as no fix has been provided.
Sounds like a good policy anyway. (Score:3)
should be restricted to communicate only with trusted devices
Sounds like a good policy anyway.
I knew it! (Score:1)
You can't trust "realtek", they are everywhere yet none of their products are worth a dime.
Fritz!Box (Score:2)
And I knew it was a good idea to go for AVM [avm.de]'s Fritz!Box-es...
(regular updates even for old models, no market segmentation where models only differ by firmware, trying to cram as much feature in one model as possible instead of launching 20 subtly different models, etc.)
Er. 201*4*, no? (Score:3, Interesting)
TFA says 2014, not 2013. And thus, not 20 months later.
Re: (Score:2)
And what about when the router you use is an all-in-one provided by your ISP and you dont get a say in which one you use?
Like cable companies that provide a cable modem/router and dont give you any choice but to use theirs.
Or things like Verizon FiOS or AT&T U-Verse where they provide the same (modem/router in the one box)
Re: (Score:2)
And what about when the router you use is an all-in-one provided by your ISP and you dont get a say in which one you use?
Like cable companies that provide a cable modem/router and dont give you any choice but to use theirs.
Or things like Verizon FiOS or AT&T U-Verse where they provide the same (modem/router in the one box)
So far, in my experience, cloning a PC's mac address to your own router's WLAN port has worked for me and for friends of mine. And since my router (as well as most of the PCs in my house) is running a version of Linux, I can truthfully say I'm running Linux.
Re: (Score:2)
It looks like this issue only effects routers running some version of Linux, since miniigd is an application designed to run on Linux.
Here's a copy of its start-up script
https://github.com/KrabbyPatty... [github.com]
Re: (Score:2)
Re: (Score:2)
If you're o
Re: (Score:2)
Put your firewall behind their router?
Yes, you have to use theirs to connect to the network .. but then you don't trust it and use your own.
Or, will that not work for you?
Because there's no way in hell I'd plug my PC directly into a router provided by my ISP. No fucking way. I trust neither them nor their security.
Hell, I'm not even on the same router/wifi network as my wife, we both have a router connected to the ISPs router.
It's just a device which gets a DHCP address, isn't it?
Or maybe support an Open Source option? (Score:3)
You could do that, or you could buy a router pre-configured with OSS from the factory. [thinkpenguin.com] It's not even expensive at ~ $50.
I bought a similar model about a year ago, and its large antennas and decent range/speed make it the best router I've yet had. If it's not even more expensive, why not support a vendor that supports (more) secure, Open Source solutions?
I have no relationship with this vendor other than being a happy customer
Re: (Score:2)
By spec, wireless N, up to 300 Mbit.
In practice, I've gone through 4 different routers, and so far, this one has come out on top. It has two decent antennas which may be some of that difference, to be fair.
My house was (over)built in the 1970s with 3/4" sheet rock, making each room almost like a Faraday cage - getting wifi signal *at all* from two rooms over is spotty at best. In my bedroom (2 doors away from the hotspot) I see about 15-20 Mbits, but in the same room I see up to ~ 40 Mbits for torrents. (50
Re: (Score:2)
Interesting idea, but the hardware spec for that device is so lacking in basic facilities that it will probably be a non-starter for a lot of people.
Re: (Score:2)
You could do that, or you could buy a router pre-configured with OSS from the factory. It's not even expensive at ~ $50.
They don't seem to offer a model with GigE. That's an abject failure, today. Anything contemporary and not heinously expensive?
FWIW, I'm using a C2D PC with 1xGigE, and a QFE card for routing and some ethernet ports, and 5-port switches on both the GigE and 100Mbps segments, then a Mikrotik Routerboard (411, IIRC) running OpenWRT to handle the WiFi. The total cost is somewhere around $120, but it does dramatically more...
Re: (Score:2)
why not support a vendor that supports ... Open Source solutions?
Because open source software sucks balls?
Isn't that a feature ? :)
Why are they allowed to get away with this? (Score:2)
It's even worse, because unlike a lot of other gear, they can actually fix the problem in the field. They don't have to do a physical recall like car companies do. What they need is remote update features.
I think i
Re: (Score:3)
Liability belongs with the ones making a profit from it, Anonymous Idiot.
Re: (Score:1)
Re: (Score:2)
But it as a consumer and leverage your consumer rights you are granted in by your local laws. They're usually something along the lines of fit for purpose and of acceptable quality. Retails usually must provide remedy, replacement or refunds.
Not a bug. Won't fix. (Score:1)
This is our hardware. We made it, we're going to have a backdoor into it.