Lesser known network services were also found generally to have poor input security and were vulnerable to buffer overflow vulnerabilities.
Relying upon this assumption of security, manufacturers are prioritizing ease-of-use and obtaining the highest variety of features possible, instead of finding an equilibrium between security, functionality, and ease-of-use (a.k.a., the SFE Triangle – Figure 3).įigure 4: Cross-Site Request Forgery (CSRF) exploitation.
As evidenced by this analysis, it is apparent that the high-end consumer routers are designed under the assumption that communications and machines on the (wireless) LAN are free of potential threats. All of the routers' web-based configuration portals use password-based authentication over HTTP – a method that is well known to be insecure without SSL/TLS encryption.Īdditionally, the routers all provided a range of services that lack secure channels or authentication mechanisms, such as FTP, Telnet, and SMB. The lack of configuration options could permit network services to operate in unintended ways, such as SMB allowing symbolic links to traverse into the router's root directory ( Figure 2).ĭuring our analysis of SOHO routers, we found that all of the routers studied do not utilize (or even attempt to utilize) a secure connection for sensitive data communications between the router and network clients. Misconfiguration of services is characterized by network services that lack configuration options or utilize unnecessarily lenient permissions. poor security design and implementation.Our analysis of extraneous service vulnerabilities inherent in the evaluated routers revealed that these security flaws originated from four primary categories: The research of an ISE security team, in which 14 routers were initially targeted, is available on our main research page. Once compromised, the adversary has unfettered access to exploit the vulnerabilities of local area hosts that would be otherwise unreachable if the router were enforcing firewall rules as intended. Worse still is that these routers are also firewalls and often represent the first and last line of defense for protecting the local network.
The attacks could include sniffing and rerouting all network traffic, poisoning DNS resolvers, performing denial of service attacks, or impersonating servers.
Once compromised, any router – SOHO or otherwise – may be used by an adversary to secure a man-in-the-middle position for launching more sophisticated attacks against all users in the router's domain. © Caped crusader image, Sergey Konyakinr, 123RFFigure 1: ISE SOHO CVE list. All the extraneous services running within these SOHO routers expose attack surfaces that a malicious adversary can leverage to compromise the router core and gain a foothold in the victim network. The alarming quantity of these security problems demonstrate how the rich service and feature sets (e.g., SMB, NetBIOS, HTTP(S), FTP, UPnP, and Telnet) implemented in these routers comes at a significant cost to security. The list of known vulnerabilities for SOHO routing devices is long ( Figure 1), and our research revealed 56 previously undisclosed security vulnerabilities in SOHO devices. The heavy use of SOHO routers in the consumer market, as well as the targeted demographic of non-computer-savvy users, has not surprisingly led to some very easy-to-use turnkey solutions. SOHO routers are often the single point of ingress and egress from a SOHO network, managing domain name resolution, firewall protection, dynamic addressing, wireless connectivity, and, of course, routing. Small office/home office (SOHO) routers are a staple networking appliance for millions of consumers.