Dangerous 'Misfortune Cookie' flaw discovered in 12 million home routers

12/20/2014

By John E Dunn, Techworld.com

• Dec 19, 2014 8:46 AM
• e-mail
• print

Researchers at Check Point have discovered a serious security vulnerability affecting at least 12 million leading-brand home and SME routers that appears to have gone unnoticed for over a decade.

Dubbed the ’Misfortune Cookie’ flaw, the firm plans to give a detailed account of the issue at a forthcoming security conference but in the meantime it’s important to stress that no real-world attacks using it have yet been detected.

That said, an attacker exploiting the flaw would be able to monitor all data travelling through a gateway such as files, emails and logins and have the power to infect connected devices with malware. Man-in-the-middle attacks would also be possible, according to Check Point.

The precise source of the issue is not known - a chipset software development kit (SDK) is suspected - but Check Point warned that up to 200 unpatched models using the RomPager embedded web server software (which uses a remote service called TR-069) prior to version 4.34 were probably vulnerable.

As to which products are affected, this is where it gets a little complicated. Check Point estimates that at least 12 million devices are affected across the world but suggested this could be an underestimate.

Given the popularity of RomPager and the list of affected brands - D-Link, Edimax, Huawei, TP-Link, ZTE, and ZyXEL sold mainly to home users - such pessimism is realistic.

D-Link's DSL-2600U router is one of many affected models.

The issue dates back to 2002 but should have been fixed by an update three years later. However, as Check Point notes:

“The patch propagation cycle, however, is incredibly slow (sometimes non-existent) with these types of devices. We can confirm many devices today still ship with the vulnerable version in place,” said its research note.

The vulnerability had been designated CVE-2014-9222, but Check Point said that identifying affected devices might not be easy for many users. Some vendors had patched the issue but that fact might not have changed the version number in RomPager software to one later than 4.34.

For more technical details, read Vulnerability in embedded Web server exposes millions of routers to hacking

Exactly what individual router vendors planned to do was hard to know but RomPager itself had been very responsive, Check Point said.

“We believe this is a serious problem that the industry needs to solve; secure automatic software updates should be offered for all modern devices, as a default setting.”

Not half. Home routers are known to be a minefield of security problems, many little publicised except to hackers. Security updates are disgracefully rare and even when they do appear users seldom apply them. The best advice is to upgrade this product eevery few years on the assumption that more recent models are likely to have security flaws that as well known.

In April, Tripwire revealed that many popular home routers were riddled with security flaws and lazy default configurations, around the time that Team Cymru revealed that 300,000 routers had been compromised to launch DNS redirection attacks. Back doors and flaws in leading products are now routine even people are distracted by apparently bigger security stories.

source