HUGE exploit in Netgear Nighthawk and other routers, accessed by browsing the web

Status
Not open for further replies.
senese there are a lot of router people in here I'll ask:

Are there any good WIRED routers out their under $100? I already have a r7000, but all my cabling comes out in a wire closet thats far from the ideal spot for the wireless signal to be. its a 3000sqft home so I'd prefer the R7000 to just be an access point setup in the dead center open area (open concept home). I'd put a wired router in the wirecloset for connecting the modem to and handling all the eithernet runs in the house.
 
Pagusas said:
senese there are a lot of router people in here I'll ask:

Are there any good WIRED routers out their under $100? I already have a r7000, but all my cabling comes out in a wire closet thats far from the ideal spot for the wireless signal to be. its a 3000sqft home so I'd prefer the R7000 to just be an access point setup in the dead center open area (open concept home). I'd put a wired router in the wirecloset for connecting the modem to and handling all the eithernet runs in the house.
Click to expand...

Why wouldn't you just use a switch in the closet and put the R7000 wherever you want?
 
TheOMan said:
Can you not do a firmware backup?
Click to expand...

I went ahead and tried it since I had a backup. No problems thankfully. Some on the install video I saw had their router brick, another had led issues (which I don't care about). I'll mess around with it, and set everything up later. I at least redid the password.

I'm actually kind of happy this forced me to change to it. I actually bought this router so I could use DD-WRT, but backed out after researching possible problems.
 
Thanks for this, my router is on there and I would never have known otherwise. Hiding that flaw is inexcusably shit by Netgear.
 
Marty Chinn said:
Why wouldn't you just use a switch in the closet and put the R7000 wherever you want?
Click to expand...

A switch wouldnt work as the first connection point with the modem would it? You need to go Modem --> Router --> rest of your network (which can have multiple switches in it)


How would you go Modem ---> Switch ---> Network. No routing functions would be carried out, a switch is a dumb device. I know some modems can handle routing functions but mine is an absolute 100% dumb modem.
 
Pagusas said:
A switch wouldnt work as the first connection point with the modem would it? You need to go Modem --> Router --> rest of your network (which can have multiple switches in it)


How would you go Modem ---> Switch ---> Network. No routing functions would be carried out, a switch is a dumb device. I know some modems can handle routing functions but mine is an absolute 100% dumb modem.
Click to expand...

You're correct. Multiple devices require routing. Switch ain't going to do that.
 
Pagusas said:
A switch wouldnt work as the first connection point with the modem would it? You need to go Modem --> Router --> rest of your network (which can have multiple switches in it)


How would you go Modem ---> Switch ---> Network. No routing functions would be carried out, a switch is a dumb device. I know some modems can handle routing functions but mine is an absolute 100% dumb modem.
Click to expand...

Yes your modem has to go to your router first, but you didn't explain that your modem was in the closet too. It's kind of hard to give network advice without understanding the layout better. With my setup, I just have a modem in a room, but the main central wiring is in a closet on the other side of the house so it's easier to manage . So for me, my closet just as a switch in it and I can place the router in any room I want because I can bridge the connection from anywhere. I also have 2 to 4 ports in every room too which makes it easy to hook it up any way I want once I bridge the connection in the closet.
 
Thanks for bringing this to our attention OP.

Pagusas said:
A switch wouldnt work as the first connection point with the modem would it? You need to go Modem --> Router --> rest of your network (which can have multiple switches in it)


How would you go Modem ---> Switch ---> Network. No routing functions would be carried out, a switch is a dumb device. I know some modems can handle routing functions but mine is an absolute 100% dumb modem.
Click to expand...

When I setup my home office/lab I used this router: $52

https://www.amazon.com/dp/B00YFJT29C/?tag=neogaf0e-20

and a Netgear ProSafe G116e but here is a G316 for $61.

http://www.newegg.com/Product/Produ...gclid=CKLcj6DA9NACFQGmaQodO-sIRw&gclsrc=aw.ds

The G116e is web-managed and $100

http://www.newegg.com/Product/Product.aspx?Item=N82E16833122596
 
Check your router for a vulnerability by going to http://[router-address]/cgi-bin/;uname$IFS-a in your browser (replacing [router-address] with your router’s IP address). If that page shows anything but an error or an empty page, your router is affected.

If it is affected, you can terminate the web server process that’s exploitable. However, this will kill the web configuration interface on your router until you reboot it. This shouldn’t be a big deal unless you go into your router’s management tool often. If you’re okay with that, type this into your browser’s URL: http://[router-address]/cgi-bin/;killall$IFS’httpd’ and then head back to the URL in step one to verify it worked.
Click to expand...

This was in a Lifehacker article. Seems like even if your router doesn't have beta firmware available, there's a work around that will prevent this vulnerability.
 
TylerD said:
Thanks for bringing this to our attention OP.



When I setup my home office/lab I used this router: $52

https://www.amazon.com/dp/B00YFJT29C/?tag=neogaf0e-20

and a Netgear ProSafe G116e but here is a G316 for $61.

http://www.newegg.com/Product/Produ...gclid=CKLcj6DA9NACFQGmaQodO-sIRw&gclsrc=aw.ds

The G116e is web-managed and $100

http://www.newegg.com/Product/Product.aspx?Item=N82E16833122596
Click to expand...

Thank you, that helps a lot. I have a 500 down/ 250 up conntention, will i hit speed limites with that setup (supposely the r7000 on regular firmeware is suppose to hit a ceiling around 450, 325 on WRT, but I still get around 480 down wired)
 
Pagusas said:
Thank you, that helps a lot. I have a 500 down/ 250 up conntention, will i hit speed limites with that setup (supposely the r7000 on regular firmeware is suppose to hit a ceiling around 450, 325 on WRT, but I still get around 480 down wired)
Click to expand...

Router is gigabit and both of those switches are gigabit. If you use CAT5e or CAT6 ethernet cabling runs under 100 meters you should get the full speed that your wireless access point accepts.
 
Thank you so much for bringing this to my attention. I have the r7000 and dont update if there arent any issues. Hopefully the beta firmware doesnt cause any new issues and I havent't been exploited yet. This will be a shitshow though, how will Netgear make affected customers aware of the problem and the need to upgrade firmware? This is a hackers wet dream.
 
Pagusas said:
senese there are a lot of router people in here I'll ask:

Are there any good WIRED routers out their under $100? I already have a r7000, but all my cabling comes out in a wire closet thats far from the ideal spot for the wireless signal to be. its a 3000sqft home so I'd prefer the R7000 to just be an access point setup in the dead center open area (open concept home). I'd put a wired router in the wirecloset for connecting the modem to and handling all the eithernet runs in the house.
Click to expand...

Check out Ubiquiti's Edgemax line of routers. They're wired routers and some of the best that you can get for the price (Ubiquiti is bascially prosumer- and even enterprise-grade hardware at very affordable prices).

Most of them are *pure* routers though, i.e. they don't really double as a switch (with the exception of the Edgerouter PoE, which has three of its five ports also providing switch functionality; that one is $175 though). In most cases, the Edgerouter X ($50) should suffice. If you have a 1Gbit/sec Internet connection such as Google Fiber, you'd better get an Edgerouter Lite, because the hardware of the Edgerouter X isn't powerful enough to do WAN/LAN routing at 1Gbit/sec. Otherwise, the Edgerouter X should be sufficient.

Pagusas said:
Thank you, that helps a lot. I have a 500 down/ 250 up conntention, will i hit speed limites with that setup (supposely the r7000 on regular firmeware is suppose to hit a ceiling around 450, 325 on WRT, but I still get around 480 down wired)
Click to expand...

The Edgerouter X can do about 600Mbps routed traffic, so it should be fine. The Edgerouter Lite can do 1Gbps but that would be overkill in your case. Just make sure to not use them as a switch.
 
Gurgelhals said:
Check out Ubiquiti's Edgemax line of routers. They're wired routers and some of the best that you can get for the price (Ubiquiti is bascially prosumer- and even enterprise-grade hardware at very affordable prices).

Most of them are *pure* routers though, i.e. they don't really double as a switch (with the exception of the Edgerouter PoE, which has three of its five ports also providing switch functionality; that one is $175 though). In most cases, the Edgerouter X ($50) should suffice. If you have a 1Gbit/sec Internet connection such as Google Fiber, you'd better get an Edgerouter Lite, because the hardware of the Edgerouter X isn't powerful enough to do WAN/LAN routing at 1Gbit/sec. Otherwise, the Edgerouter X should be sufficient.
Click to expand...

I didn't know this about my Edgerouter X. Thanks!
 
GifGafIsTheBestGaf said:
ASUS routers stay winning, my go-to brand personally and always my recommendation here on GAF.
Click to expand...

http://arstechnica.com/security/201...e-been-pwned-thanks-to-easily-exploited-flaw/
http://blogs.harvard.edu/zeroday/2014/02/05/so-this-is-what-getting-pwned-is-like/

Anyone who plugged a hard drive into their router around the time it was vulnerable probably had someone access and copy everything. People were actively exploiting this and sharing huge lists of vulnerable IPs for quite a while.


For anyone looking at an edgerouter, research it first because it's not a plug and play device. Expect to spend hours or days setting it up. A lot of people configure them incorrectly as well because they don't know what they are doing and end up leaving their entire network wide open.
 
I just demoted my R7000 from gateway to access point the other day after discovering its less than stellar UPNP implementation affected TitanFall 2. It also suffered some kind of firmware corruption that fast track that demotion. In light of this news, I'll be looking at alternatives like running ASUSWRT-Merlin on it.

I used to run Shibby Tomato on my RT-N66U but found the slightly modified branch called ASUSWRT-Merlin to be a far superior option with regards to stability and performance. It taught me the benefits of leveraging both internal and open firmware.

I stuck with NETGEAR's R7000 firmware because it was based off DD-WRT and I was satisfied with the feature and performance. I didn't see the need to go full DD-WRT. Now that I know safety isn't the number 1 priority for NETGEAR, I'll be switching.
 
Trying to download the beta patch and it's a .chk file. When it gets added to my download list and try to save it to my desktop it asks what application to open it with. What do I pick?
 
NVM - looks like they're all fucked.

Netgear R7000, R6400, and R8000 models have been confirmed to be vulnerable, and other models, including the R7000P, R7500, R7800, R8500 R9000, have been reported by end users as being affected.
Click to expand...
 
I paid $350 for this crap? I can't trust them anymore. Wonder if they'll refund me.
 
Persona7 said:
http://arstechnica.com/security/201...e-been-pwned-thanks-to-easily-exploited-flaw/
http://blogs.harvard.edu/zeroday/2014/02/05/so-this-is-what-getting-pwned-is-like/

Anyone who plugged a hard drive into their router around the time it was vulnerable probably had someone access and copy everything. People were actively exploiting this and sharing huge lists of vulnerable IPs for quite a while.


For anyone looking at an edgerouter, research it first because it's not a plug and play device. Expect to spend hours or days setting it up. A lot of people configure them incorrectly as well because they don't know what they are doing and end up leaving their entire network wide open.
Click to expand...

well damn, Asus stay winning ?*

just as a side note i use Merlin with my router
 
Persona7 said:
http://arstechnica.com/security/201...e-been-pwned-thanks-to-easily-exploited-flaw/
http://blogs.harvard.edu/zeroday/2014/02/05/so-this-is-what-getting-pwned-is-like/

Anyone who plugged a hard drive into their router around the time it was vulnerable probably had someone access and copy everything. People were actively exploiting this and sharing huge lists of vulnerable IPs for quite a while.


For anyone looking at an edgerouter, research it first because it's not a plug and play device. Expect to spend hours or days setting it up. A lot of people configure them incorrectly as well because they don't know what they are doing and end up leaving their entire network wide open.
Click to expand...

Hackers expose eight-month-old Asus weakness by leaving note on victims' drives.

haha thats great
 
Pagusas said:
senese there are a lot of router people in here I'll ask:

Are there any good WIRED routers out their under $100? I already have a r7000, but all my cabling comes out in a wire closet thats far from the ideal spot for the wireless signal to be. its a 3000sqft home so I'd prefer the R7000 to just be an access point setup in the dead center open area (open concept home). I'd put a wired router in the wirecloset for connecting the modem to and handling all the eithernet runs in the house.
Click to expand...

Plenty are....

Just make sure it has a decent CPU, so it can handle multiple connections without packet drops and the like. Most router suck at this well before you saturate what you're isp gives ya. The other part make sure you can use good firmware. Once you have good firmware make sure SQM or Cake based QOS is on so you keep jitter to a minimum and keep your voip/gaming stuff from taking hards hits from streaming or web browsing.

I use WDR-3600 and it does the job just fine, short of me getting a 85Mbps+ isp connection.

Bboy AJ said:
I paid $350 for this crap? I can't trust them anymore. Wonder if they'll refund me.
Click to expand...

No rourter on the market is worth more than 200$ Also security is what it is, just upgrade the firmware you will be fine, this is no different updating your OS after it's hacked you wouldn't ditch windows would you?

Netherscourge said:
WRT fucked up my Linksys Router a couple years ago.

Never using that again.
Click to expand...

They don't even have releases like they did years ago now. Early firmware shit was crap it's only been the last 3 years you could find good stuff and even then if you're not a power user I see no point in doing router firmware. I only see the point in point out how shitty stock firmware is, but considering most consumers don't care the industry doesn't.
 
Is there any way to check to see if my crap has been posted on the internet? Updating with the Beta firmware now.

What all was vulnerable? Everything connected to the router (both hardwired and wifi) or just things directly connected VIA the USB ports?
 
I assumed the D7000 would be affected since the R7000 (router only version) is affected, but the proof of concept exploit didn't work for me. I'll check again when I get home but its possible it's omission from the list wasn't an oversight.
 
tim.mbp said:
This was in a Lifehacker article. Seems like even if your router doesn't have beta firmware available, there's a work around that will prevent this vulnerability.
Click to expand...

Interesting. I just patched my router with the beta firmware and I can still see stuff on that page.

I wonder if the beta firmware isn't working or there's behind the scenes protection

edit: actually I take it back. Restarted my web browser and tried again and it's an error page. I think I'm good now.
 
saunderez said:
I assumed the D7000 would be affected since the R7000 (router only version) is affected, but the proof of concept exploit didn't work for me. I'll check again when I get home but its possible it's omission from the list wasn't an oversight.
Click to expand...
It worked on mine. I don't see any update file either.
 
I can't get any info, but is the C6250 basically the same as the R6250, but with the cable modem addition? I can't see if that's affected or not.
 
Netgear has to be the slowest company at releasing critical firmware updates. You have to run beta software just to get ICMP on IPv6.
 
Thanks for the heads up OP, I have always wanted to play around with open source router firmware but have put it off. Thanks to this exploit, I went ahead and installed dd-wrt on my netgear r7000 today.
 
I appreciate the heads up.

Viewtiful said:
Thanks for the heads up OP, I have always wanted to play around with open source router firmware but have put it off. Thanks to this exploit, I went ahead and installed dd-wrt on my netgear r7000 today.
Click to expand...

This was me, cutting my teeth on custom router firmware, for part of today. I ended up reverting back to Netgear's (beta) firmware for the immediate convenience. I'll experiment with dd-wrt again soon when I can knock the home network down for a while.
 
tim.mbp said:
This was in a Lifehacker article. Seems like even if your router doesn't have beta firmware available, there's a work around that will prevent this vulnerability.
Click to expand...

after i updated the firmware
it's now asking me to log in to the router instead of displaying anything
is this now fine?


Dizastah said:
I just tried this with my R7000 and the page says "This site can't be reached.....refused to connect."
Click to expand...

i'm on r7000 too
but we got something different D:
 
jiggle said:
after i updated the firmware
it's now asking me to log in to the router instead of displaying anything
is this now fine?


i'm on r7000 too
but we got something different D:
Click to expand...

I got that too. That doesn't seem like it should do that.

I ended up going with dd-wrt and then tried that command again and the website errored out liked I imagine it's supposed to.
 
Status
Not open for further replies.

Similar threads

What is the best web browser for android?
39
481
DavidGzz replied
When i logged in today neogaf was in dark mode and other weird behavior
7
451
FatallyYours replied
Japan still using visit Japan Web
27
906
Durien replied
Sony CEO Insists ‘Madame Web’, "Kraven" Aren’t “Terrible” and Says the “Press Just Crucified It”
News 
39
2K
nush replied
Streamers, influencers, and Yourube channels need to stop with annotations and other static images
15
1K
Mr Reasonable replied
Top Bottom