The IT Nerd

This does not give me the warm fuzzies. Nor should it give the warm fuzzies to people who own certain D-Link routers. Craig Heffner, a vulnerability researcher with Tactical Network Solutions, discovered that some D-Link routers have a built-in backdoor that allows one to change settings and remotely execute code:

if your browser’s user agent string is “xmlset_roodkcableoj28840ybtide” (no quotes), you can access the web interface without any authentication and view/change the device settings 

Now, what does “xmlset_roodkcableoj28840ybtide” mean? The last part when read backwards is “edit by 04882 joel backdoor.” That implies it was written in by D-Link, likely during the development of the firmware as part of the development process. Except that these sorts of things are usually removed before the product is released. This one clearly wasn’t.

The following routers are affected by this:

• DIR-100
• DIR-120
• DI-624S
• DI-524UP
• DI-604S
• DI-604UP
• DI-604+
• TM-G5240

Additionally, several Planex routers also appear to use the same firmware:

• BRL-04UR
• BRL-04CW

Now D-Link has  posted this on their website discussing the issue. Among other things, it says this:

We are proactively working with the sources of these reports as well as continuing to review across the complete product line to ensure that the vulnerabilities discovered are addressed.  
We will continue to update this page to include the relevant product firmware updates addressing these concerns. 

It sounds like this will eventually be fixed.

My take on this? This is an #epicfail if I have ever seen one. It leaves those who have these routers with the impression that D-Link doesn’t take security seriously. That’s not good. Hopefully this is addressed by them quickly and transparently.

This entry was posted on October 15, 2013 at 3:08 pm and is filed under Commentary with tags D-Link, Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.