The IT Nerd

I am not sure what Netgear was thinking when they came up with this idea, but if you own a NightHawk R7000 router from the company and you have updated the firmware to said router in the last little while, it’s now collecting the following info by default and sending it back to Netgear:

• Total number of devices connected to the router
• IP address
• MAC addresses
• Serial number
• Router’s running status
• Types of connections
• LAN/WAN status
• Wi-Fi bands and channels
• Technical details about the use and functioning of the router and the WiFi network

Netgear had this on its website as to why it is doing this:

Technical data about the functioning and use of our routers and their WiFi network can help us to more quickly isolate and debug general technical issues, improve router features and functionality, and improve the performance and usability of our routers

Here’s the problem with that. If you want to collect data, allow one to opt into this. Forcing one to opt out should never be how this sort of thing should work as it just leaves a very bad taste in ones mouth as a result. Now if you don’t want Netgear collecting info on you, here’s how you disable this “feature”:

• Launch a web browser from your PC or smartphone that is connected to the network.
• Open the router login window by entering http://www.routerlogin.net.
• Type the router username and password. If you haven’t changed the default settings, your username is admin, and password is password.
• Select Advanced → Administration → Router Update on the Home page.
• Scroll down to the Router Analytics Data Collection section and select the Disable button to disable router analytics data collections.
• Click the Apply button to save your settings.

Now this “feature” is likely to come to other Netgear routers. So if you own one, you should be on the lookout for this “feature” and take action if required to protect your privacy.

A day after a really mind blowing bug with their router management software on macOS that they for whatever reason will not fix, Netgear has had to fess up to losing customer data that was stored on their cloud service. The Register has the details:

This week, the San Jose-based networking business sent an email to customers, seen by The Register, confirming that an “outage” affecting ReadyCLOUD, the free service for its network attached storage offering, caused the storage systems to disconnect from the cloud service and be marked as deleted at the end of March.

Compounding the issue, as part of a clean-up process, Netgear decided that when a ReadyCloud account is marked as closed, the NAS holding that account’s home folder should be deleted along with all of the data it was holding.

As one user complained to The Register: “In practice, accounts are generally deleted from the NAS admin screen by the user and a big warning flashes up to tell you that all data will be deleted. In this case, as the glitch was server side, no warning was presented and loads of people found that their home folders and data had mysteriously been deleted, by the looks of it, at the command of Netgear.”

The Reg reader got in touch to say that the outage lost all of his photographs of a trip with his 18-month-old daughter to Disneyland, and complained that despite Netgear’s claims they had identified all users, the company had not yet contacted him.

That’s a really huge screw up. After all, when a company offers a service where they store your data, they have a responsibility to protect said data. The fact that they were unable to do that in this case is appalling. Now the company claims that only 40 or 50 people lost data, but we’ll find out what the real number is when the inevitable class action lawsuit gets filed. The company is also trying to recover the data, but I think that may be futile. Which is another reason why there will be a class action lawsuit. Finally, they’ve fixed the issue that caused this, but that is cold comfort to those who lost data. Clearly this, combined with the story that I posted yesterday, not to mention their issues with their routers security from last year, seems to indicate that Netgear is a company that perhaps you might want to steer clear of.

I’ve become aware of a growing issue that has macOS users of Netgear products ticked off. The issue came to light on MacInTouch where a user posted that upon installing a piece of software that Netgear supplies to manage their router called Netgear Genie, this happens:

I bought a Netgear router, and noticed something strange when I installed the Netgear Genie software: the dock vanished for a moment, and when it returned, my desktop picture was reset to the Apple-supplied default. And all my desktop picture settings (e.g. random rotation of a particular folder) were wiped out.

Now that sounds trivial. But when the user investigated, he discovered that it is not trivial. Here’s why:

The explanation is simple. I can see in the Genie installer that at the end of a new or upgrade installation, it runs a script which contains this command:

That’s right: the installer will blithely delete any database that is in the OS X Dock library folder.

This is a critical bug because you really should not be deleting anything in that directory. Not just because you’ll inconvenience users by resetting their dock and desktop preferences. But because of the fact that Apple might use that directory for other things in the future. Thus by installing this software to manage your Netgear router, you might hose your system.

#Fail

What’s worse is if you read through the post on MacInTouch, Netgear’s response has been shambolic. They’ve asked for irrelevant information. They’ve raised roadblocks to getting a timely resolution. And they’ve generally been unhelpful.

#EpicFail

Clearly, Netgear has dropped the ball here and either doesn’t recognize that or doesn’t care. Either way, the correct response to this is to not buy their products. Any company that has a potentially catastrophic bug and does nothing to address it doesn’t deserve your money.

Seriously, what is up with Netgear these days?

After having some serious security flaws pop up last year, comes this latest one found by researcher Simon Kenin of Trustwave. According to this post, he found that by triggering an error message, the router can be tricked into handing over a numerical code that can then be used with the password recovery tool to retrieve the router’s administrator credentials. But what is worse is that Kenin also discovered that in many cases, the numerical code is not even necessary, and that random strings sent directly to the password recovery script would still cause the login information to be displayed. From there, it’s a trivial task to pwn the router. There are 31 different Netgear router models that are affected by this flaw and Netgear advises that you update your firmware right now.

Charming.

You really have to wonder if Netgear takes the security of its products seriously. I get that any vendor can have security issues with their products. But the scale that Netgear seems to have these sorts of issues seems really high to me.

If you own a Netgear router, you have to be wondering if you should ditch it for something else? I say that because hot off the heels of this serious security issue coming to light, though that was kind of fixed a few days later comes this:

The NETGEAR WNR2000 allows an administrator to perform a number of sensitive functions in the web interface through an apparent CGI script named apply.cgi. This script is invoked when changing Internet settings, WLAN settings, restore to factory defaults, reboot the router, etc.

However apply.cgi is not really a script, but a function that is invoked in the HTTP server (uhttpd) when it receives that string in the URL. When reverse engineering uhttpd, it was found that it also allows an unauthenticated user to perform the same sensitive admin functions if apply_noauth.cgi is invoked instead.

Some of the functions, such as rebooting the router, can be exploited straight away by an unauthenticated attacker. Other functions, such as changing Internet, WLAN settings or retrieving the administrative password, require the attacker to send a “timestamp” variable attached to the URL. This timestamp is generated every time the target page is accessed and functions as a sort of anti-CSRF token.

The timestamp generating function was reverse engineered and due to incorrect use of random number generation (details below) it is possible to identify the token in less than 1000 attempts with no other previous knowledge.

By combining this knowledge with an information leakage, it is possible to recover the administrator password. This password is then used to enable telnet functionality in the router and obtain a root shell if the attacker is in the LAN.

Finally, a stack buffer overflow was also discovered, which combined with the apply_noauth.cgi vulnerability and the timestamp identification attack allows an unauthenticated attacker to take full control of the device and execute code remotely in the LAN and in the WAN.

Okay. Let me translate for you. The vulnerabilities described above could allow a remote attacker to execute code and take over the device without authentication. And the attack is possible on the local network and via the Internet if remote administration is turned on, which to be fair it is not by default.

That’s a pretty big #Fail on the part of Netgear. What’s worse is that according to Pedro Ribeiro, the security researcher who discovered this is Netgear’s response:

NETGEAR did not respond to any emails, so THERE IS NO FIX for these vulnerabilities.

It is recommended to replace this router with another make and model that supports OpenWRT firmware. WNR2000 v3 and v4 have OpenWRT images available, but the latest v5 is not supported yet.
Timeline of disclosure:

26.09.2016: Email sent to NETGEAR (security@netgear.com) asking for PGP key, no response.

28.10.2016: Email sent to NETGEAR (security@netgear.com) asking for PGP key, no response.

26.11.2016: Disclosed vulnerability to CERT through their web portal.

29.11.2016: Received reply from CERT. They indicated that NETGEAR does not cooperate with them, so they recommended getting CVE numbers from MITRE and releasing the vulnerability information.

            Email to MITRE requesting CVE numbers, no response.

            Email sent to NETGEAR (security@netgear.com) asking for PGP key, no response.

20.12.2016: Public disclosure.

Well, that’s an #EpicFail on the part of Netgear to not even respond to him. I bet that they’re working overtime over the holidays to come up with a fix now that this is public and a PR disaster in progress. I am saying that because Netgear pushed out this advisory four days after Ribero released this info to the public. That’s a four day head start for every hacker who wants to exploit this. Another #EpicFail for Netgear.

My advice to you is that given that this is the second major vulnerability in Netgear products that has been found in the last month, you should take Ribero’s advice and stop using Netgear’s routers until they fix this. Or better yet, stop using Netgear’s products altogether. They clearly can’t keep them secure and they don’t want to deal with issues that are brought to them by security researchers in a timely manner. Both are great reasons not to use their products in my mind.

If you have a Netgear router, you need to immediately check to see if you have a firmware update below. If you do, download it and install it as fast as you can to protect your router from being recruited into a botnet for a distributed denial of service attack.

Firmware that is available now to prevent this is listed below:

Download NETGEAR R6400 Firmware 1.0.1.18

Download NETGEAR R7000 Firmware 1.0.7.6

Download NETGEAR R8000 Firmware 1.0.3.26

Download NETGEAR R6250 Firmware 1.0.4.6 Beta

Download NETGEAR R6700 Firmware 1.0.1.14 Beta

Download NETGEAR R6900 Firmware 1.0.1.14 Beta

Download NETGEAR R7100LG Firmware 1.0.0.28 Beta

Download NETGEAR R7300DST Firmware 1.0.0.46 Beta

Download NETGEAR R7900 Firmware 1.0.1.8 Beta

Download NETGEAR D6220 Firmware 1.0.0.22 Beta

Download NETGEAR D6400 Firmware 1.0.0.56 Beta

You’ll note that some of these links say “Beta” which might make you nervous. And it should. Netgear notes that as a beta firmware it hasn’t been fully tested and may not work for some users. But having said that, you can make an argument that some protection from this threat is better than none. Netgear also says that it is continuing to review all of its products to determine if any others are vulnerable to this attack. Any other devices found to suffer from the vulnerability will be patched ASAP.

If you have a  R7000P, R7500, R7800, R8500, R9000, R6200, R6400, R6700, R7000, R7100LG, R7300, R7900, and R8000 router from Netgear, you have a serious problem. There is evidence to suggest that simply by visiting a specifically crafted website, the router could be recruited into being part of a distributed denial of service attack botnet. Sample attack code is already floating around the Internet. For example, it’s on Twitter:

Netgear R7000 Command Injection. https://t.co/TJvVdlEokU

— Acew0rm (@Acew0rm1) December 8, 2016

Plus there’s a YouTube video that illustrates this:

Here’s what is really bad about this situation. The exploit was initially published on Dec. 9, and later revealed by CERT on Dec. 11. Netgear did not go public with the issue until Dec. 12. That’s a serious #EpicFail on the  part of Netgear. On top of that, the official recommendation from CERT in terms of protecting yourself is to not use any of these routers.

If you want to find out if you’re affected by this, point your web browser to http://[router-address]/cgi-bin/;uname$IFS-a where [router-address] is replaced with the router’s local IP address. If the page that loads shows anything other than an error or blank page, the router is likely vulnerable.

Netgear has advised users that at present there are no firmware updates that fix this and affected users will have to download and manually install updates whenever they appear as no timetable currently exists. That means that there will be a lot of these routers out there just waiting to be exploited. If you have one, my advice is to dump it for pretty much any other router out there RIGHT NOW. After all, you don’t want your router to be part of a botnet do you?

In the meantime, Netgear has a lot of explaining to do.