Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Recent Posts

  • Calendar

    August 2014
    S M T W T F S
    « Jul   Sep »
     12
    3456789
    10111213141516
    17181920212223
    24252627282930
    31  
  • Email Subscription

  • About Us
    TrendLabs Security Intelligence Blog(breadcrumbs are unavailable)

    Archive for August 25th, 2014




    Routers manufactured by Netcore, a popular brand for networking equipment in China, have a wide-open backdoor that can be fairly easily exploited by attackers. These products are also sold under the Netis brand name outside of China. This backdoor allows cybercriminals to easily run arbitrary code on these routers, rendering it vulnerable as a security device.

    What is this backdoor? Simply put, it is an open UDP port listening at port 53413. This port is accessible from the WAN side of the router. This means that if the router in question has an externally accessible IP address (i.e., almost all residential and SMB users), an attacker from anywhere on the Internet can access this backdoor:

    Figure 1. Netstat output, with web admin and backdoor ports highlighted

    This backdoor is “protected” by a single, hardcoded password located in the router’s firmware. Netcore/Netis routers appear to all have the same password. This “protection” is essentially ineffective, as attackers can easily log into these routers and users cannot modify or disable this backdoor.

    Almost all Netcore/Netis routers appear to have this vulnerability, based on the information we examined. Using ZMap, to scan vulnerable routers, we found more than two million IP addresses with the open UDP port. Almost all of these routers are in China, with much smaller numbers in other countries, including but not limited to South Korea, Taiwan, Israel, and the United States.

    What kinds of commands can an attacker give to a vulnerable router? Aside from logging in, the attacker can upload, download, and run files on the router. This gives the attacker near-complete control of the router. For example, settings can be modified to help carry out man-in-the-middle attacks.

    Here’s another attack that can be easily carried out: the file that contains the user name and password for the router’s normal, web-based administration panel is stored without any encryption. This file can be easily downloaded by the attacker, as seen below:

    Figure 2. Dump of user name and password

    We are well aware of the dangers of vulnerable routers, but this vulnerability is particularly serious because of the ease of exploitation. We have not been able to find any documentation that describes this backdoor, nor any that states its purpose and who wrote it. We have contacted the manufacturer, but Trend Micro has not yet received a response.

    In order to determine if their router is vulnerable, users can use an online port scanner. A probe at port 53413 of a vulnerable router would result in something like this:

    Figure 3. UDP port scan

    Users should pay particular attention to the section that has been underlined in red.

    Users have relatively few solutions available to remedy this issue. Support for Netcore routers by open source firmware like dd-wrt and Tomato is essentially limited; only one router appears to have support at all. Aside from that, the only adequate alternative would be to replace these devices.

     


     

    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice