backtop


Print 11 comment(s) - last by xKelemvor.. on Jul 3 at 4:27 PM

D-Link hasn't fixed a critical vunerability after it was reported to them 5 months ago

A serious security vulnerability reported last February to D-Link still hasn’t been fixed in a number of routers affected, according to several readers who have emailed DailyTech. The vulnerability allows remote code to be executed through the routers firmware potentially leaving affected customers vulnerable to attack. The vulnerability can give an attacker complete control over any and all network traffic.

The effected products are:
  • DI-524 (Wireless)
  • DI-604*
  • DI-624 (Wireless)
  • DI-784* (Wireless)
  • EBR-2310*
  • WBR-1310 (Wireless)
  • WBR-2310 (Wireless)
*(Denotes firmware update available)

D-Link has hardly said a word publicly about the issue and has only patched a small portion of the devices affected.  In fact the only word directly from D-Link is from a supposed support staff member in a post on the DSLReports.com forums. According to that person the issue has to do with UPnP, a LAN side protocol thus reasoning that the problem isn’t susceptible to WAN or internet side attacks.

Unfortunately because some of the effected routers are wireless it isn’t unlikely that an attacker might compromise the router by gaining access to the wireless portion of the router and injecting malicious code. Even secured wireless routers aren’t foolproof and given enough time and resources these too can be compromised.  The only advice that can be given at this point from security researchers is to discontinue using the affected routers until a fix is published by D-Link as there is nothing the consumer can to do mitigate the issue themselves.

D-Link was also recently in the news when its engineers began using a FreeBSD NTP top level server as the primary time server for its devices. The issue was solved eventually, and new routers stopped using the NTP server.


Comments     Threshold


This article is over a month old, voting and posting comments is disabled

A bit overkill ?
By armagedon on 7/1/2006 3:12:21 PM , Rating: 3
If the attacker has to pass through the wireless section, it's a pretty dam hard thing to do with WPA encryption.
If the user is too dum to not secure his wireless transmission ,he has a lot more other potential threats to worry about.




RE: A bit overkill ?
By oTAL on 7/2/2006 12:35:51 AM , Rating: 2
I agree with you... I mean, this is a vulnerability, and it is important for unsecured lans, like companies, where an internal attacker may compromise the network. For the average residencial gateway this doesn't seem like an issue... stop using it? I'm not even sure I'd loose the 10 minutes it took to upgrade the firmware if there was one available...
Maybe I misread the article, but if you have to get access to the LAN part of the network to exploit the flaw, then IMHO opinion this becomes a non-issue for residencial networks.


RE: A bit overkill ?
By MercenaryForHire on 7/3/2006 9:51:31 AM , Rating: 1
quote:
if you have to get access to the LAN part of the network to exploit the flaw, then IMHO opinion this becomes a non-issue for residencial networks


Agreed. Once inside the LAN, hacking the router becomes a pretty low priority. About the only reason I could think of to hack the router would be, well, to get the WEP/WPA keys [b]that you already have if you're accessing it wirelessly.[/b]

- M4H


It's "(A)ffected"
By sxr7171 on 7/1/2006 4:03:46 PM , Rating: 4
Learn the difference please.




Weird to hear......
By Freezetronius on 7/2/2006 7:52:12 AM , Rating: 1
Because ive had my D-Link 4300 since day one over a year ago and its never glitched on me and I hammer the living crap out of it




RE: Weird to hear......
By JamesCurtis on 7/2/2006 12:49:58 PM , Rating: 2
It wouldn't be a glitch, if the vulnerability was exploited it would mean lost data via malicious code or other consequences. Someone would have to get past your wireless encryption though to exploit it, assuming you have any ;)


By dewdlebug on 7/1/2006 4:01:51 PM , Rating: 2
No surprise here, this reminds of when d-stink copied the Spam Cube (spamcube.com) and called it Secure Spot. D-link is to technology as enron was to shareholders - hot air.




By CZroe on 7/2/2006 4:37:06 PM , Rating: 2
The Nintendo WiFi Connection issues that the DL-524 has are entirely software issues and they have been known all along.

You can not connect to the Nintendo WiFi connection at all with most Nintendo DS units and game. Some are able to connect when you try several times (like 20!) but they can't stay connected so it is still 100% incompatible.

So, if you research it, you'll find the offending wireless setting (tx rate) and change it (from "auto" to "54mbps").

Here's the kicker though: It's not a wireless problem. I knew something was weird when I was setting it to 54mbps for an 11mbps device. If you use a wired PC and a Nintendo WiFi USB adapter, you get the exact same problem! That means that a WIRELESS setting affects WIRED computers! This flaw has been identified and they have been repeatedly notified since October/November of last year yet they have done nothing. This is equivalent to some typo breaking XBOX Live support and then doing NOTHING to fix it.




My experience with D-Link was unacceptable
By Beenthere on 7/1/06, Rating: -1
By dgingeri on 7/3/2006 1:18:06 PM , Rating: 2
I have had issues with D-link as well. I have a DI-524 that locks up hourly when wireless is turned on, yet their tech support tells me that if it works with wireless turned off, it's not defective. That is just bogus as all heck. I will never buy another D-link product again, and I advise others of this as well.


By xKelemvor on 7/3/2006 4:27:48 PM , Rating: 2
Friends don't let friends buy D-Link...


"Can anyone tell me what MobileMe is supposed to do?... So why the f*** doesn't it do that?" -- Steve Jobs

Related Articles













botimage
Copyright 2014 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki