NSA Surveillance – Starts with your router

Look at your default router

http://securityevaluators.com//content/case-studies/routers/soho_router_hacks.jsp

We define a critical security vulnerability in a router as one that allows a remote attacker to take full control of the router’s configuration settings, or one that allows a local attacker to bypass authentication and take control. This control allows an attacker to intercept and modify network traffic as it enters and leaves the network.

• All 13 routers evaluated can be taken over from the local network
  • 4 of these attacks require no active management session.
• 11 of 13 routers evaluated can be taken over from the WAN
  • 2 of these attacks require no active management session.

Can you even believe these results?

Unfortunately, there is little the average end-user can do to fully mitigate these attacks. Successful mitigation often requires a level of sophistication and skill beyond that of the average user (and beyond that of the most likely victims).

SOHO networking device VENDORS should incorporate the following design changes in to their product lines.

• Using authenticated (digitally signed, and verifiable by the router) firmware updates.
• Designing a method for automatic firmware updates, that can be opted out of by users.
• Perform regular security audits to ensure devices are as hardened as possible.

******

Scan my router now

Scan for Universal Plug and Play Check

http://upnp-check.rapid7.com/

******

 Schneier on the Snowden documents.

https://www.schneier.com/blog/archives/2013/09/how_to_remain_s.html

The NSA also attacks network devices directly: routers, switches, firewalls, etc. Most of these devices have surveillance capabilities already built in; the trick is to surreptitiously turn them on. This is an especially fruitful avenue of attack; routers are updated less frequently, tend not to have security software installed on them, and are generally ignored as a vulnerability.

Schneier advised:

1. Be suspicious of commercial encryption software, especially from large vendors. My guess is that most encryption products from large US companies have NSA-friendly back doors, and many foreign ones probably do as well. It’s prudent to assume that foreign products also have foreign-installed backdoors. Closed-source software is easier for the NSA to backdoor than open-source software. Systems relying on master secrets are vulnerable to the NSA, through either legal or more clandestine means

Router Attacks

Despite being widely distributed and deployed in nearly every modern home and small office, SOHO networking equipment has received surprisingly little attention from security researchers. Yet, these devices facilitate the connectivity and protection (we hope) of millions of end-systems. The critical vulnerabilities that persist in these widely used devices demonstrate an urgent need for deeper scrutiny.

ISE initially set out to evaluate the security of ten popular, off-the-shelf SOHO wireless routers. The final scope of the research project was expanded to include thirteen unique devices. Our research indicates that a moderately skilled adversary with LAN or WLAN access can exploit all thirteen routers. We also found that nearly all devices had critical security vulnerabilities that could be exploited by a remote adversary, resulting in router compromise and unauthorized remote control. At least half of the routers that provided network attached storage (NAS) were found to be accessible by a remote adversary (full details will be disclosed in a future article).

We further categorize these remotely and locally accessible vulnerabilities by indicating their associated attack requirements:

• Trivial attacks can be launched directly against the router with no human interaction or access to credentials.
• Unauthenticated attacks require some form of human interaction, such as following a malicious link or browsing to an unsafe page, but do not require an active session or access to credentials.
• Authenticated attacks require that the attacker have access to credentials (or that default router credentials are used—an all-too-common situation) or that a victim is logged in with an active session at the time of the attack.

Excellent Technical report is here:

http://securityevaluators.com//content/case-studies/routers/soho_techreport.pdf