WTF is your problem, Netgear? Another hijack hole found in its routers

Researchers are warning of a serious security hole that can be exploited to hijack potentially hundreds of thousands of Netgear routers. The programming blunder allows an attacker with access to the router to harvest the administrator access password. A victim could visit a malicious webpage that uses JavaScript to exploit the …

[AJames]

Already fixed?

I followed the link from this article to the bug description page at Netgear to the update page for my R6300v2 router, only to find that it says this bug was apparently fixed already in the firmware update I installed at the end of December (V1.0.4.6_10.0.76). I see that the bug report numbers are dated 2017, so how is it that they were supposedly already fixed in earlier firmware?

[MrDamage]

Re: Already fixed?

Responsible disclosure perhaps?

Give Netgear enough time to check, fix, test, recheck, refix and retest, produce an update, and then disclose the bug.

[Parax]

Re: Already fixed?

The article says

"Netgear has released a fix for the update, though Kenin says that getting the network hardware giant to pay attention to the report was a nine-month ordeal "

[Charles 9]

Re: Already fixed?

Same here for my R7000.

[joed]

Re: Already fixed?

I guess this issue is with some newer Netgear routers. The only password recovery option for mine (that I'm aware of) is the hole in the back of the case (accepting metal pin). Maybe some of newer, cloud enabled "smart" routers that I'd not touch. Home router better be simple and did not require sign-in to somebody's cloud.

[Down not across]

Re: Already fixed?

I guess this issue is with some newer Netgear routers. The only password recovery option for mine (that I'm aware of) is the hole in the back of the case (accepting metal pin).

Appears so. I just checked on old WNDR3700 with V1.0.4.68 firmware (never used as a router, but just as an access point) and whilst failing to authenticate does result in page produced by unauth.cgi, there is no tokens or anything like that. Likewise passwordrecovered.cgi does not exist (results in 404).

[Christian Berger]

The problem is rather simple

Netgear probably doesn't write the code running on their routers, they get the code from the chipset vendors and then reskin it. So they decide on a chipset, and while the hardware is being developed, they re-skin the firmware of the vendor. Any updates coming out since then will simply be ignored.

[Voland's right hand]

WTF is your problem, Netgear?

WTF is your problem, Netgear? - it is Netgear. That's all.

[Korev]

Recomended SoHo router

I've pretty much lost confidence in Netgear's attitude to security and I'm thinking of getting rid of my R7000; what's the best AC router for SoHo use these days?

[pLu]

Re: Recomended SoHo router

PC Engines APU2 + UniFi AP AC.

[Voland's right hand]

Re: Recomended SoHo router

Anything that can run openwrt and install openwrt.

I usually buy Tp-Link (after checking that it is supported on OpenWRT website).

[YourNameHere]

Re: Recomended SoHo router

I've been testing out the new Peplink Soho for my office and it's looking pretty good.

https://www.peplink.com/products/pepwave-surf-soho/

[Paul Woodhouse]

Re: Recomended SoHo router

I do quite like Drayteks...

[Christian Berger]

Re: Recomended SoHo router

If you want a "setup and forget" solution, look at a Fritz!Box. Those have auto update.

[Anonymous Coward]

Consumer products are mediocre

Most consumer product is build as cheaply as possible, hacked together software running on low cost hardware, , which is reflected in the price. As in power tools there are cheap home versions (consumer grade) of the more expensive version sold to the commercial sector (industry grade).

[TeeCee]

The internet problem.

Your device's security was tested by half-a-dozen people working to a tight deadline.

Your device's security will be tested by thousands of people with nothing better to do until you throw it away...

[An nonymous Cowerd]

I recently upgraded from Asus to Apple, throughput went up, availability went up!

(hanging off a long distance 802.11A/WiMax mountain top ISP-company in the alps)

this shiny 2013 Extreme does do AC quite well, limit of about 50 clients, and I was able to find it refurb - Apple are about to drop making new ones, according to rumors. AMZN currently has them for £159.

Strangely, my ISP (often) cut my RT-AC56U off as it was pinging for NTP 'too-much' in their opinion, the previous Asus RT-N16 was perfect - but was taken out by the EMP of lightning hitting something in the garden.

[Charles 9]

That wouldn't be EMP that killed your router but a power surge. Lightning, even just in close proximity, can fry a lot of electronics, even WITH protection.

[Mad Chaz]

Not for everyone

But personally, I use pfSense. In my case, inside a VM on the computer I use as my home server. But any old/small/underpowered computer with 2 NIC can run it really.

It's just not the kind of thing most people want to use.

[Richard Boyce]

Default port numbers

This is a reminder to use non-default port numbers for services such as remote management. This will sometimes prevent zero-day expliots as well as provide a little protection for those who are slow to patch.

[Tom 64]

Re: Default port numbers

It may be worthwhile to resort to that, but only if you cannot turn off the external interface.

Not exposing your admin interface to every hacker out there is a much better idea.

[JustNiz]

Here's your best option if your hardware supports it:

http://wiki.openwrt.org/toh/start?dataflt%5BBrand*%7E%5D=netgear

[Charles 9]

Trouble is, support is incomplete. Can't use it for my R7000, for example, because it OpenWRT can't drive the wireless chips. It's an issue common with FOSS because wireless chips are fiercely guarded trade secrets owing to wireless patents and competition (Linux has similar WiFi issues).