Netgear 0-day vulnerability analysis and exploit (opens in new tab)

> The worst part is this isn't even just going to affect folks that would never think to update their router firmware. The firmware they do push out is frequently a massive downgrade.

I worked there a bit over 10 years ago, so things may have changed, but honestly I wouldn't expect them to change all that much. For that kind of hardware (SOHO stuff), Netgear didn't have any software developers in-house. It was all outsourced to dev shops in Asia. The software was usually whatever generic thing the dev house had built, with customization for branding and enabling/disabling features Netgear wanted or didn't want. Occasionally they would pay to add features that didn't exist.

Netgear usually didn't get source code, and would only get changelogs for new releases (which weren't all that detailed). There were often many regressions, and all bug testing and feature verification was black-box. When something was wrong, it was often a fight to get the dev house to prioritize it, especially if they didn't think it was a critical bug (declaring a bug a shipping showstopper was usually effective, but you can't cry wolf all the time, and that only works for pre-release products, not updates).

I imagine things are better now; at the very least I expect these developers to have at least a little more awareness of common security issues and how to avoid them (definitely was not the case in the 00s), but I assume it's still a mixed bag. On the plus side, most of the current-gen hardware is beefy enough to run Linux, which a lot more developers are familiar with (IIRC a lot of the stuff back then was running vxWorks), which hopefully makes it easier to hire better developers.

If you want high-quality software on your networking gear, go with a company that you know is actually a software company, and not an outsourced hw/sw company. Products that are based on OpenWRT or Tomato or something like that are probably safer, assuming they haven't broken it with their customizations... but don't expect updates to new major releases. Having said that, I still buy Netgear switches and other stuff that's internal to my network and are generally relatively "dumb". They're usually pretty reliable and reasonably priced.

Highly recommend the synology line of routers. I've deployed a few of them for neighbors and have gotten exactly 0 calls. They mesh over wired or wireless, and for all of their faults Synology does a pretty good job of releasing software updates for their products for WAY longer than any other vendor I've worked with.

Just make sure you use the 2600AC as the primary router, the 2200s can technically function in that role but are pretty under-powered.

The best thing about setting up Google wifi routers for your relatives is you can set yourself up as the manager of them, and manage them with the Google Wifi app from anywhere. So before Uncle Bob calls you about the wifi you'd already have got the notification that his cable service is down again.

Another brand i vouch for is AVM, their routers are all over Germany and they're reliable workhorses for years...

Maybe, just maybe, someone should start a list with vendors that put out shitty software on their devices, never deliver firmware updates and have stupid exploits...

One of the redeeming features of the R7000 is that it can run AdvancedTomato, DD-WRT, etc.

DD-WRT on the R7000 is flawless.

I even run nginx as a name-based proxy on mine, with load balancing! Works like a champ.

For all software, we need 2 branches... one with feature updates and security fixes and one with only security fixes (Maybe AI will figure out a way to make this happen). That would reduce the number of bugs in one of the branches.

> I found this fix months after it had been posted, and there had still been no new patch released to fix the issue.

D-Link isn't any better, many of their firmwares to fix KRACK were in Beta for 4 years and many are still in Beta.

I run an OpenBSD router at home. I'm not sure if that would satisfy your security requirements.

> I am sick of having to assume my network hardware is trivially compromised.

I don't have the gateway my ISP gave me on my LAN for this reason. I do have to laugh a little bit about people who use a VPN to hide requests (DNS? Because most of the web is HTTPS, now) from their ISP when their ISP has a device on their network.

The tough part in my opinion is the access point. You either have to:

- Put a wireless card in the router, but a lot of them are crap (limited features, not dual band, require closed firmware, not compatible with *BSD...)

- Buy an access point appliance, but most of them are as secure as the Netgear devices of the fine article.

Get an enterprise router/firewall.

Also most of these vulnerabilities (as the article points out) are in the web server. If the web server isn't exposed,it isn't of much practical security concern.

I've also run DD-WRT for years with excellent results. Per the usual benefits of open source and active maintainers, it is generally going to (a) have the trivial stuff already addressed (b) keep up to a reasonable extent with security patches.

You seem to imply that by virtue of being a microkernel, an OS will be imbued with magical powers preventing it from being compromised.

The last time I looked into OpenWRT/DD-WRT (years ago), it seemed disadvantageous to switch to them because they would be slower than stock firmware due to missing some kind of hardware support. Is this still the case these days?

EDIT: It sounds like the situation for my router (R7000) is quite the opposite now, apparently being almost twice as fast due to new hardware acceleration features.

What's the deal with no signatures on OpenWRT firmware images.

In my experience, the biggest gain is from separating the router from the wireless AP. It lets you choose among more affordable, purpose built and higher performance devices.

Specifically I would recommend the TP-Link EAP line as a wireless AP (the $50 EAP225v3 is very good). Extremely simple to configure. Routers that perform well require configuration unfortunately, especially economical ones like the Microtik ($50). It lacks out of the box settings for port forwarding and hairpin NAT, though it has the simplest secure VPN setup I have ever seen. The only router that competes with its performance (ie can route gigabit Internet at full speed) with easy config is the Cisco RV340, which costs $220 and is 3 years old.

Apple discontinued its wireless routers because they were bad. Apple routers run an ancient and naturally no longer patched version of NetBSD. They have terrible wireless performance on the worst Broadcom chipset with awful quirks. They mix with non Broadcom wireless devices extremely poorly (typically Atheros is the high performance pick). They are extremely slow, not at all suitable for gigabit Internet. If you update the port forwarding they must restart, and take down your internet. However, they are basically purpose built for correct macOS and iPhone multi-AP WiFi hand-off. There are things they do that not even enterprise hardware does right or may ever do right, simply because Apple does not document the magic that makes it possible. Or because Apple uses such bad chipsets with so many quirks, that only those quirks all working together do things go right. If I were you, I’d eBay away your 7 year old Airport Express to some greater fool, and use that surprisingly large amount of money to buy good stuff.

Anyway, most people shove their wireless AP into a bookshelf, taking at least 30% of their internet bill worth of performance and lighting it on fire. People use mesh networking wireless, like the Eero, something so abjectly bad it boggles the mind, because they’d rather spend $300 once to only use 50% of their internet’s monthly value than $10 once on Ethernet cable to get 100% of it. Sometimes they buy Ubiquiti hardware, which is ancient and overpriced at this point, and wind up paying for some internet configuration license that makes no sense. I really pity the people paying a monthly fee for mesh wireless configuration. This stuff is extremely marketing driven, it is in reality just the same exact commodities (two possible wireless chipsets and Linux) remixed into whatever crap Google thinks will convince people to let them gather home networking telemetry.

But configuring a Microtik is not easy. So there you go.

I used to have apple gear, replaced it with a edgerouter for a while but that was too much of a bother. Now I got a amplifi HD which is more or less a apple experience in a good way.

Eero

The problem with than plan however, is that many of these devices tend to depend on arcane network hardware acceleration features in order to reach decent switching throughput.

Which rules out OpenWrt on some of the lower-spec pieces if you have a faster WAN connection (Ie. 1gbit), as I don't believe they have support for these on many platforms. (MT7621 is referenced as supported, and Qualcomm's "SFE" being supported in community builds)

They're running CGI and writing homemade web servers in C because they haven't maintained or upgraded their software in decades.

I don't think they are low power devices. My bet would be they're relatively normal hardware running a light linux. It takes quite a bit of power to route gigabit ethernet or ac wifi.

Rust isn't magic. And you can write CGIs in any language. Shouldn't we also ask why are they using their own web server? or why a company with millions of devices deployed has done little testing?

That's not a workable solution for the vast majority of the population.

In general, this is not a safe assumption to make -- for example, due to DNS Rebinding attacks.

The article also mentions that the exploit is working remotely:

> As the vulnerability occurs before the Cross-Site Request Forgery (CSRF) token is checked, this exploit can also be served via a CSRF attack. If a user with a vulnerable router browses to a malicious website, that website could exploit the user’s router. The developed exploit demonstrates this ability by serving an html page which sends an AJAX request containing the exploit to the target device.

Also, if you're replacing the firmware, the new firmware can create an outgoing root shell to a destination of your choice. There's no internal limitation here.

There is a much longer list within the comments of exploit.py

It appears they may have scraped the Netgear site and run all the images through binwalk + objdump to make the list.

Routers have been full of stupidly bad bugs for years; nothing really new here. I recall analyzing one a while back and finding that it used session tokens to determine whether one was logged into the interface. These were derived from the uptime with triple des, but the nonce was a constant string of text and the key was based off of interface mac addresses. One has to wonder, at that point, why do anything at all?

As someone who recently got the Dream Machine Pro with NanoHD access point, most of the consumers will not want to deal with such a setup. Also, Ubiquiti has their own issues to sort out as well.

AVM, I think (but not sure) that they're still made in Germany

Mikrotik

Draytek