Difference between revisions of "Misfortune Cookie Vulnerability"
Jump to navigation
Jump to search
(→Fixes) |
|||
| Line 20: | Line 20: | ||
==Fixes== | ==Fixes== | ||
NCF has looked into this vulnerability and recommends the following steps: | NCF has looked into this vulnerability and strongly recommends that you perform the following steps: | ||
*Verify hardware version - see [http://www.tplink.ca/en/Article/?id=46 this TP-Link page] to find hardware version | *Verify the hardware version - see [http://www.tplink.ca/en/Article/?id=46 this TP-Link page] on how to find hardware version | ||
*If your modem/router is in the level identified by TP-Link as upgradable, please ensure that you update the firmware, either yourself or by contacting NCF and arranging for the update to be done for you. You'll need to bring the modem/router with its power supply to NCF. No need to bring any cables (we have those). | *If your modem/router is in the level identified by TP-Link as upgradable, please ensure that you update the firmware ASAP, either by yourself (if you are comfortable doing so) or by contacting NCF and arranging for the update to be done for you. You'll need to bring the modem/router with its power supply to NCF. No need to bring any cables (we have those). | ||
*If your modem/router is not upgradable, NCF | *If your modem/router is not upgradable, NCF strongly recommends that you procure a newer modem/router, either from NCF or from a trusted store. | ||
*Carnegie Mellon University CERT [http://www.kb.cert.org/vuls/id/561444 also suggests] that units that do not have new firmware available can have their firmware replaced with [https://en.wikipedia.org/wiki/DD-WRT dd-wrt], [https://en.wikipedia.org/wiki/OpenWrt openwrt], or [https://en.wikipedia.org/wiki/List_of_wireless_router_firmware_projects others]. NCF members can do this themselves at their own risk. | *Carnegie Mellon University CERT [http://www.kb.cert.org/vuls/id/561444 also suggests] that units that do not have new firmware available can have their firmware replaced with [https://en.wikipedia.org/wiki/DD-WRT dd-wrt], [https://en.wikipedia.org/wiki/OpenWrt openwrt], or [https://en.wikipedia.org/wiki/List_of_wireless_router_firmware_projects others]. NCF members can do this themselves at their own risk. | ||
*Regardless of the above, the following two TP-Link articles describe | *Regardless of the above, the following two TP-Link articles describe recommended safe practices: | ||
**[http://www.tp-link.com/en/article/?faqid=573 How to protect your TP-LINK network devices from potential attack?] | **[http://www.tp-link.com/en/article/?faqid=573 How to protect your TP-LINK network devices from potential attack?] | ||
**[http://www.tp-link.com/en/article/?faqid=308 How to disable remote management function for TP-LINK ADSL modem router] | **[http://www.tp-link.com/en/article/?faqid=308 How to disable remote management function for TP-LINK ADSL modem router] | ||
| Line 39: | Line 39: | ||
The firmware (FW) version can be identified and upgraded by executing the following steps: | The firmware (FW) version can be identified and upgraded by executing the following steps: | ||
*Ensure that you have your NCF credentials on-hand before performing the upgrade | *Ensure that you have your NCF credentials on-hand '''before''' performing the upgrade | ||
*Connect your desktop or laptop to the modem/router via Ethernet cable - this should NOT be done via Wi-Fi! | *Connect your desktop or laptop to the modem/router '''via Ethernet cable''' - this should '''NOT''' be done via Wi-Fi! | ||
*Launch a browser and type in the URL 192.168.1.1 (see [http://www.tp-link.com/en/article/?faqid=315 this TP-Link article]) | *Launch a browser and type in the URL '''192.168.1.1''' (see [http://www.tp-link.com/en/article/?faqid=315 this TP-Link article]) | ||
* | *'''Username: admin''', '''Password: NCF_DSL_PW''' (by default, NCF uses the '''NCF_DSL_PW''' also for '''log-in''' and '''Wi-Fi''' Pre-Shared Key) | ||
*Click on the | *Click on the '''Maintenance''' tab | ||
*Click on the Firmware tab and verify that your FW version is as indicated above. If not, [http://www.tp-link.com/en/article/?faqid=296 follow the TP-Link upgrade instructions]. | *Click on the '''Firmware''' tab and verify that your FW version is as indicated above. If not, [http://www.tp-link.com/en/article/?faqid=296 follow the TP-Link upgrade instructions]. | ||
==Notes== | ==Notes== | ||
Revision as of 17:51, 31 December 2014
This article is about the so-called Misfortune Cookie vulnerabilities discovered on modem firmware in 2014, what it is and what to do about it.
Background
Each modem/router sold by NCF has a built-in web server to allow the modem to be configured by any computer via any browser.
In December 2014 Carnegie Mellon University CERT announced that some DSL modems/routers have a vulnerability that have existed in the firmware since 2002. This security problem has been detected in the firmware that uses vulnerable versions of Allegro RomPager in the web server portion of the firmware employed by many modems/routers, including some of those sold by NCF.
Vulnerability
The security vulnerability can be fixed in recent modems/routers by upgrading the firmware, replacing the web server with a newer version that does not have the security vulnerability.
Older modems do not have a firmware upgrade available, so it is important to make full use of the available security to prevent outsiders from using the web server to re-configure the modem in some undesirable way.
It is possible to access the web server in two different ways:
- Connect to the web server from the outside, via the DSL line (WAN side). This route is closed if you are using a modem/router that has been configured by NCF
- Connect to the web server from the inside (LAN side), either via your Wi-Fi network or via an Ethernet cable. We assume that you are not going to let untrusted person/s connect to your LAN via Ethernet, so in the same manner you also need to prevent them from connecting to it wirelessly. It is therefore very important that you have good security on your Wi-Fi network, with a good password. If the modem/router has been configured by NCF, it will have a good password (by default, NCF uses your NCF DSL password also for log-in and Wi-Fi).
As a general rule, if your modem/router has been configured by NCF, and you are sure that unknown persons cannot use your Wi-Fi network, you have pretty good security against the "Misfortune Cookie" vulnerability.
Fixes
NCF has looked into this vulnerability and strongly recommends that you perform the following steps:
- Verify the hardware version - see this TP-Link page on how to find hardware version
- If your modem/router is in the level identified by TP-Link as upgradable, please ensure that you update the firmware ASAP, either by yourself (if you are comfortable doing so) or by contacting NCF and arranging for the update to be done for you. You'll need to bring the modem/router with its power supply to NCF. No need to bring any cables (we have those).
- If your modem/router is not upgradable, NCF strongly recommends that you procure a newer modem/router, either from NCF or from a trusted store.
- Carnegie Mellon University CERT also suggests that units that do not have new firmware available can have their firmware replaced with dd-wrt, openwrt, or others. NCF members can do this themselves at their own risk.
- Regardless of the above, the following two TP-Link articles describe recommended safe practices:
As long as you have the following hardware versions and the latest corresponding firmware versions installed, then your modem/router is not affected by the Misfortune Cookie.
- TD-W8951ND:
- hardware v5; firmware TD-W8951ND_V5_141114
- hardware v6; firmware TD-W8951ND_V6_141027
- TD-8816: hardware v8; firmware TD-8816_V8_140311
The firmware (FW) version can be identified and upgraded by executing the following steps:
- Ensure that you have your NCF credentials on-hand before performing the upgrade
- Connect your desktop or laptop to the modem/router via Ethernet cable - this should NOT be done via Wi-Fi!
- Launch a browser and type in the URL 192.168.1.1 (see this TP-Link article)
- Username: admin, Password: NCF_DSL_PW (by default, NCF uses the NCF_DSL_PW also for log-in and Wi-Fi Pre-Shared Key)
- Click on the Maintenance tab
- Click on the Firmware tab and verify that your FW version is as indicated above. If not, follow the TP-Link upgrade instructions.
Notes
- A lot of your questions can be answered on TP-Links FAQs
- Any WAN vulnerability is blocked from the Internet by disabling WAN access by ACL (Access Control Level):
- Log into 192.168.1.1
- Enter admin & DSL password
- Click on Access Management tab
- Verify that ACL: Activated is selected
- Verify that Interface: LAN is selected.
- NCF started verifying this on all modems since July/August 2014. NCF also checked that Remote Management port is disabled. See this TP-Link article for further step-by-step instructions.
- Any LAN vulnerability is blocked from the LAN by using a strong Wi-Fi password (NCF applies the DSL password here). If your Wi-Fi is open (no password is required to connect, like in many public places), then your modem is open to attack. We strongly advise that you implement Authentication Type: WPA-PSK/WPA2-PSK with Encryption: TKIP/AES to secure your Wi-Fi network with the highest available settings