Feeds

D-Link exposes WiFi routers with new 'security feature'

It's not a lock. It's a key

Top 5 reasons to deploy VMware with Tegile

A new security feature added to some D-Link wireless routers actually makes users more susceptible to network intrusion, according to a hacker blog, which provides enough evidence to be taken seriously.

Manufacturer D-Link was still busy congratulating itself for adding a CAPTCHA designed to prevent malware bots from logging on to the devices when folks at the SourceSec Security Research blog showed how the upgrade could be manipulated to steal a WPA (or Wi-Fi protected access) password without even bothering to solve the test.

That's because the new firmware logs in using a GET request containing a salted MD5 hash of the password, along with with input that's unique to the CAPTHCHA image. It turns out all that's required to access the router's setup page is the hash, so the feature provides an easy way for anyone within range to access the panel that controls all kinds of sensitive settings and contains the WPA password.

What's more, the new firmware allows even those with user-level access the ability to log in to the control panel, so an attacker need not have administrative credentials to perform the attack.

When we learned earlier this week that D-Link added the CAPTCHA to some of its home and office routers, we dismissed it as little more than a gimmick designed to lull inattentive consumers into a false sense of security. After all, it does nothing that couldn't be achieved by taking 30 seconds to change the default password to a phrase that's strong and unique.

Now we learn that it can actually make it easier for people within range to sneak into private sections of a network and uses the notoriously insecure MD5 hash to boot. Now that's something worth writing about. ®

Remote control for virtualized desktops

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?