Feeds

Tenda seals shut router backdoor found by D-Link hole-prober

Shut the back door!

Secure remote control for conventional and virtual desktops

Chinese networking manufacturer Tenda has issued a fix that seals up a recently discovered backdoor in its wireless router kit.

Craig Heffner, the same researcher who uncovered a backdoor in routers from D-Link, uncovered more secret functionality that ships with Tenda's products.

Heffner discovered the flaw after unpacking firmware updates for Tenda's networking kit and locating suspicious code.

Attackers could take over the router and execute commands simply by sending a UDP packet with a special string, as explained in a detailed advisory.

"The backdoor only listens on the LAN, thus it is not exploitable from the WAN," Heffner explains. "However, it is exploitable over the wireless network, which has WPS enabled by default with no brute force rate limiting. My shiny new ReaverPro box made relatively short work of cracking WPS, providing access to the WLAN and a subsequent root shell on the router.'

Heffner warned that the backdoor was present on Tenda’s W302R and W330R router models as as well as re-branded models, such as the Medialink MWN-WAPR150N, because all share the same exploitable functionality (specifically a “w302r_mfg” magic packet string in a modified GoAhead webserver) that ships with the products.

Attackers could gain unauthenticated access to the routers’ administrative interfaces through its built-in web server on all affected models, provided they had first managed to hop onto the same network as their intended victim.

Target Components, which distributes Tenda's products in the UK, acknowledged the problem while crediting Tenda for developing a fix in just two days.

The company had released a software update that closes the backdoor on the three affected models. Target added that, contrary to fears expressed by other security researchers in they wake of Heffner's discovery, the backdoor problem was restricted to three models of Tenda-manufactured kit.

In a statement, Tenda apologised to its customers and said: “We promise that no other lines of Tenda have the same bugs after all lines were detected systematically by our engineers.”

Tenda's notice (in less-than-perfect but broadly understandable English, key extract below) also plays down the significance of the whole security flap.

It was also verified by our engineers that the bug will not make your network system be visited via internet by strangers, so we can promise that there is no big security problem occurred. However, we would suggest that all the SME users who use those two lines upgrade them immediately just in case of further security problems.

The relevant security patches can be found via links within Tenda's advisory here.

We passed on Tenda's advisory to Heffner but are yet to hear from him. Thus there's no confirmation that the fix released by Tenda actually does what it says on the tin.

Earlier this month Heffner discovered a similar backdoor on a range of router kit from D-Link. In response, D-Link promised to close its routers' backdoors by Halloween (31 October).

Pending the availability of a fix, users of the vulnerable kit are advised to disable remote access to their routers and make sure their wireless networks are secure. ®

Remote control for virtualized desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.