*http://www.govinfosecurity.com/report-flaw-affects-12-million-routers-a-7738/op-1 <http://www.govinfosecurity.com/report-flaw-affects-12-million-routers-a-7738/op-1>*
*Flaw Affects 12 Million Routers* *Devices from 50 Manufacturers Affected, Check Point Warns* By Mathew J. Schwartz, *December 30, 2014.* At least 12 million home and small-office routers from 50 manufacturers have a flaw that an attacker could remotely *exploit* <http://www.databreachtoday.com/breaches-c-318> to seize control of the device and intercept all data that it transmits, according to security firm Check Point Software Technologies. Among the devices at risk are at least 200 different products manufactured by such vendors as D-Link, Edimax, Huawei, TP-Link, ZTE and ZyXEL. See Also: How to Implement the NIST Cybersecurity Framework Using COBIT 5 <http://www.govinfosecurity.com/webinars/how-to-implement-nist-cybersecurity-framework-using-cobit-5-w-533> Check Point presented the findings of their research into what they've dubbed the "Misfortune Cookie" vulnerability at this week's 31st Chaos Communication Congress, or 31C3, in Hamburg, Germany. *Related Content* - Mitigating the Risk of Backdoor Attacks <http://www.govinfosecurity.com/mitigating-risk-backdoor-attacks-a-7158> - Chase Breach Offers Detection Lessons <http://www.govinfosecurity.com/chase-breach-offers-detection-lessons-a-7527> - FFIEC: Boards Need Cyber Training <http://www.govinfosecurity.com/interviews/ffiec-boards-need-cyber-training-i-2495> - Does U.S. Truly Want Cyber Peace? <http://www.govinfosecurity.com/interviews/does-us-truly-want-cyber-peace-i-2415> - Protecting Against 'Visual Hacking' <http://www.govinfosecurity.com/blogs/protecting-against-visual-hacking-p-1771> *Related Whitepapers* - Securing Cloud Workloads <http://www.govinfosecurity.com/whitepapers/securing-cloud-workloads-w-1143> - Secure Mobile Banking: Protecting Your Customers and Your Bottom Line <http://www.govinfosecurity.com/whitepapers/secure-mobile-banking-protecting-your-customers-your-bottom-line-w-1141> - Breach Prevention Tactics: How to Eliminate Stored Passwords <http://www.govinfosecurity.com/whitepapers/breach-prevention-tactics-how-to-eliminate-stored-passwords-w-1136> - Aligning Data Security with NIST 800-53 Requirements <http://www.govinfosecurity.com/whitepapers/aligning-data-security-nist-800-53-requirements-w-1131> - Security Incident Report: Data Breach at Target Corporation <http://www.govinfosecurity.com/whitepapers/security-incident-report-data-breach-at-target-corporation-w-1130> The company says it has discovered two distinct vulnerabilities in RomPager, which is a Web server built by Allegro Software that gets embedded in the firmware that runs many router and gateway devices. And Allegro has confirmed the flaws. One vulnerability, *CVE-2014-9222* <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9222>, allows an attacker to remotely bypass the device's authentication mechanism; this is the Misfortune Cookie flaw. A related vulnerability, *CVE-2014-9223* <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9223>, allows an attacker to create a buffer overflow on a device, triggering a denial of service. "The Misfortune Cookie vulnerability is due to an error within the HTTP cookie management mechanism present in the affected software, allowing an attacker to determine the 'fortune' of a request by manipulating cookies," the *Check Point* <http://mis.fortunecook.ie/> researchers say. "All an attacker needs in order to exploit Misfortune Cookie is to send a single packet to your public IP address. No hacking tools required - just a simple, modern browser." The Check Point researchers say they have yet to see any in-the-wild attacks that exploit the vulnerability. But based on scans of the Internet looking for equipment that runs a vulnerable version of RomPager, they found at least 12 million devices currently being used - across 189 countries - that are vulnerable to related attacks. Users of devices that sport the flaw are at risk of having their data intercepted, warns Dublin-based information security consultant Brian Honan, who heads Ireland's computer emergency response team. "The biggest risk would be for the attackers to be able to modify settings on the router, such as changing the DNS settings," he says. "This could allow the attackers to then redirect the users' Web traffic to phishing websites, malware-loaded websites, or to intercept their Internet traffic and capture sensitive information such as passwords and financial details." Beyond consumers, remote employees are also at risk from vulnerable devices, says threat-intelligence firm iSight Partners. "Although the Misfortune Cookie vulnerability does not affect routers commonly used in larger enterprise environments ... compromised devices still pose a potential threat to enterprises, especially to those with employees that perform work on their computer or mobile devices through home routers," it says in a research note. *Flaws Patched in 2005* In a statement, *Allegro Software* <https://www.allegrosoft.com/allegro-software-urges-manufacturers-to-maintain-firmware-for-highest-level-of-embedded-device-security/news-press.html>, which is based in Boxborough, Mass., notes: "These vulnerabilities were discovered in the RomPager embedded Web server version 4.07, which was released in 2002." But the company says that the flaws were identified and fixed, and an update - RomPager version 4.34, which fixes the vulnerability - was released to customers in 2005. The most recent version of RomPager is version 5.40. But Allegro Software says that some manufacturers are continuing to ship products that include a version of RomPager that is a decade or more out of date. "Unfortunately, not all manufacturers using Allegro Software products have updated their devices with the latest RomPager software component," it says. "In some cases, manufacturers continue to make and sell products with software components that are over 13 years old, which can expose products to security concerns." Allegro Software notes that it's a third-party supplier of embedded Web servers, and that it's incumbent upon device manufacturers to patch their customers' equipment, by issuing updated firmware. "If you have a product that is affected by the above security concerns, please contact the product manufacturer to obtain a firmware update," it says. Huawei's Product Security Incident Response Team tells Information Security Media Group that it has identified the vulnerability and published a security notice on its website. According to that *security alert* <http://www.huawei.com/en/security/psirt/security-bulletins/security-notices/hw-406887.htm>, both the Huawei Echolife HG530 and HG520c routers are vulnerable to the two vulnerabilities discovered by Check Point. Huawei on Dec. 24 released a related patch for each of those devices. D-Link, Edimax, TP-Link, ZTE and ZyXEL did not immediately respond to requests for comment on Check Point's research. *Pinpointing Problems* German IT journalist Hanno Böck has created a free online tool that's designed to *scan hostnames or IP addresses* <https://rompager.hboeck.de/> for the presence of equipment that contains either of the vulnerabilities identified by Check Point. If vendors fail to issue patches for vulnerable devices, then consumers might be best served by throwing those devices away. "If old tech is no longer supported, then people should consider replacing them with newer and more secure devices," says Honan, who is also a cybersecurity adviser to Europol. "Tech should be treated like many other items we use in our homes. If your vacuum cleaner can no longer do the job properly and it cannot be repaired, you replace it. The same [goes for] the items our digital lives depend on." __._,_.___ ------------------------------ Posted by: "beowulf" <[email protected]> ------------------------------ Visit Your Group <https://groups.yahoo.com/neo/groups/grendelreport/info;_ylc=X3oDMTJmdDJydTZ2BF9TAzk3MzU5NzE0BGdycElkAzIwMTk0ODA2BGdycHNwSWQDMTcwNTMyMzY2NwRzZWMDdnRsBHNsawN2Z2hwBHN0aW1lAzE0MjAwNTczNzk-> [image: Yahoo! Groups] <https://groups.yahoo.com/neo;_ylc=X3oDMTJlY2Q2c3NqBF9TAzk3NDc2NTkwBGdycElkAzIwMTk0ODA2BGdycHNwSWQDMTcwNTMyMzY2NwRzZWMDZnRyBHNsawNnZnAEc3RpbWUDMTQyMDA1NzM3OQ--> • Privacy <https://info.yahoo.com/privacy/us/yahoo/groups/details.html> • Unsubscribe <[email protected]?subject=Unsubscribe> • Terms of Use <https://info.yahoo.com/legal/us/yahoo/utos/terms/> __,_._,___ -- -- Thanks for being part of "PoliticalForum" at Google Groups. For options & help see http://groups.google.com/group/PoliticalForum * Visit our other community at http://www.PoliticalForum.com/ * It's active and moderated. Register and vote in our polls. * Read the latest breaking news, and more. --- You received this message because you are subscribed to the Google Groups "PoliticalForum" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
