D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by spartas on Tuesday October 08, 2019 @03:39PM (#21196290)

>Of course, in reality, this CVE seems almost un-exploitable in the wild, anyway. How will an exploiter get to the login page in the first place? They'd have to know your network password and be in your physical vicinity, or your ISP would have to send traffic to your router's login page from the Internet.

Nope. Not at all. Most router attacks these days are malicious JavaScript (like in ads and trackers) that send HTTP requests to the router from the user's own web browser (already inside the network). No proximity access is needed

https://arstechnica.com/information-technology/2019/07/websi...

[ Parent | on HN ]

Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by jjeaff on Tuesday October 08, 2019 @04:11PM (#21196635)

Would this not also require some sort of exploitable CORS vulnerability?

[ Parent | on HN ]

Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by chopin on Tuesday October 08, 2019 @04:33PM (#21196910)

CORS prevents the JS from seeing the result but it doesn't prevent the sending of the request.

This is one of the reasons my internal network is not 192.168.1.1/24 and the router is not 192.168.1.1.

[ Parent | on HN ]

Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by spartas on Tuesday October 08, 2019 @04:53PM (#21197137)

> This is one of the reasons my internal network is not 192.168.1.1/24 and the router is not 192.168.1.1.

Do you also disable WebRTC on all clients on your network? An attacker (or script) may be foiled by your non-standard gateway network, but your work in obfuscating the router is wasted if they can get at your client IP address.

[ Parent | on HN ]

Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by kbenson on Tuesday October 08, 2019 @04:56PM (#21197173)

Doesn't CORS generally send an OPTION request first to see if the target site even allows the requests, thus preventing this? That's what I've seen when trying to work around browser CORS limitations.

[ Parent | on HN ]

Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by rnicholus on Tuesday October 08, 2019 @05:14PM (#21197348)

only for ajax requests that are not "simple", that is requests that cannot be sent w/out JavaScript. The sending of this OPTIONS request is referred to as a pre-flight. A more through description at https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

[ Parent | on HN ]

Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by foxylion on Tuesday October 08, 2019 @05:15PM (#21197350)

You can also just do a normal form post request into an invisible iframe that is generated by the attacker's javascript.

[ Parent | on HN ]

Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by singron on Tuesday October 08, 2019 @04:35PM (#21196950)

You can submit forms without CORS as long as there is no CSRF protection. I don't know what CSRF protection is being used.

[ Parent | on HN ]

Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by peeters on Tuesday October 08, 2019 @04:29PM (#21196863)

Depends on the attack and the vulnerability. The article does say this:

> The attacks work when routers use weak administrative passwords and are vulnerable to CSRF attacks.

Which implies that a cross site request is being made. So e.g. you put a hidden form in a netf1ix.com page whose action is at some URL on the router. The user ends up accidentally posting data to that URL which is not affected by CORS and same-origin.

[ Parent | on HN ]

Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by jtaft on Wednesday October 09, 2019 @10:00AM (#21203303)

Normal form posts don't require pre-flight requests. DNS rebinding attacks can be used too.

[ Parent | on HN ]