The weakest link on the network: Exploiting ADSL routers to perform cyber-attacks

Abstract

ADSL routers are an integral part of today's home and small office networks. Typically, these devices are provided by a user's ISP and are, usually, managed by people who do not have any special technical knowledge. Often poorly configured and vulnerable, such devices are an easy target for network-based attacks, allowing cyber-criminals to quickly and easily gain control over a network. In this paper, we systematically evaluate the security of ADSL routers and identifY the potential of attacks, which attempt to compromise the vulnerabilities of their web interface. More specifically, we present common vulnerabilities and attacks that occur in websites on the Internet, and project them on the special characteristics of the web management interface of ADSL routers. To put this analysis into a practical context, we investigate the security of a popular ADSL router provided by a Greek iSP. in this security assessment, we have discovered two O-day vulnerabilities in the web management interface of the tested router. In particular, we discovered an operating system (OS) command injection and stored Cross-Site Scripting (XSS) attack. A malicious may exploit these vulnerabilities to perform several large-scale attacks. Specifically, he/she can perform DNS hijacking attack and redirect the users to fake web sites for phishing; mount a Distributed Denial of Service (DDoS) attack using the compromised routers as zombie machines; or even spread a malware. Finally, we discuss some well-known security practices that should be followed from developers and users to enhance the security of ADSL routers.

Commix: automating evaluation and exploitation of command injection vulnerabilities in Web applications

“…More specically, in a previous paper [58], we investigated the security of a popular ADSL router named ZTE ZXV10 H108L ADSL 2+ Wireless Router, provided by the Telecommunication Company "WIND Hellas". Through the usage of Commix tool, we were able to automatically identify exploitable classic results-based, time-based blind and le-based semi blind command injection vulnerabilities on the "host" POST parameter of the "manager_dev_ping_t.gch", that allow an attacker to execute arbitrary commands on the target host system, with highly granular permissions/privileges.…”