Critical vulnerability in NetUSB driver exposes millions of routers to hacking

ITworld.com ^ | May 19, 2015 | Lucian Constantin

[Utilizer]

Millions of routers and other embedded devices are affected by a serious vulnerability that could allow hackers to compromise them.

The vulnerability is located in a service called NetUSB, which lets devices connected over USB to a computer be shared with other machines on a local network or the Internet via IP (Internet Protocol). The shared devices can be printers, webcams, thumb drives, external hard disks and more.

NetUSB is implemented in Linux-based embedded systems, such as routers, as a kernel driver. The driver is developed by Taiwan-based KCodes Technology. Once enabled, it opens a server that listens on TCP port 20005 for connecting clients.

Security researchers from a company called Sec Consult found that if a connecting computer has a name longer than 64 characters, a stack buffer overflow is triggered in the NetUSB service. If exploited, this kind of vulnerability can result in remote code execution or denial of service.

[Utilizer]

Yet more router vulnerabilities...

[Utilizer]

Ping...

[dadfly]

bookmark

[Ray76]

more...

http://www.kb.cert.org/vuls/id/177092

[bob_denard]

for what i’ve hearded hackers can do eveything and anything so with more security it will be useless

[ShadowAce]

[rarestia]

I highly recommend a software router running on an old laptop or computer in your home. pfSense is far and away one of the best free router/firewall programs I’ve ever played with, and it beats the pants off of any retail router/switch.

[logi_cal869]

Interesting

http://www.infoworld.com/article/2861574/network-security/you-should-be-running-pfsense-firewall.html

Thanks

[rarestia]

Don’t let the spec sheet scare you. If you’re a home user, you can set it up on an old laptop, and it’ll run just fine. There are a few communities that have it setup on Arduino and Raspberry Pi devices. And there are enterprises using them for mid- to large-scale deployments.

[goodnesswins]

I need someone to translate that article..although at end it says you can purchase it ready to install...

[BuckeyeTexan]

As long as computers understand 0’s and 1’s, they're hackable, period. Ain't no such thang as computer security. We do what we can to limit the risks and that's all we can do.

There's always a way around or through if one is knowledgeable enough to find it.

[bob_denard]

Cybercrime Cost Americans $800,492,073 Last Year

The Federal Bureau of Investigation’s Internet Crime Complaint Center (IC3) tallied 269,422 complaints in 2014, totaling $800,492,073 in losses, according to a new report. The center has received 3,175,611 complaints since its establishment in May 2000.

The losses compiled in 2014 are likely much lower than actual Internet crime losses. The report states, “Only an estimated 15 percent of the nation’s fraud victims report their crimes to law enforcement, while the IC3 estimates less than 10 percent of victims file directly through [w]ww.ic3.gov.”

http://www.latimes.com/nation/la-na-boy-scouts-call-end-gay-leader-ban-20150521-story.html

[beef]

If I understand this correctly, the attack would have to come from within your network. Does this affect routers running DD-WRT?

[Utilizer]

If I understand the article correctly, it does not matter either way, running it or not. It’s the NetUSB driver that is the culprit, not whether the router runs DD-WRT.