Network devices – such as routers, switches, printers and firewalls – can be hijacked to give a remote attacker full control of the network, Phil Purviance and Joshua Brashars, senior security consultants at AppSec Consulting, said during their presentation on Thursday. The attack method relied on JavaScript and cross-site request forgery, they said.
While demonstrations of hacking routers and other networked hardware is not new to Black Hat, this presentation was unusual because so much of the attack was automated. Its success hinged on social engineering, a modern browser supporting HTML5 and lax password security.
Typically JavaScript attacks are limited to the browser, but the researchers used a blended attack, which broke this constraint and could affect actual network devices and the network itself.
The two demonstrated their attack with a widely available, but older model small office/home office (SOHO) router from Linksys by Cisco. Attacking this made sense because users tend to ignore what is happening with their routers so long as the devices keep doing their jobs, Brashars said.
Purviance added that many enterprises have SOHO routers running smaller networks, which means attackers could use this method to piggyback onto the enterprise network.
“You've essentially turned these SOHO devices into a full-blown Linux attack framework,” Brashars said.
The blended attack would begin with a social engineering scam to lure the victim to a malicious website and execute a specially crafted JavaScript program, Brashars said.
The program then instructs the browser to scan the local network and list all connected devices. The next step launches a brute-force attack on one of the devices to crack its login information. This becomes even easier if the password on the router hasn't been changed from the manufacturer's default.
Once the attacker has access to the router interface, it's relatively simple to use HTML5 to launch a cross-site request forgery attack to download and install malicious firmware onto the router, granting full control over the device.
“We're replacing an operating system on a network device and taking complete control of it,” Purviance said.
To eliminate this attack opportunity, cross-origin resource sharing in HTML5 should be more restrictive, and embedded devices should have cross-request forgery protections on embedded devices, Purviance said. Also, web browsers should not allow external processes from accessing local network addresses, and networked devices should be getting automatic updates instead of relying on users to manually install them.
Changing the router's administrator password to something strong and complex will also make it harder for the attack to succeed. Cisco is one of the few vendors that now force users to pick a new default password during initial set-up. In fact, the user has to manually disable the security policy in order to avoid changing the password, or to select a weak password.
But while some vendors have taken steps to increase the device's security, most have not, Brashars said.
