While demonstrations of hacking routers and other networked hardware is not new to Black Hat, this presentation was unusual because so much of the attack was automated. Its success hinged on social engineering, a modern browser supporting HTML5 and lax password security.
The two demonstrated their attack with a widely available, but older model small office/home office (SOHO) router from Linksys by Cisco. Attacking this made sense because users tend to ignore what is happening with their routers so long as the devices keep doing their jobs, Brashars said.
Purviance added that many enterprises have SOHO routers running smaller networks, which means attackers could use this method to piggyback onto the enterprise network.
“You’ve essentially turned these SOHO devices into a full-blown Linux attack framework,” Brashars said.
The program then instructs the browser to scan the local network and list all connected devices. The next step launches a brute-force attack on one of the devices to crack its login information. This becomes even easier if the password on the router hasn’t been changed from the manufacturer’s default.
Once the attacker has access to the router interface, it’s relatively simple to use HTML5 to launch a cross-site request forgery attack to download and install malicious firmware onto the router, granting full control over the device.
“We’re replacing an operating system on a network device and taking complete control of it,” Purviance said.
To eliminate this attack opportunity, cross-origin resource sharing in HTML5 should be more restrictive, and embedded devices should have cross-request forgery protections on embedded devices, Purviance said. Also, web browsers should not allow external processes from accessing local network addresses, and networked devices should be getting automatic updates instead of relying on users to manually install them.
Changing the router’s administrator password to something strong and complex will also make it harder for the attack to succeed. Cisco is one of the few vendors that now force users to pick a new default password during initial set-up. In fact, the user has to manually disable the security policy in order to avoid changing the password, or to select a weak password.
But while some vendors have taken steps to increase the device’s security, most have not, Brashars said.