Critical Vulnerability In NetUSB Driver Exposes Millions of Routers To Hacking 70
itwbennett writes: NetUSB, a service that lets devices connected over USB to a computer be shared with other machines on a local network or the Internet, is implemented in Linux-based embedded systems, such as routers, as a kernel driver. Once enabled, it opens a server that listens on TCP port 20005 for connecting clients. Security researchers from a company called Sec Consult found that if a connecting computer has a name longer than 64 characters, a stack buffer overflow is triggered in the NetUSB service. The advisory notice has a list of affected routers.
Re: (Score:2)
It actually does not. You can even get faster performance with garbage collection.
Re: (Score:2)
It actually does not. You can even get faster performance with garbage collection.
Yes, you can.... everywhere except in the real world. Garbage collection is one of the reasons iOS is much faster than Android on the same hardware.
Re: (Score:2)
It actually does not. You can even get faster performance with garbage collection.
Yes, you can.... everywhere except in the real world. Garbage collection is one of the reasons iOS is much faster than Android on the same hardware .
Since when does Android run on iOS devices? It doesn't?
. . . . .
Then it's not the same hardware.
Re: (Score:2)
At risk of being pedantic, there was a project years ago that got Android kinda-sorta working on the iPhone 3G. It was sluggish and drained your battery at an alarming rate because it didn't have any hardware-acceleration or power-management support, and it didn't let you make calls IIRC, but it was Android on an iPhone. It even set itself up in a dual-boot environment, so you could switch between Android and iOS. AFAIK, it was never developed into
Re: (Score:2)
It's all ARMv8.
Re: (Score:2)
And Windows Phone on the same hardware specs outperforms them all (which is why a $49 Nokia running WP is actually not a terrible experience)...........I'm pretty sure .Net has garbage collection.
Re: (Score:2)
Slashdot: Critical Vulnerability In NetUSB Driver Exposes Millions of Routers To Hacking
TFA: Tiny list of router models affected.
FTFY
Re: (Score:2)
Re: (Score:2)
Fail.
Actually: Stop having people program C that do not know how to program securely in C. 0-terminated strings are fine in some contexts and not in others. The problem is people that cannot tell which is which.
Re: (Score:2)
"Stop having people program C that do not know how to program securely in C"
Unfortunately we need more than handful of programmers ... we need the less able programmers, but we can't trust them with C.
A fact abundantly clear for 2 decades, yet C persists ... billions of dollars of unnecessary damages.
Re: (Score:2)
I disagree. We do _not_ need the "cheap" programmers as what they write has negative worth. The reason C persists is simple: It is the best tool for quite a few jobs and it is a good tool in the hands of an expert. The damage caused is indeed unnecessary, but it is never a tool's fault when it is wielded incompetently.
NOT a kernel bug (Score:5, Informative)
This is some crappy proprietary firmware library for very low cost network devices. As TFA mentions, we can expect a lot more of these vulnerabilities in the "IoT".
Re:NOT a kernel bug (Score:5, Insightful)
It may not be part of the mainline Linux kernel, but the "firmware library" here is a kernel module, so this bug is a kernel-mode remote execution vulnerability. Which... probably isn't that much worse than a userland vulnerability for this type of device, where everything typically runs as root anyway, but still.
Re: (Score:3)
These are not all necessarily "very low cost network devices". I have the Netgear R7000 which is in the list and at the time I bought it it was one of the highest rated and most expensive home WiFi routers available. Granted, these are not corporate infrastructure level devices, but they are certainly not all "very low cost" ones either.
Re: (Score:2)
Pretty much the only thing
DD-WRT / other open source router software? (Score:5, Interesting)
The advisory focuses on hardware brands - doesn't mention anything about aftermarket software. Anyone know?
DD-WRT no. Vuln. if proprietary & shares webca (Score:3)
The vulnerable module appears to be proprietary, not open source, so dd-wrt and other open source firmware wouldn't include it.
If you have a router or similar device with a USB port which can be used to share USB printers and webcams, it's vulnerable. Sharing of USB STORAGE is done differently.
Millions (Score:3)
If by "millions" you mean "one or two with computer names longer than 64 characters." At least for external threats. For internal threats on public WiFi, the networks should always be presumed to be insecure. For private networks, you already control the devices that connect because you have a secure passphrase, right? Right?
Re: (Score:2)
Not only that, but it appears that it needs to be internal (as in physical access), a name longer than 64 character PLUS connected via USB. I cannot think if too many instances where this is a mission critical combination.
This is what you get for not using Systemd (Score:1)
Not surprised at all for trusting any services management with anything other than Systemd
Proprietary, not open source (Score:5, Insightful)
The buggy software is not open source. It is proprietary. I'll FTFY, updating your post to reflect that it's proprietary software:
Another day another MASSIVE security problem caused by proprietary software. I cannot wait for this shitty industry of crappy software written by crappy programmers hired by managers focused purely on profit to die the death it so richly deserves. This is going into my yearly talk I give at the local compsci department about why proprietary software should be SHUNNED, not embraced, by up and coming programmers. Not only does it cost us JOBS and INCOME potential, it demonstrably results in WORSE software.
More pointedly (Score:2)
Who needed it? (Score:3)
Seriously. NetUSB? On a router? WHY the devil would I want that?
But lemme guess: It was cheap to add, it was a feature that we can tack onto the "look, shiny!" list of things the router can do and people simply count down the "features" of a router whether they need them or even know what the fuck they are.
Meanwhile, it becomes near impossible to buy a router that is JUST THAT. A router. And in case you're wondering "hey, why would you want that when you can have $feature on top of it for FREE?", look no further than this exploit. Without the useless gadget that netUSB is, this exploit would not exist!
Re: (Score:2)
So...disable all the features you aren't using to minimize your threat surface?
Re: (Score:2)
I do. If that's possible at all. Besides, not always does "disabling" a service really render it secure against an exploit targeting it. That's the whole point behind an exploit, that whatever it attacks does not behave as it should.
Re:Who needed it? (Score:5, Interesting)
Seriously. NetUSB? On a router? WHY the devil would I want that?
Printer sharing. A problem that was solved well in the 80's and since re-solved slightly worse every few years. It is difficult to imagine a worse way than NetUSB, but I am sure there are developers out there with a better imagination than mine.
Re: (Score:2)
It was solved in the 80s and then crapped on in the 90s in the name of making ever-cheaper disposable printers for the purpose of selling million-dollar ink cartridges and print heads.
Re: (Score:3)
Re: (Score:2)
>What was the solution in the 80s that you are referring to?
Ethernet.
Either it has wifi or an "RJ45" jack on the back or it's crap.
--
BMO
Re: (Score:2)
There are lots of solutions:
Re: (Score:2)
So yeah, not seeing this as a really killer feature in a router. I guess that's why my router doesn't have a USB port.
OpenBSD (Score:1)
They should be using OpenBSD in routers anyway.
pfsense for the win (Score:2)
Still glad I'm using my pfsense router.
I have no doubt that there are plenty of devices that suffer from this vulnerability and will never see a firmware update because they'd rather you "buy some shiny new hardware that will not have this vulnerability". Well, guess what? I bought my last 2 routers for that reason, and I shouldn't have to buy a new one every 2 years because the manufacturer went cheap-and-dirty.
NetUSB=proprietary. Is there an open replacement? (Score:3)
It happens I could use remote USB port functionality.
(Right now I want to run, on my laptop, a device that requires a Windows driver and Windows-only software. I have remote access to a Windows platform with the software and driver installed. If I could export a laptop USB port to the Windows machine, it would solve my problem.)
So NetUSB is vulnerable. Is there an open source replacement for it? (Doesn't need to be interworking if there are both a Linux port server and a Windows client-pseudodriver available.)
Re: (Score:3)
Re: (Score:2)
Yes, Linux has USB/IP support. There's a kernel module to handle it on the Linux host, and there's a client driver available for Windows (although I'm not sure how well it works as I've never used it myself).
I had a need to get a USB scanner into a Windows 7 VM that I connected to via RDP. I put Linux USB/IP on a raspberry PI and plugged the scanner in. The Windows box got the client. I could scan. Problem solved.