Unluckily for us, the Mexican issue is not an isolated one. Here in Spain we have quite an accute problem, especially in ADSL routers. I recently read in Bandaancha that it’s no longer necessary to trojanize the computers in order to make DDoS attacks. Incorrectly preconfigured ADSL routers can be used as additional zombies on the wild, replying to DNS queries from the WAN side. At least for the moment, no profit can be made from it, but the attackers gain the ability to remotely manage routers. What if they include a sniffer in a vanilla firmware that reports back to a botnet any logged data? This is not as easy as using traditional methods, but it’s still a chance.
I was concerned after reading it, but I didn’t think it was strange at all. We have a long-term, unresolved problem. It started when the first ADSL lines appeared. Simply put, ISPs couldn’t cope with the growing demand of ADSL lines, so there was no time for them to worry about security. A lack of both know-how and capability of foreseeing future issues have not helped either. Until today, the number of broadband users has been increasing, and the security problems in the routers that the clients receive from ISPs remain unresolved.
To summarize, most ADSL routers for home clients still come with these security flaws:
- Poor wireless preconfiguration
- Default users
- Lack of proper remote management
- Lack of automatic updates
I think that those who should worry the most are ISPs offering ADSL services. Sure, there are daring users who might, unwittingly, misconfigure their routers, but those are the minority. Most home users don’t change their router’s settings. Problems like DNS Amplifictation shouldn’t exist, because all that’s needed to avoid them is proper configuration and remote management. Today, no one would expect a mail administrator to configure the company MTA in an open relay. Such behavior would be considered unprofessional, to say the least. Why shouldn’t the same apply to network engineers?
Is it possible to solve the problem remotely with some kind of massive firmware upgrade and reconfiguration, or is the system fatally wounded and the routers need to be entirely replaced, much like what happened with SECA/NAGRA? I’m afraid the latter is more likely to happen, with the added problem that the cost is considerably higher than that of sending one million bug-free smartcards. So why do they keep installing flash memories on the routers? It may be worth going back to the good-old mask ROM much cheaper and with a nice retro look.