These code-execution exploits are limited in their scope because adversaries must either be in a position to conduct a man-in-the-middle attack or tamper with the DNS server that a device uses to find the update on the Internet. The combination of those two lapses makes it possible to send a malicious update that vulnerable devices will automatically install. The researcher, who works for security firm ForAllSecure, also found that it was trivial for attackers with moderate experience to bypass digital-signature checks that verify a downloaded update as the legitimate one offered by OpenWTR maintainers. Security researcher Guido Vranken, however, recently found that updates and installation files were delivered over unencrypted HTTPs connections, which are open to attacks that allow adversaries to completely replace legitimate updates with malicious ones. Users generally find OpenWRT to be a more secure choice because it offers advanced functions and its source code is easy to audit. Besides routers, OpenWRT runs on smartphones, pocket computers and even laptops and desktop PCs.
OpenWRT has a loyal base of users who use the freely available package as an alternative to the firmware that comes installed on their devices. For almost three years, OpenWRT-the open source operating system that powers home routers and other types of embedded systems-has been vulnerable to remote code-execution attacks because updates were delivered over an unencrypted channel and digital signature verifications are easy to bypass, a researcher said.
0 kommentar(er)
