Re: Hacker pierces hardware firewalls with web page.

Perhaps they are exploiting UPnP in some obscure way to achieve this?

Regards

Farrukh

On Tue, Jan 12, 2010 at 5:51 AM, <[email protected]> wrote:

> I've seen several other posts where people make use of browser exploits to
> trick the browser into submitting a form to the router/firewall, and if the
> router has the default password, the attacker can then configure the
> firewall any way they want.
>
> This sounds a little different. This sounds like it is exploiting standard
> protocols.
>
> With FTP the client connect to the server, then at the start of a file
> transfer the client tells the server what port to connect to on the client.
> A 'helpful' firewall will watch for this message and reconfigure itself to
> allow traffic to that port. IIRC for FTP this data connection is one-way
> (with acks flowing the other way), but with SIP the port is used for data in
> both directions.
>
> This sounds like the attacker is managing to use javascript to make a
> connection out that the firewall thinks is a protocol like this, and then by
> specifying the port they want to attack, tricking the firewall into opening
> that port up so that it can be attacked from the server the javascript
> connected to.
>
> David Lang
>
>
>
>
> On Fri, 8 Jan 2010, R. DuFresne wrote:
>
>  -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>>
>>
>> In reading this, I get the impression this is not a fault in the firewalls
>> themselves, but more an issue with the configuration of firewalls having
>> been 'tested' by this hacker.  Am I wrong in reading this news in that
>> fashion?::
>>
>>
>> January 6, The Register - (International) Hacker pierces hardware
>> firewalls with web page. On January 5, a hacker demonstrated a way to
>> identify a browser's geographical location by exploiting weaknesses in many
>> WiFi
>> routers. Now, the same hacker is back with a simple method to penetrate
>> hardware firewalls using little more than some javascript embedded in a
>> webpage. By luring victims to a malicious link, the attacker can access
>> virtually any service on their machine, even when it's behind certain
>> routers that automatically block it to the outside world. The method has
>> been tested on a Belkin N1 Vision Wireless router, and the hacker says he
>> suspects other devices are also vulnerable. "What this means is I can
>> penetrate their firewall/router and connect to the port that I specified,
>> even though the firewall should never forward that port," the hacker told
>> the Register. "This defeats that security by visiting a simple web page. No
>> authentication, XSS, user input, etc. is required." The hacker's
>> proof-ofconcept page forces the visitor to submit a hidden form on port
>> 6667, the standard port for internet relay chat. Using a hidden value, the
>> form surreptitiously coerces the victim to establish a DCC, or direct
>> client-to-client, connection. Vulnerable  routers will then automatically
>> forward DCC traffic to the victim's internal system, and using what's known
>> as NAT traversal an attacker can  access any port that's open on the local
>> system. For the hack to work, the visitor must have an application such as
>> file transfer protocol or session initiation protocol running on his
>> machine. The hack does not guarantee an attacker will be able to compromise
>> that service, but it does give the  attacker the ability to probe it in the
>> hope of finding a weak password or a vulnerability that will expose data or
>> system resources. Source:
>> http://www.theregister.co.uk/2010/01/06/web_based_firewall_attack/
>>
>>
>>
>>
>> Thanks,
>>
>>
>> Ron DuFresne
>> - -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>       admin & senior security consultant:  sysinfo.com
>>                       http://sysinfo.com
>> Key fingerprint = 9401 4B13 B918 164C 647A  E838 B2DF AFCC 94B0 6629
>>
>> These things happened. They were glorious and they changed the world...,
>> and then we fucked up the endgame.    --Charlie Wilson
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.5 (GNU/Linux)
>>
>> iD8DBQFLR3qist+vzJSwZikRAotcAJ9fHEWAOm2N5xFKww7/wA9O+YYdeACfZUEZ
>> uZciRDQsRu1kZZQUZctPwmY=
>> =KCsu
>> -----END PGP SIGNATURE-----
>> _______________________________________________
>> firewall-wizards mailing list
>> [email protected]
>> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
>>
>>  _______________________________________________
> firewall-wizards mailing list
> [email protected]
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
>

_______________________________________________
firewall-wizards mailing list
[email protected]
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards