Connect with us

Technology

Gear from Netgear, Linksys, and 200 others has unpatched DNS poisoning flaw

Published

on

Getty Images

Hardware and software makers are scrambling to determine if their wares suffer from a critical vulnerability recently discovered in third-party code libraries used by hundreds of vendors, including Netgear, Linksys, Axis, and the Gentoo embedded Linux distribution.

The flaw makes it possible for hackers with access to the connection between an affected device and the Internet to poison DNS requests used to translate domains to IP addresses, researchers from security firm Nozomi Networks said Monday. By feeding a vulnerable device fraudulent IP addresses repeatedly, the hackers can force end users to connect to malicious servers that pose as Google or another trusted site.

The vulnerability, which was disclosed to vendors in January and went public on Monday, resides in uClibc and uClibc fork uClibc-ng, both of which provide alternatives to the standard C library for embedded Linux. Nozomi said 200 vendors incorporate at least one of the libraries into wares that, according to the uClibc-ng maintainer, include the following:

The vulnerability and the lack of a patch underscore a problem with third-party code libraries that has gotten worse over the past decade. Many of them—even those like the OpenSSL cryptography library that are widely used to provide crucial security functions—face funding crunches that make the discovery and patching of security vulnerabilities difficult.

“Unfortunately I wasn’t able to fix the issue by myself and hope someone from the rather small community will step up,” the maintainer of uClibc-ng wrote in an open forum discussing the vulnerability. uClibc, meanwhile, hasn’t been updated since 2010, according to the downloads page for the library.

What’s DNS poisoning, anyway?

DNS poisoning and its DNS cache-poisoning relative allow hackers to replace the legitimate DNS lookup for a site such as google.com or arstechnica.com—normally 209.148.113.38 and 18.117.54.175, respectively—with malicious IP addresses that can masquerade as those sites as they attempt to install malware, phish passwords, or carry out other nefarious actions.

First discovered in 2008 by researcher Dan Kaminsky, DNS poisoning requires a hacker to first masquerade as an authoritative DNS server and then use it to flood a DNS resolver inside an ISP or device with fake lookup results for a trusted domain. When the fraudulent IP address arrives before the legitimate one, end users automatically connect to the imposter site. The hack worked because the unique transaction assigned to each lookup was predictable enough that attackers could include it in fake responses.

Internet architects fixed the problem by changing the source port number used each time an end user looks up the IP number of a domain. Whereas before, lookups and responses traveled only over port 53, the new system randomized the port number that lookup requests use. For a DNS resolver to accept a returned IP address, the response must include that same port number. Combined with a unique transaction number, the entropy was measured in the billions, making it mathematically infeasible for attackers to land on the correct combination.

The vulnerability in uClibc and uClibc-ng stems from the predictability of the transaction number the libraries assign to a lookup and their static use of source port 53. As Nozomi researchers Giannis Tsaraias and Andrea Palanca wrote:

Given that the transaction ID is now predictable, to exploit the vulnerability an attacker would need to craft a DNS response that contains the correct source port, as well as win the race against the legitimate DNS response incoming from the DNS server. Exploitability of the issue depends exactly on these factors. As the function does not apply any explicit source port randomization, it is likely that the issue can easily be exploited in a reliable way if the operating system is configured to use a fixed or predictable source port.

Nozomi said it wasn’t listing the specific vendors, device models, or software versions that are affected to prevent hackers from exploiting the vulnerability in the wild. “We can, however, disclose that they were a range of well-known IoT devices running the latest firmware versions with a high chance of them being deployed throughout all critical infrastructure,” the researchers wrote.

On Monday, Netgear issued an advisory saying the company is aware of the library vulnerabilities and is assessing whether any of its products are affected.

“All Netgear products use source port randomization and we are not currently aware of any specific exploit that could be used against the affected products,” the device maker said. Representatives from Linksys and Axis didn’t immediately respond to emails asking if their devices are vulnerable.

Without more details, it’s hard to provide security guidance for avoiding this threat. People using a potentially affected device should monitor vendor advisories for updates over the next week or two.

This Article was first live here.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published.

Technology

Broadcom is in ongoing talks to acquire VMware, but a deal is not imminent (Greg Roumeliotis/Reuters)

Published

on


Sources: Broadcom is in ongoing talks to acquire VMware, but a deal is not imminent  —  Chipmaker Broadcom Inc (AVGO.O) is in talks to acquire cloud service provider VMware Inc (VMW.N), people familiar with the matter told Reuters.  —  Negotiations between Broadcom and VMware are ongoing and a deal is not imminent, the sources said.

This Article was first live here.

Continue Reading

Technology

How to watch AMD, Nvidia, and Microsoft’s Computex 2022 keynotes

Published

on

Computex is just hours away and will feature keynotes from some of the biggest names in tech, including AMD, Nvidia, and Microsoft. There will almost certainly be some exciting announcements from each brand, but since Computex takes place in Taipei, Taiwan, the keynotes don’t occur at the most convenient times (at least for those of us in North America).

Microsoft and AMD’s keynotes will have you staying up into the wee hours of the morning tonight, while Nvidia’s keynote doesn’t take place until late tomorrow evening. Here’s how and when to tune into each keynote:

How to watch AMD’s keynote

AMD CEO Lisa Su is set to speak in a keynote titled “AMD Advancing the High-Performance Computing Experience,” which is set to highlight AMD’s latest innovations in laptop and desktop performance. The chip company is rumored to reveal Ryzen 7000 series desktop CPUs that use the new Zen 4 core architecture, as well as its X670E, X670, and B650 motherboards that support the next-gen AM5 platform.

You can watch the keynote on YouTube when it goes live early tomorrow morning on Monday, May 23rd at 2AM ET, 11PM PT, or 2PM local time in Taipei. If you’re unsure what time that is for where you live, you can check out this handy time conversion chart AMD posted to Twitter.

How to watch Nvidia’s keynote

Nvidia’s keynote will feature six different speakers, including Ian Buck, the company’s vice president of accelerated computing; Jeff Fisher, the senior vice president of GeForce; and Michael Kagan, the CTO of Nvidia. The keynote is set to cover a range of topics, such as accelerated computing, gaming, content creation, and data center solutions.

You can watch the keynote from Nvidia’s YouTube livestream tomorrow night, May 23rd at 11PM ET / 8PM PT, or 11AM on local Taipei time.

How to watch Microsoft’s keynote

Microsoft’s keynote includes a talk from Panos Panay, the chief product officer behind Windows and Microsoft Surface devices, as well as Nicole Dezen, Microsoft’s corporate vice president. The keynote is simply titled “A Conversation About Windows 11 with Panos Panay and Nicole Dezen.”

You can watch the 30-minute keynote from YouTube early tomorrow morning on May 23rd at 3:30AM ET / 12:30AM PT, or 3:30PM local time in Taipei.

This Article was first live here.

Continue Reading

Technology

Paytm, whose share price has dropped 57% so far this year, reports Q4 revenue of ~$200M, up 89% YoY, and a net loss of ~$98M, up 72% YoY due to higher expenses (Reuters)

Published

on


Reuters:

Paytm, whose share price has dropped 57% so far this year, reports Q4 revenue of ~$200M, up 89% YoY, and a net loss of ~$98M, up 72% YoY due to higher expenses  —  India’s One 97 Communications Ltd (PAYT.NS), the parent of fintech firm Paytm, on Friday reported a wider fourth-quarter loss due …

This Article was first live here.

Continue Reading

Trending