Linksys vuln confirmed as a HNAP1 bug
The Benefits and Significance of Private Platform as a Service
The worm called “The Moon”, which began spreading between Linksys home broadband kit last week, has been confirmed as a problem with the devices’ HNAP1 implementation, and an exploit has been made public.
The exploit was posted to Exploit-db.com by user Rew, who said this Reddit discussion meant the “cat’s out of the bag”.
Possible vulnerable devices include the Linksys E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000 and E900, according to the SANS Institute, which first spotted the worm in the wild. The SANS Institute also notes that vulnerability depends on firmware revision.
Unfortunately, some of the devices in the list are no longer supported, so users can’t get new firmware (for example, as El Reg noted last week, the E1000 is on the no-longer-supported list).
HNAP – the Home Network Administration Protocol – was created by Pure Networks and acquired by Cisco, and provides admin access to HNAP-enabled kit. As the SANS Institute’s Rob VandenBrink writes here, “the irony of someone ‘in the biz’ deciding in 2007 that we need yet another clear-text network management protocol does not escape me”. ®
Evaluating the cost of a DDoS attack
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/02/17/linksys_vuln_confirmed_as_a_hnap1_bug/