STE WILLIAMS

PARIS ─ Dell Technology Camp 2013 ─ Oct. 23, 2013 – Dell today announced the release of four products that tackle today’s biggest IT imperatives ─ including BYOD, cloud, network security, and compliance ─ and make Connected Security a reality for customers worldwide. Dell’s holistic and connected approach, which spans from endpoint to datacenter to cloud, helps solve today’s most complex security and compliance problems.

As part of Dell’s Connected Security portfolio, Delltrade One Identity Cloud Access Manager, Delltrade SonicWALL NSA 2600 next generation firewall, Delltrade ChangeAuditor 6.0, and Delltrade InTrusttrade 10.7 all provide new levels of protection, and empower organizations to collectively gather, analyze, report and act in a proactive way when managing security threats.

The major trends impacting IT today make it crucial for organizations to move away from managing security in silos, and embrace a strategy focused on connecting security to the infrastructure, information and applications that are critical to the organization. To protect data wherever it resides ─ on the network, in the cloud, or on mobile devices ─ Dell delivers Connected Security through solutions that provide predictive, context-aware security to detect and protect against unseen threats, as well as managed security service offerings with SecureWorks and Dell Data Protection and Encryption.

News Facts:

One Identity Cloud Access Manager offers web-based access control to help organizations safely and effectively use both on-premise and cloud-based applications.

Addresses the need to control access to cloud apps and other apps from multiple end points ─ including office desktops, laptops, and mobile devices ─ that expose organizations to major security vulnerabilities

Provides an increased layer of security with access management for both on-premise applications and web-based applications like Salesforce, Google Apps and office 365

Enables Connected Security by delivering browser-based access through a unified and secure single sign-on, with just-in-time cloud provisioning, federation, authorization, and audit capabilities for all use situations

The Dell SonicWALL Network Security Appliance (NSA) 2600 features Dell’s patented single-pass Reassembly-Free Deep Packet Inspection engine, and leverages the power of more than one million connected sensors around the world, so organizations can block the newest threats as they emerge.

Includes critical security capabilities such as intrusion prevention with sophisticated anti-evasion technology; network-based anti-malware with cloud assist CloudAV security; Dell SonicWALL’s Global Response Intelligent Defense (GRID) Network, which gathers input from millions of sensors to provide connected security against today’s increasingly connected threats; SSL decryption and inspection; content/URL filtering; application visibility; application control; and application bandwidth management

Delivers secure mobile access from a wide variety of platforms including Windows, Linux, MacOS, iOS, Windows 8.1 RT, and Android, enabling organizations to provide multilayered security and access control rules as part of a multilayered BYOD strategy

Ensures that customers always receive the necessary security without compromising network performance. The NSA 2600 gives organizations the power to solve their security and compliance challenges today, while helping them better prepare for tomorrow

In addition to world-class threat protection, the NSA 2600 offers a wealth of standard features vital to SMBs, site-to-site VPN, WAN failover and load balancing, and an integrated wireless controller for secure wireless networking, all while remaining easy to deploy and manage

ChangeAuditor 6.0 tracks, reports and alerts on vital configuration, user and administrative changes in real-time, without the overhead of native auditing.

Enables the viewing, correlation and filtering of change events, and provides the relation to other events over the course of time and in chronological order across the Windows environment. This affords a better understanding and forensic analysis of those events and trends

Eliminates unknown security concerns and ensures continuous auditing of critical assets by providing detailed and normalized information on a change, and any related events, in only one click

Delivers on the promise of Connected Security by detecting threats and patterns, enabling a rapid response from any device in real time

InTrusttrade 10.7 helps organizations address regulatory compliance and internal security through the secure real-time collection, compression and search of event logs.

Monitors user access to critical systems and applications, and enables forensic analysis of user and system activity based on historical event data

Collects events on user and administrator activity from diverse and widely dispersed systems and applications, and presents them in an easy-to-use and complete form suitable for reporting and analysis

Enriches the Dell SecureWorks offering with intelligent data feeds that capture crucial aspects of user activity on Windows systems, detecting internal threats in less time and with less overhead

Supports Connected Security that’s unified with the business by eliminating silos of information, connecting security information across data, user, network, applications, and services

Pricing and Availability:

Call for pricing on One Identity Cloud Access Manager, Dell SonicWALL NSA2600, ChangeAuditor 6.0, and InTrust 10.7.

All four Dell solutions are available globally through the channel. Call Dell or a channel partner for more information.

Quotes:

Matt Medeiros, vice president and general manager, Security Products, Dell Software

“Today’s mega-trends ─ cloud, BYOD/mobility, and big data ─ each introduce a magnitude of new threats and vulnerabilities. The new challenges these threats create for the IT environment ─ insufficient visibility, siloed security, compliance requirements and new reporting ─ all must be managed with limited resources. The only true line of defense is a comprehensive set of predictive, context-aware security solutions that break down silos and protect data where it resides. Dell Connected Security provides a dynamic solution portfolio that gives organizations the power to solve today’s biggest security and compliance challenges, while helping them better prepare for tomorrow.”

John McClurg, vice president and chief security officer, Dell

“In an age of increasing risk, the security industry is facing the need to dramatically change its approach to protecting organizations of all sizes across all industries, at all times. Dell is at the forefront of this shift. Our vision for Connected Security ─ a holistic and connected approach to security that spans from endpoint to datacenter to cloud ─ is the driving force behind these collaborative, performance-focused security solutions. The new solutions announced today further expand our Connected Security portfolio, providing CSOs like myself with the business intelligence, contextual richness and tools we need to mitigate risks and become business enablers.”

Mike Johnson, president and CEO, Cerdant

“We view Dell’s focus on security and its drive to deliver a comprehensive portfolio around its Connected Security strategy as an exciting development for channel partners like us. We are seeing great revenue potential in helping customers leverage Dell’s industry-leading end-to-end security solutions to tackle their most critical security issues and we look forward to continuing to build our arsenal of security solutions using Dell’s best-of-breed software products.”

Supporting Resources:

Dell Connected Security: www.dell.com/security

Twitter: www.twitter.com/dellsecurity

Facebook: https://www.facebook.com/DellHomeUS?brand_redir=1

LinkedIn: http://www.linkedin.com/company/dell

Dell YouTube: http://www.youtube.com/user/DellVlog

Dell Google+: https://plus.google.com/+Dell#+Dell/posts

About Dell

Dell Inc. (NASDAQ: DELL) listens to customers and delivers innovative technology and services that give them the power to do more. For more information, visit www.dell.com and http://software.dell.com

Join us at Dell World 2013, Dell’s premier customer event exploring how technology solutions and services are driving business innovation. Learn more at www.dellworld.com and follow #DellWorld on Twitter.

Article source: http://www.darkreading.com/perimeter/dell-rolls-out-new-security-products/240163235

London, United Kingdom – 28 October 2013 – Goode Intelligence (www.goodeintelligence.com), the leading research, analysis and consultancy organisation for the mobile security industry, today issued a new market forecast report revealing that the market for mobile biometric security products and services is set to grow significantly over the next six years.

Goode Intelligence reports that as a result of the combination of Apple’s positive move with Touch ID and the creation of a strong ecosystem to support biometrics on consumer mobile devices, by 2018, 3.4 billion users will be using biometrics on their mobile devices, generating almost US$8.3 billion worth of revenue for the biometrics industry.

The report details that fingerprint sensors will become standard in most high-end smart mobile devices by 2015 and become common in all mobile devices shipped during 2018.

The report, Mobile Biometric Security – Market Forecast Report 2013 – 2018, shows that the key drivers behind this market growth and the adoption of mobile biometric security include:

The Consumerisation of Biometrics: Apple has changed everything and has again disrupted a market and rebranded biometrics as a convenient method of communicating with consumer technology. Previously, Biometrics has largely been associated with high-end security; border control, national ID solutions and for providing access control for high-security buildings. This has all changed with the Apple iPhone 5s and Touch ID

Convenient mobile device protection: Existing mobile device authentication is cumbersome and inconvenient. This means that many devices are left with no protection. Replacing a PIN or Passcode with an easy-to-use biometric can reduce this burden

Mobile Commerce: Mobile devices have become the prime method of carrying out digital commerce yet identity verification and payment authorisation has not yet been updated to match this form factor. Biometrics can offer a convenient and secure method to prove identity and to authorise payments

As part of a multi-factor authentication solution: Most of the major authentication vendors support, or have plans to support, biometrics in their authentication products. This will be supported by authentication standards initiatives such as the FIDO Alliance that will enable biometrics to be easily utilised, when available, on mobile devices

Mobile devices are getting more secure: Apple’s Touch ID fingerprint solution makes use of a ‘secure vault’ to ensure that the fingerprint templates are stored in a secure area of the hardware. It is thought that Apple is leveraging ARM’s TrustZone, a hardware-security environment for secure storage and trusted execution. Security services are being built into all mobile platforms to counteract malware and to protect sensitive information and transactions. Complimentary services such as Mobile Device Management (MDM), Secure Containers and Mobile Application Management (MAM) create a trusted platform to support biometric security on consumer mobile devices

“Biometrics on mobile devices is not a new concept; the first commercial device to embed a fingerprint sensor was launched back in 1999. What we have now, and what has changed in the last 18 months, is a much more favourable environment in which biometrics on mobile devices will flourish” said Alan Goode, author of the report and founder of Goode Intelligence.

“Apple’s decision to launch its latest flagship iPhone, the iPhone 5S with an embedded touch fingerprint sensor, was a pivotal moment for the biometrics industry and will accelerate the Consumerisation of Biometrics trend.

“We believe that there will be a rush by consumer smart mobile device (SMD) manufacturers to emulate Apple by embedding and integrating biometrics technology into their next generation devices – not just fingerprint sensors but other biometric technology as well.

“This will become even more important in the post-smartphone world when wearable technology and smart cars/houses/cities will offer us a much more personal computing experience – in this world biometrics may well hold the key for identity and user interaction.”

Further information about the Mobile Biometric Security Market Forecasts can be found at www.goodeintelligence.com

About Goode Intelligence

Goode Intelligence is the leading research, analysis and consultancy organisation for the mobile security industry; providing services to global technology and telecommunications organisations. For more information about Goode Intelligence please visit www.goodeintelligence.com

Article source: http://www.darkreading.com/mobile/mobile-biometric-security-products-and-s/240163229

Download Dark Reading‘s November special issue

As companies add more cloud services to their IT environments, the process of managing identities is getting more complex.

When companies use cloud services — services they don’t control themselves — they still must develop sound policies around role-based access. They still must grant rights to users who need information to get work done. And they must be able to automatically take away those privileges when people leave a company or change roles. On top of it all, companies using cloud services are also bound by any compliance rules that govern their identity and access management (IAM) initiatives.

With the collection of cloud services now holding sensitive data, organizations have to contend with a smorgasbord of new login systems and proprietary connector APIs that often don’t work well with internal IAM systems. “I bet that not many IT professionals thought they would look nostalgically at large, complex, on-premises deployments, but now many do,” says Julian Lovelock, VP of product marketing for identity assurance at smart card manufacturer HID Global.

Managing cloud IAM means “using a complex set of one-off procedures,” says Nishant Kaushik, chief architect for cloud IAM provider Identropy. This approach may lead to “chaos and an inability to audit any of the systems.”

But sound identity management and governance is core to nearly all IT security functions. That’s why security experts are advocating that companies improve how they manage identities in environments that mix cloud services and enterprise networks. “In this new world, you have to stitch the identities together,” says Todd McKinnon, CEO of cloud IAM provider Okta.

Building Policies

Ask any enterprise IT administrator if his or her organization has a process for managing new software deployments, and the answer is invariably yes. You’ll also likely get all hands raised if you ask about password management and user account management controls, says Greg Brown, VP and CTO of cloud and data center solutions for McAfee. But there aren’t nearly as many raised hands when you ask how many have a procedure for someone to buy infrastructure-as-a-service, or for on-boarding users in a new software-as-a-service (SaaS) application, he says.

Two of the most fundamental policies of IT are which software can be used and how the credentials to use them should be administered, says Brown. These policies govern which applications, devices and people have access to which pools of sensitive information. Companies have these policies largely in place for on-premises systems, but they often do not know which users are leveraging SaaS — and whether they’re compliant with corporate and regulatory policies.

The need for security and compliance is driving some companies to find better ways to bridge enterprise IAM and cloud provider applications, often by provisioning user identity through cloud-capable, federated single sign-on (SSO). “In a bridge, the enterprise maintains control of its own identities and its own authentication,” says Allan Foster, VP of technology and standards for ForgeRock, an open platform provider of IAM systems. “And since the service transaction is initiated by the enterprise, it can maintain auditing as to who accessed the service and when, although not about what was done.”

Many companies are achieving this bridge through Active Directory (AD) and Lightweight Directory Access Protocol connections, setting policies that can be enforced through group membership based on the users. Enterprises have been pressuring cloud providers to embrace standards including SAML, OAuth and OpenID for easier exchange of authentication information between the cloud provider and the enterprise.

An employee using a federated single sign-on system is given one set of credentials to access multiple cloud accounts. This user is only authorized to use those cloud accounts permitted by the group he or she belongs to. For example, if a user is in the sales group in Active Directory, he or she would be given secure access to Salesforce.com as well as the enterprise’s in-house sales applications. This approach aids the rapid rollout of new cloud services to large groups of users. Even more importantly, using AD to aggregate identities in cloud environments speeds up the deprovisioning of cloud applications to employees when they leave the company or change roles.

“Enforcing the use of federated SSO — and not using passwords with cloud apps — means that users can only log in to cloud apps if they have an account in AD,” says Patrick Harding, CTO of cloud IAM company Ping Identity. “Terminated users are usually immediately disabled in AD by IT and will not be able to access any cloud apps.”

This type of single sign-on provides more control over the cloud sign-in process, but it’s only at the first stage of maturity for efficiently getting people onto the system. This initial operational focus mirrors the maturation that happened with on-premises IAM years ago, says Kaushik. “Once the cloud operational things are solved, people realize they have governance problems and compliance problems,” Kaushik says. “It isn’t simply about being able to create accounts. It’s also how to create an account, when to create an account and how to deprovision an account.”

As companies get accustomed to cloud single sign-on, they often find that cloud identity services lack fine-tuning for authorizing and monitoring a user’s access to cloud resources.

Article source: http://www.darkreading.com/management/identity-management-in-the-cloud/240163175

The official NSA website NSA.gov was offline for several hours on Friday, prompting immediate wild speculation that it had been taken down by a DDoS campaign.

But the NSA itself eventually squashed the rumours, announcing officially that the issue was “an internal error that occurred during a scheduled update”.

The site was apparently down for up to six hours on Friday afternoon and evening, indicating either a pretty serious error or some rather sluggish efforts at restoring normality.

The NSA has been increasingly beleaguered of late, with the ever-mushrooming Snowden leaks heaping embarrassment upon embarrassment.

With growing public distrust and distaste for the agency, it was inevitable that many would assume the outage was down to some sort of revenge attack by the internet community.

The incident also coincided nicely with a major rally in Washington D.C. over the weekend to protest against the NSA’s snooping activities.

But of course, as the satirical science and technology cartoon XKCD pointed out in 2012, a public-facing website may be an easy target, but it’s not really a particularly vital asset to a top-secret government agency.

It’s unlikely that any of the NSA’s spies were uploading deviously-obtained data to the site and ended up blocked from reporting Angela Merkel’s latest text messages back to base.

On the other hand, the accidental outage seems to run counter to recent impressions that the NSA is overloaded with super-elite computer geniuses who can do just about anything, including breaking the most advanced cryptography.

At least, if those people are there, they’re not working on the public website.

It also serves as a reminder that while updates are of course important, they should always be properly tested before being implemented in live environments, and proper known-working backups should always be available to fall back on in case of disaster.

Follow @VirusBtn
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Ke-IY0OfBUM/

A Florida man has been sentenced to two years in federal prison for defrauding student aid accounts, while his two fellow-conspirators have been given probation and community sentences.

The group’s techniques should serve as a reminder that it’s not just the information stored on our computers that we need to keep secure.

Christopher J. Wright of Fort Lauderdale in Florida was a student at Florida Agricultural and Mechanical University (FAMU) when he and two other Florida men hijacked financial aid accounts of a number of fellow-students, redirecting funds due to them into accounts controlled by the trio.

Wright was sentenced last week to two years prison time, and the two men who joined him in his frauds, Carl Coutard and Carliss Pereira, pleaded guilty earlier this year and have been given “home detention” and “community confinement” sentences, plus community service and restitution payments.

Most but not all of the money they defrauded has been retrieved by reversing transfers.

At the time of the initial indictments in the case, the offenses covered were said to carry sentences of up to ten years in some cases and five years in others, so it may seem that the three men have got off lightly, particularly those serving no actual jail time.

But the US Attorney announcing the sentences insisted that they send ” a clear message that engaging in this type of criminal conduct will have serious consequences, including the real possibility of a felony conviction and a prison term”.

Perhaps the most interesting feature of the case from a security viewpoint is how the three men went about gathering the information they needed to defraud their victims.

As well as using the standard techniques of social engineering, “tricking FAMU employees and the students themselves into providing this information”, and researching their victims on the internet for useful PII, they also found data “by taking paperwork discarded in the trash bins near the FAMU computer help desk”.

This should remind us of the importance of hard-copy data as well as the vast swathes of digital information on all of us swirling around the internet.

In the age of NSA snooping anxiety, the focus of our privacy worries has been very much on protecting our online data and communications, but it’s important not to forget the potential value of old-school “dumpster diving” techniques.

Printed material we throw away can be very useful to identity thieves. Those pre-filled-in credit card application forms the banks seem to so enjoy sending out may be an obvious danger, but there are subtler indicators too, with data such as dates of birth and travel plans often easily deduced from discarded material.

Printing things out at work or college is especially dangerous, as we tend to feel safer among our peers and so are perhaps less wary of leaving bank statements or half-filled application forms lying around for prying eyes to see.

So be careful with your personal information in the real world, not just in the digital one – for example, I tear addresses off junk mail before it goes into the recycling, and I put anything at all personally identifiable straight onto the fire-lighting pile to be burned ASAP.

If you’re not lucky enough to have a nice fireplace to keep you toasty and safely destroy documents, maybe invest in a good-quality shredder and use it on anything at all sensitive.

And if you’re running a business, hospital, university or other institution handling sensitive internal or third-party data, consider a shred-by-default policy, and discourage your people from printing out anything that doesn’t really need to be committed to paper.

Follow @VirusBtn
Follow @NakedSecurity

Image of hands holding prison bars courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/DTsmrlPyPpY/

News, opinion, advice and research: here’s our latest quarter-hour security podcast, featuring Chet and Duck (Chester Wisniewski and Paul Ducklin) with their informative and entertaining take on the latest security news.

You may have noticed that it’s only a week since the latest full Chet Chat.

That’s not a mistake – by popular request, we’re going back to a weekly format, so your favourite security pocast will now come out twice as often as before!

By the way, you can keep up with all our podcasts via RSS or iTunes, and catch up on previous Chet Chats by browsing our podcast archive.

Listen to this episode

Play now:

(28 October 2013, duration 13’27”, size 8.1MB)

Download for later:

Sophos Security Chet Chat #121 (MP3)

Stories covered in Chet Chat #120

• WordPress 3.7 with automatic security updating is out now
• OS X Mavericks – optional OS upgrade or critical security fix?
• Apple’s iCloud iConundrum – does convenience mean insecurity?
• Is your smartphone broadcasting your movements when you shop?
• Doctors disabled wireless in Dick Cheney’s pacemaker to thwart hacking

Previous episodes

Don’t forget: for a regular Chet Chat fix, follow us via RSS or on iTunes.

Follow @NakedSecurity

Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/8FIbFhARpc0/

Supercharge your infrastructure

IBM has issued a warning to owners of its Storwize arrays, SAN Volume Controller and Flex System V7000, because all are at risk of having their contents erased.

Big Blue’s warning about the problem is blunt: “Administrative access to the system via the IP interface may be obtained without authentication.”

That’s bad news because “The vulnerabilities can be exploited by a user with access to the system’s management IP interface using vulnerabilities in the Apache Struts component. If successful, the user can gain access with superuser privilege which will allow any modification to the configuration, including complete deletion.”

The fix sounds simple: upgrade Storwize appliances to version 7.1.0.5 of their operating system. We’ve qualified that statement with “sounds” because version 7.1.0.5 was released at the beginning of October. Plenty of storage administrators may have had good reason not to make the upgrade.

One piece of silver lining: IBM notes that the web interface is likely not exposed to the internet. That means an insider is the most likely threat, yet another reason for storage admins to keep those pesky network admins away from their beloved boxen. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/28/ibm_storwize_arrays_at_risk_of_complete_deletion/

Supercharge your infrastructure

IBM has issued a warning to owners of its Storwize arrays, SAN Volume Controller and Flex System V7000, because all are at risk of having their contents erased.

Big Blue’s warning about the problem is blunt: “Administrative access to the system via the IP interface may be obtained without authentication.”

That’s bad news because “The vulnerabilities can be exploited by a user with access to the system’s management IP interface using vulnerabilities in the Apache Struts component. If successful, the user can gain access with superuser privilege which will allow any modification to the configuration, including complete deletion.”

The fix sounds simple: upgrade Storwize appliances to version 7.1.0.5 of their operating system. We’ve qualified that statement with “sounds” because version 7.1.0.5 was released at the beginning of October. Plenty of storage administrators may have had good reason not to make the upgrade.

One piece of silver lining: IBM notes that the web interface is likely not exposed to the internet. That means an insider is the most likely threat, yet another reason for storage admins to keep those pesky network admins away from their beloved boxen. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/28/ibm_storwize_arrays_at_risk_of_complete_deletion/

Supercharge your infrastructure

Chinese networking manufacturer Tenda has issued a fix that seals up a recently discovered backdoor in its wireless router kit.

Craig Heffner, the same researcher who uncovered a backdoor in routers from D-Link, uncovered more secret functionality that ships with Tenda’s products.

Heffner discovered the flaw after unpacking firmware updates for Tenda’s networking kit and locating suspicious code.

Attackers could take over the router and execute commands simply by sending a UDP packet with a special string, as explained in a detailed advisory.

“The backdoor only listens on the LAN, thus it is not exploitable from the WAN,” Heffner explains. “However, it is exploitable over the wireless network, which has WPS enabled by default with no brute force rate limiting. My shiny new ReaverPro box made relatively short work of cracking WPS, providing access to the WLAN and a subsequent root shell on the router.’

Heffner warned that the backdoor was present on Tenda’s W302R and W330R router models as as well as re-branded models, such as the Medialink MWN-WAPR150N, because all share the same exploitable functionality (specifically a “w302r_mfg” magic packet string in a modified GoAhead webserver) that ships with the products.

Attackers could gain unauthenticated access to the routers’ administrative interfaces through its built-in web server on all affected models, provided they had first managed to hop onto the same network as their intended victim.

Target Components, which distributes Tenda’s products in the UK, acknowledged the problem while crediting Tenda for developing a fix in just two days.

The company had released a software update that closes the backdoor on the three affected models. Target added that, contrary to fears expressed by other security researchers in they wake of Heffner’s discovery, the backdoor problem was restricted to three models of Tenda-manufactured kit.

In a statement, Tenda apologised to its customers and said: “We promise that no other lines of Tenda have the same bugs after all lines were detected systematically by our engineers.”

Tenda’s notice (in less-than-perfect but broadly understandable English, key extract below) also plays down the significance of the whole security flap.

It was also verified by our engineers that the bug will not make your network system be visited via internet by strangers, so we can promise that there is no big security problem occurred. However, we would suggest that all the SME users who use those two lines upgrade them immediately just in case of further security problems.

The relevant security patches can be found via links within Tenda’s advisory here.

We passed on Tenda’s advisory to Heffner but are yet to hear from him. Thus there’s no confirmation that the fix released by Tenda actually does what it says on the tin.

Earlier this month Heffner discovered a similar backdoor on a range of router kit from D-Link. In response, D-Link promised to close its routers’ backdoors by Halloween (31 October).

Pending the availability of a fix, users of the vulnerable kit are advised to disable remote access to their routers and make sure their wireless networks are secure. ®

ioControl – hybrid storage performance leadership

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/28/tenda_bricksup_router_backdoor/

Supercharge your infrastructure

Chinese networking manufacturer Tenda has issued a fix that seals up a recently discovered backdoor in its wireless router kit.

Craig Heffner, the same researcher who uncovered a backdoor in routers from D-Link, uncovered more secret functionality that ships with Tenda’s products.

Heffner discovered the flaw after unpacking firmware updates for Tenda’s networking kit and locating suspicious code.

Attackers could take over the router and execute commands simply by sending a UDP packet with a special string, as explained in a detailed advisory.

“The backdoor only listens on the LAN, thus it is not exploitable from the WAN,” Heffner explains. “However, it is exploitable over the wireless network, which has WPS enabled by default with no brute force rate limiting. My shiny new ReaverPro box made relatively short work of cracking WPS, providing access to the WLAN and a subsequent root shell on the router.’

Heffner warned that the backdoor was present on Tenda’s W302R and W330R router models as as well as re-branded models, such as the Medialink MWN-WAPR150N, because all share the same exploitable functionality (specifically a “w302r_mfg” magic packet string in a modified GoAhead webserver) that ships with the products.

Attackers could gain unauthenticated access to the routers’ administrative interfaces through its built-in web server on all affected models, provided they had first managed to hop onto the same network as their intended victim.

Target Components, which distributes Tenda’s products in the UK, acknowledged the problem while crediting Tenda for developing a fix in just two days.

The company had released a software update that closes the backdoor on the three affected models. Target added that, contrary to fears expressed by other security researchers in they wake of Heffner’s discovery, the backdoor problem was restricted to three models of Tenda-manufactured kit.

In a statement, Tenda apologised to its customers and said: “We promise that no other lines of Tenda have the same bugs after all lines were detected systematically by our engineers.”

Tenda’s notice (in less-than-perfect but broadly understandable English, key extract below) also plays down the significance of the whole security flap.

It was also verified by our engineers that the bug will not make your network system be visited via internet by strangers, so we can promise that there is no big security problem occurred. However, we would suggest that all the SME users who use those two lines upgrade them immediately just in case of further security problems.

The relevant security patches can be found via links within Tenda’s advisory here.

We passed on Tenda’s advisory to Heffner but are yet to hear from him. Thus there’s no confirmation that the fix released by Tenda actually does what it says on the tin.

Earlier this month Heffner discovered a similar backdoor on a range of router kit from D-Link. In response, D-Link promised to close its routers’ backdoors by Halloween (31 October).

Pending the availability of a fix, users of the vulnerable kit are advised to disable remote access to their routers and make sure their wireless networks are secure. ®

ioControl – hybrid storage performance leadership

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/28/tenda_bricksup_router_backdoor/