SoylentNews

Over 21,000 Linksys Routers Leaked Their Device Connection Histories

posted by Fnord666 on Monday May 20 2019, @10:51AM   
from the talktative-devices dept.

upstart writes:

Submitted via IRC for AnonymousLuser

Over 21,000 Linksys routers leaked their device connection histories

Over 21,000 Linksys routers leaked their device connection historiesLinksys, however, says it can't replicate the apparent flaw.Sponsored Links

Certain Linksys WiFi routers might be sharing far more data than their users would like. Security researcher Troy Mursch has reported that 33 models, including some Max-Stream and Velop routers, are exposing their entire device connection histories (including MAC addresses, device names and OS versions) online. They also share whether or not their default passwords have changed. Scans have shown between 21,401 and 25,617 vulnerable routers online, 4,000 of which were still using their default passwords.

The attack appear to be relatively straightforward and involves little more than visiting an exposed router's internet address and running a device list request. It works whether or not the router's firewall is turned on, Mursch toldArs Technica, and isn't affected by a patch Linksys released in 2014.

There are potentially serious consequences. Complete connection histories could tell hackers if there are juicy targets on a given network, such as a phone running outdated software, while stalkers might find out if their victim had visited a given location. The password status, meanwhile, could make it easy to hijack devices for the sake of botnets and other online crimes.

---

Original Submission

• Not much of a firewall then. Not much of a firewall then. (Score: 5, Insightful) by SomeGuy on Monday May 20 2019, @12:51PM (1 child)

  by SomeGuy (5632) on Monday May 20 2019, @12:51PM (#845494)

  How the virtual fuck does a router return ANY kind of information remotely over the internet if its firewall is on? That would indicate something horribly wrong with the firewall software or its configuration.

  Starting Score:	1		point
  Moderation		+3
  Insightful=3, Total=3
  Extra 'Insightful' Modifier		0
  Karma-Bonus Modifier		+1
  Total Score:		5

• Re:Not much of a firewall then. (Score: 4, Interesting) by digitalaudiorock on Monday May 20 2019, @01:18PM

  by digitalaudiorock (688) on Monday May 20 2019, @01:18PM (#845497) Journal

  Yea...pretty inexcusable. The last time I needed to replace my router I went for a Linksys WRT1900ACS and installed dd-wrt on it. I've been really happy with that. At least, unlike the factory firmware that might offer updates for a few years, there are always new dd-wrt versions getting built. My only gripe was with the router itself that apparently at some point went to a fanless design that just wasn't sufficient. I had to add a USB powered fan sitting on top of the router to maintain safe temperatures.

  Parent