Nessus Plugin Spotlight: Linksys Router Detection

Embedded devices are often connected to a network with no regard given to security. The market has been saturated with devices such as web cameras, wireless routers, VoIP phones and more. Manufacturers are in a race to see who can produce the cheapest and most user-friendly device. Of course, when you make something cheap and easy to use, security is often one of the last considerations. We are left with consumer devices that come with default credentials, common web application vulnerabilities, and no encryption support on management protocols (HTTP vs. HTTPS, and Telnet vs. SSH).

The insecurity of embedded systems may not seem to be a big deal; what could someone possibly do if they compromised such a device? If the device is a router, the potential for traffic sniffing and DNS cache poisoning attacks are high. Other devices such as web cameras can be used to gather intelligence, used as jumping off points (such as printers as depicted in the book "Stealing the Network: How to Own a Continent") or even used as part of a botnet. There is one report of a botnet being built solely on embedded systems including wireless routers in particular. Vulnerable embedded systems are plentiful on the Internet, as uncovered by Columbia University researchers in October 2009 when they released vulnerability scanning data of 130 million IP addresses. Nearly 300,000 devices presented a management interface, with 21,000 of those devices using default passwords. I believe this poses a significant threat to our infrastructure and plan to talk in more detail about this topic at SOURCE Boston in April of this year. As I research embedded systems I regularly feed the Tenable research team information about my findings.

Linksys Router Detection

As part of my investigations into HNAP protocol vulnerabilities we have updated plugin id 44391 titled "Linksys Router Detection". This plugin now uses HNAP to detect the router model and firmware version of Linksys routers:

Customers can use this to scan their environments for embedded systems as part of their periodic network audits. The extra information is useful to evaluate the risk level for different devices such as determining if they are running the latest firmware.