As companies continue to beat the Internet of Things drum, promoting a world when every device is smart, and anything electronic is network connected, we have some news that shows just what a horrible idea this really is. A security firm has found that a Linux kernel driver called NetUSB contains an amateurish error that can be exploited by hackers to remotely compromise any device running the driver. The driver is commonly found in home routers, and while some offer the ability to disable it, others do not appear to do so.
NetUSB is developed by Taiwanese company KCodes. The purpose of the driver is to allow PCs and Macs to connect to USB devices over a network, so that these devices can be shared just by plugging them into a Wi-Fi router or similar. To do this, a driver is needed at each end; a client driver on the PC or Mac, and a server driver on the router itself.
This router-side driver listens to connections on TCP port 20005, and it's this driver that contains a major security flaw. SEC Consult Vulnerability Lab, which publicized the problem, discovered that the Linux driver contains a simple buffer overflow. As part of the communication between client and server, the client sends the name of the client computer; if this name is longer than 64 bytes, the buffer overflows. The company says that this overflow can be exploited to enable both denial of service (crashing the router) and remote code execution.
In its write up of the bug, the researchers described the issue as something of a throwback, writing "the '90s are calling and want their vulns back, stack buffer overflow." Simple stack buffer overflows in widely deployed software are these days relatively unusual, as developers have become somewhat more conscientious of the danger they represent. But clearly not every developer has gotten the message yet.
SEC examined firmware for many SOHO routers, finding the flawed code in products from D-Link, Netgear, TP-Link, Trendnet, and ZyXEL. Ninety-two different products, including many current generation models, were found to include the bad code (a full list is available in the advisory. A further 21 other vendors also appear to ship NetUSB products; SEC did not check those vendors' firmwares, so the dangerous driver is likely to be found in more than just those 92 devices. SEC estimates that millions of devices are affected.
Exposure will vary from device to device, as not all routers will necessarily have the bad driver loaded and running. But many do. Worse, they may have no good way of disabling it; Netgear told SEC that even with NetUSB functionality disabled through the router's configuration UI, the driver is still loaded, and there is no ability either to disable it or to block access to port 20005 in the firewall.
TP-LINK intends to issue firmware updates for most of its affected devices by the end of the month. The response from other vendors appears to be less satisfactory, with no clear timeline for issuing fixes, nor even a commitment to fix the flaw (or create a way to disable the problem driver).
Will Internet of Things devices fare any better than routers? We're not going to hold our breath. It's almost certainly going to suffer the same propensity for sharing code and inadequate upgrade process. The result is unlikely to please anyone other than hackers.
reader comments
82