Researchers scanning the internet for vulnerable embedded devices have found nearly 21,000 routers, webcams and VoIP products open to remote attack. Their administrative interfaces are viewable from anywhere on the internet and their owners have failed to change the manufacturer's default password.
Linksys routers had the highest percent of vulnerable devices found in the United States -- 45 percent of 2,729 routers that were publicly accessible still had a default password in place. Polycom VoIP units came in second, with default passwords lingering on about 29 percent of 585 devices accessible over the internet.
"You can reflash the firmware or install any software you wish on vulnerable devices," said Salvatore Stolfo, a Columbia University computer science professor who is overseeing the research project aimed at uncovering vulnerable appliances on the internet. "These devices will be owned and used by bot herders and other miscreants."
Hackers can use vulnerable routers to conduct click fraud or DNS cache poisoning attacks or to launch attacks on other systems. (See our recent Threat Level story about vulnerable routers used by Time Warner customers.) Someone with remote access to the administrative interface of a VoIP system would also be able to install firmware to record conversations.
The research project, devised by Columbia University grad student Ang Cui at the university's Intrusion Detection Systems Laboratory, involves scanning networks belonging to the largest internet service providers in North America, Europe and Asia. The lab is sponsored by the Defense Advance Research Projects Agency (Darpa), the Department of Homeland Security and other federal agencies.
"Vulnerable devices can be found in significant numbers in all parts of the world covered by our scan," (.pdf) the researchers wrote in a summary of their initial findings presented at a symposium in June. "The double digit vulnerability rates suggest that a large botnet can be created by constituting only embedded network devices."
Since initiating the project last December, the Intrusion Detection researchers have scanned 130 million IP addresses and found nearly 300,000 devices whose administrative interfaces were remotely accessible from anywhere on the internet. The 21,000 devices with default passwords are the most vulnerable, but the rest are theoretically vulnerable to brute-force password-cracking attacks, Stolfo said. Extrapolating from the numbers they've gathered, the researchers estimate that 6 million vulnerable devices are likely connected to the internet.
The group has so far focused on residential routers and devices but is now looking at scanning more sensitive networks to search for vulnerable devices inside large corporations and government networks.
"People tend to buy stuff and bring them to work and just plug them in," Stolfo said. "So we think we'll be able to find vulnerable devices in highly sensitive places."
The researchers didn't attempt to explore the administrative interfaces or tamper with the devices they found, so they believe their work isn't illegal.
"The scan script sends the public password for the product, and if the device responds with the 'command prompt' for that product interface, then the machine is obviously open," Stolfo said. "We do not access the machine. We break the connection at that point and move on."
ISPs can easily detect the scanning, and the researchers embedded a URL in their probes for a webpage explaining the project that gives network providers a chance to opt out. Stolfo says a couple of universities, a security company and government agency have so far asked to be exempt from the scan.
The researchers have provided ISPs with their findings in the hope that they will do something to protect vulnerable customers.
"It's not clear how an ISP is going to do a general announcement, but we hope there will be some way to communicate to the home user in particular about what they have to do to reconfigure their device," Stolfo said.
But Stolfo says product makers are the real culprits and need to hide their administrative interfaces by default and provide clear instructions for users who want to alter that configuration. Vendors should also be more forceful in communicating to users that default passwords need to be changed to robust alphanumeric passwords that include special characters to thwart brute force attacks.
"This is not a password you're going to need every day, so setting a very hard password and recording it at home on a piece of paper is probably a safe thing to do," Stolfo says.
The group plans to run the scan for a few more months, then wait before re-running it to see if the number of vulnerable devices has fallen after they've notified ISPs about the vulnerabilities.
See also:
