text: Newfound Router Flaw lets hackers control 'Home Internet Connections', Telecom News, ET Telecom
  The vulnerability allows an attacker to install their own firmware to the device, which would still work as before, but with back doors and other unwanted features.ANI | September 02, 2016, 17:19 IST
  NEW DELHI: F-Secure researchers have uncovered a critical vulnerability in some models of Inteno home routers that, if exploited, is severe enough to allow an attacker complete control over the victim device and the Internet traffic traveling through it. The finding highlights the security challenges plaguing consumer routers.
  The vulnerability allows an attacker to install their own firmware to the device, which would still work as before, but with back doors and other unwanted features. An attacker exploiting the flaw would be able to listen in on unencrypted traffic going through the router, not just device-to-internet, but device-to-device inside the home; as well as manipulate the victim's browsing sessions by redirecting to malicious sites.
  "By changing the firmware, the attacker can change any and all rules of the router," said Janne Kauhanen, cyber security expert at F-Secure.
  "Watching video content you're storing on another computer? So is the attacker. Updating another device through the router? Hopefully it's not vulnerable like this, or they'll own that too. Of course, HTTPS traffic is encrypted, so the attacker won't see that as easily. But they can still redirect all your traffic to malicious sites that enable them to drop malware on your machine," he added.
  The router type in question typically receives firmware updates from a server associated with the user's internet service provider (ISP). But problematically, the vulnerable routers make no effort to confirm the update is valid and comes from the right place.
  An attacker who has already gained access to the traffic between the home router and the ISP's update server (for example, by accessing an apartment building's network distribution trunk) can set up his own update server. He could then apply a malicious firmware update.
  "It's ridiculous how insecure the devices we're sold are," says Kauhanen.
  "We and other security companies are finding vulnerabilities in these devices all the time. The firmware used in routers and Internet of Things devices is neglected by manufacturers and their customers - by everyone except hackers, who use the vulnerabilities to hijack Internet traffic, steal information, and spread malware," he added.
  However, he points out that replacing the router is problematic advice. "As vulnerabilities in consumer DSL equipment are extremely common, it could well be that the device switch only leads to an even worse security situation," he says.