full-disclosure - Re: Netgear WG602 Accesspoint vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: rtoren at futures-inc.com (Rip Toren)
Subject: Re: Netgear WG602 Accesspoint vulnerability

Quoting Jan Jungnickel <jj@...munity.de>:

> On Tue, Jun 08, 2004 at 10:05:56AM +0200, pera@...ersize.org wrote:
> 
> > >Netgear has 'fixed' this by changing the username and
> > >password to something else. 
> > I heard the username has been changed to "superman" with the
> > password "21241036". I wonder whose phone number THIS is...
> 
> Precisely. I'm pretty stunned by this blatant example of
> stupidity :/
> 
> -- 
> carmunity.com GmbH              Mary-Astell-Strasse 2
> Jan Jungnickel                  28359 Bremen
 <<snip>>

  Depending upon how the account name and password are stored, this might have been as
simple as a binary edit of the firmware, with some checksum cleanup. Unfortunately, it
would only take a couple of hours to completely hide any literal values from a 'strings'
search.

  Even if another firmware is released, and it shows no strings; can it be assured that
the account data has not just been hidden. This might also mean that the V2 product is
also compromised, but with masked account data... who knows?

  Since they seem to have demonstrated a corporate commitment to 'backdoor' their product;
it might be time to find a more customer friendly supplier. At least until the is some
public statement by NetGear about the situation.

   I care, I used one of these; until 10 minutes ago.

-- 
Rip Toren
Senior Information Assurance Engineer
Futures Inc.
email: rtoren@...ures-inc.com
website:  http://www.futures-inc.com

-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/