lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 10 Apr 2019 04:10:47 +0000
From: "Harley A.W. Lorenzo via Fulldisclosure" <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Security Analysis of the TP-Link Archer C50 Router

================================================================================
Title: Security Analysis of the TP-Link Archer C50 Router
Version: Archer C50(US)_V2_160801 (latest firmware available)
Product Page: https://www.tp-link.com/us/home-networking/wifi-router/archer-c50/
Published: 2019-04-10 (UTC Time)
Published by: Harley A.W. Lorenzo <hl1998@...tonmail.com>
    <GPG Key: 0xF6EF23904645BA53>
================================================================================

================
Security Details
================

 *  The C50 router implements a completely unencrypted HTTP authentication
    login handshake on its port 80 HTTP server for administrative tasks
 *  The C50 router implements a telnet server over Busybox Telnetd
 *  The C50 router implements an SSH service with on Dropbear 2012.55 with
    low-bit DSA and RSA keys (1024 and 1040-bit respecitvely)

===================
Login Sniffing/MITM
===================

Because of C50 router login handshake is completely unencrypted (both over HTTP
and telnet) any attacker with access to the network data sent to the router
can easily acquire the username and password sent in the login.

For example, the following proof of concept regarding HTTP traffic:

 1. Set up a valid sniffer and listen for the HTTP traffic sent to the server
 2. Login to the server via its webserver
 3. Watch for a GET request to its base index with a cookie with the format
        Authorization=BASIC {[user]:[pass]}
            *   Where [user] is replaced with the username and [pass] is
                replaced with the password entered
            *   Where everything in {} is encoded in base64

===
SSH
===

 * The SSH server is possibly vulnerable to serveral CVEs regarding Dropbear
 * DSA is an deprecated singing algorithm and is better replaced with ECDSA
 * Both the DSA and RSA keys are well below the recommended size

================
Additional Notes
================

Beside the HTTP sniffing PoC, these are all preliminary findings, and this
research is an ongoing effort.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists