Eircom Netopia Routers Are Wide Open

smellslikeshoes

After reading the siliconrepublic article I'm curious as to what the gardai could actually do if someone reported unauthorized access to their network.
How easy would it be for the gardai to find the culprit? and Is it actually feasible to expect them to do so?

s4dd

"Not very" and "No" i'd say... smells like a throwaway line to me.

watty

from http://www.siliconrepublic.com/news/news.nv?storyid=single9323

The Eircom spokesperson added: “For advanced security, customers can choose to change their security software to WPA (Wi-Fi Protected Access).”

Because anyone able to use Google can setup Linux and (with no previous expertise) crack WEP in 5 minutes anyway.

So I'm glad to hear they are recommending WPA, not just changing the SSID or WEP key.
It's not a router flaw. It's a flaw in the SW Netopia did for eircom. I'm informed there are no Led Zepplin fans in the relevent eircom dept.

The address in the article is wrong
http://www.broadbandsupport.eircom.net./ won't work
http://www.broadbandsupport.eircom.net will
It does not have any obvious warning yet and still shows the flawed CD wizard setup
I can't link as the site uses session.

yallingup

Sponge Bob wrote:

wpa is a password , something like

76u-098-970148e1-9479-18743148e09184-1904u1[30487-1414104&&301e4018

Ah, Jaysus, Sponge, that's my password...

Cabaal

smellslikeshoes wrote:

After reading the siliconrepublic article I'm curious as to what the gardai could actually do if someone reported unauthorized access to their network.
How easy would it be for the gardai to find the culprit? and Is it actually feasible to expect them to do so?

While people have been arrested in the UK for using people's wifi, unless the person is accessing a companys network then I highly doubt the Gardai will put resources into sending a Gardai down to stop someone from using somebody else's wifi connection.

pid()

Enjoy your 15 seconds lads.

Will eircom be issuing a firmware upgrade as well? Because if the router is reset then it's back to square one.

WPA is not a possibility for everyone, if you're pre XP sp2 you have to use WEP. Changing the default wep key secures you for a whole of 5 minutes or less. They need to show their customer's how to use mac address filtering, but even that isn't totally secure either.

Sponge Bob

The best security feature I know for any wireless network is one of these

s4dd

Or some of this

bartificer

pid() wrote:

Will eircom be issuing a firmware upgrade as well? Because if the router is reset then it's back to square one.

I would imagine that if the router is re-set people would use the updated instructions Eircom are mailing out.

pid() wrote:

WPA is not a possibility for everyone, if you're pre XP sp2 you have to use WEP.

If you're pre-XP-SP2 you shouldn't be connecting to the net. That's just asking to be p0wn3d!

pid() wrote:

They need to show their customer's how to use mac address filtering, but even that isn't totally secure either.

No, they really don't. MAC address filtering is pointless. It is totally trivial to by-pass. It's no more than pretend security.

The key is to use WPA with a GOOD KEY. The importance of a good long WPA key cannot be over-emphasised.

Bart.

pid()

bartificer wrote:

I would imagine that if the router is re-set people would use the updated instructions Eircom are mailing out.

And do you expect those instructions to contain information on how to upgrade the firmware on a netopia router? I think you might be hoping for a bit too much there.

bartificer wrote:

If you're pre-XP-SP2 you shouldn't be connecting to the net. That's just asking to be p0wn3d!

Do you know how many pre XP sp2 devices there are on the internet? There are absolutely millions. That was a bit of a retarded statement tbh. What age are you, out of curiosity?

bartificer wrote:

No, they really don't. MAC address filtering is pointless. It is totally trivial to by-pass. It's no more than pretend security.

The key is to use WPA with a GOOD KEY. The importance of a good long WPA key cannot be over-emphasised.

Bart.

MAC Address filtering is not pointless, it's enough to throw off a lazy script kiddie who has difficulty with your router. That is it's only benefit. If you read my post you would see that I mention MAC address filtering is not secure. Please think before you jump down my throat. I, unlike you, know what I'm talking about.

bartificer

pid() wrote:

And do you expect those instructions to contain information on how to upgrade the firmware on a netopia router? I think you might be hoping for a bit too much there.



Do you know how many pre XP sp2 devices there are on the internet? There are absolutely millions. That was a bit of a retarded statement tbh. What age are you, out of curiosity?



MAC Address filtering is not pointless, it's enough to throw off a lazy script kiddie who has difficulty with your router. That is it's only benefit. If you read my post you would see that I mention MAC address filtering is not secure. Please think before you jump down my throat. I, unlike you, know what I'm talking about.

Did we get out of the wrong side of the bed this morning or something? I'll ignore the slight on my age and intelligence and respond as if you had been kind enough to keep things civil.

When you think about it, what WEP only devices should there still be out there? Well, you have a few very annoying recent ones like the Nintendo stuff and some TiVos. Then you have people who have old OSes that are out of support (Win98, WinME, Win2K, WinNT4.0). And finally you have machines that are running XP but are not fully patched.

The people running pre-SP2 XP need to upgrade to SP2 for loads of reasons, not just WPA. Hence, SP2 should be a recommended minimum spec. The people running pre-XP operating systems are running officially obsolete operating systems. MS don't support them, why should Eircom? That leaves only one trouble group, the Nintendo and TiVo owners. They need to make an informed decision about their priorities, security -v- connectivity.

So, it should be clear from this that we are not yet at the happy day when we can consign WEP to the annals of history. However, I do think we have arrived at the stage where the default needs to flip. We need to go from WEP by default with instructions for switching to WPA (like we have now), to WPA by default with instructions for switching to WEP only if needed. Still, the fact that Eircom will be telling people about WPA at all is a step forward for sure.

As for MAC filtering, any script kiddie thrown off by MAC filtering will probably also be thrown off by WEP It is of course not totally pointless, but really, there are much more important and simpler things that Eircom should educate their users about before they get to MAC filtering.

Bart.

pid()

bartificer wrote:

Did we get out of the wrong side of the bed this morning or something? I'll ignore the slight on my age and intelligence and respond as if you had been kind enough to keep things civil.

When you think about it, what WEP only devices should there still be out there? Well, you have a few very annoying recent ones like the Nintendo stuff and some TiVos. Then you have people who have old OSes that are out of support (Win98, WinME, Win2K, WinNT4.0). And finally you have machines that are running XP but are not fully patched.

The people running pre-SP2 XP need to upgrade to SP2 for loads of reasons, not just WPA. Hence, SP2 should be a recommended minimum spec. The people running pre-XP operating systems are running officially obsolete operating systems. MS don't support them, why should Eircom? That leaves only one trouble group, the Nintendo and TiVo owners. They need to make an informed decision about their priorities, security -v- connectivity.

So, it should be clear from this that we are not yet at the happy day when we can consign WEP to the annals of history. However, I do think we have arrived at the stage where the default needs to flip. We need to go from WEP by default with instructions for switching to WPA (like we have now), to WPA by default with instructions for switching to WEP only if needed. Still, the fact that Eircom will be telling people about WPA at all is a step forward for sure.

As for MAC filtering, any script kiddie thrown off by MAC filtering will probably also be thrown off by WEP It is of course not totally pointless, but really, there are much more important and simpler things that Eircom should educate their users about before they get to MAC filtering.

Bart.

I may have done. Heh.

Anyway, MS doesn't support them because they want to drive their new OS, Vista, and get cash that way. It's why the sale of XP will soon cease with the likes of Dell, etc. They do not not support them because they are obsolete, they do not support them because they want those people to buy their new product. You can lay the blame with anyone, with MS for not releasing a WPA patch on older operating systems and that's where I think part of the blame should lie. I'm guesstimating here, but I would be very confident that 33%, if not more, of eircom's customers are pre XP. You can't just ignore these people and tell them to upgrade their OS, but at the same time what can Eircom do about it? Nothing. They can 'advise' them on the best steps to take, which is what they will do next month. Their assess are covered after that.

Yes, we all wish WEP would just go away, but it's a catch 22 and it's not going to go away for a long time, unfortunately. I mean come on, the Eircom phones use WEP. What's their excuse for that?

Sponge Bob

pid() wrote:

I'm guesstimating here, but I would be very confident that 33%, if not more, of eircom's customers are pre XP.

And very few pre xp systems have a wireless card so its irrelevant. They would have a network card to connect .

The vast majority of those with wireless cards should be running xp sp2 or higher.

anyway you can get a wpa client for 98/me/2000 here

bartificer

pid() wrote:

Anyway, MS doesn't support them because they want to drive their new OS, Vista, and get cash that way. It's why the sale of XP will soon cease with the likes of Dell, etc.

There's certainly an element of truth to that. Although, XP is six years old this month. Machines from six years ago are really getting long in the tooth now.

pid() wrote:

They do not not support them because they are obsolete, they do not support them because they want those people to buy their new product.

You can look at it that way but from a security point of view I look at it the other way round, they are obsolete because MS have ceased support. Since they are not being patched they are a pure liability.

pid() wrote:

You can lay the blame with anyone, with MS for not releasing a WPA patch on older operating systems and that's where I think part of the blame should lie. I'm guesstimating here, but I would be very confident that 33%, if not more, of eircom's customers are pre XP.

Like you I'm also not going on anything more than and education guess here but 33% sounds very high to me. When a PC gets to be three years old it is really starting to get obsolete. Add two more years to that and you get to 5 years old. By one year after the introduction of XP I very much doubt Dell were still selling Win2K machines. So, being conservative, it's only machines that were bought more than five years ago that can't go with WPA.

pid() wrote:

You can't just ignore these people and tell them to upgrade their OS, but at the same time what can Eircom do about it? Nothing. They can 'advise' them on the best steps to take, which is what they will do next month. Their assess are covered after that.

You are indeed right that their asses are covered. It is also a good thing that they are sending out a letter. I'll reserve comment on the content of that letter till I see it.

One other point though, even if Eircom were to go fully WPA that would not exclude pre-SP2 machines from connecting to the net, it would just exclude them from connecting over WiFi. The Netopia comes with ethernet ports. I can't remember if it's three or four but it's certainly enough to allow old machines connect the old way.

pid() wrote:

Yes, we all wish WEP would just go away, but it's a catch 22 and it's not going to go away for a long time, unfortunately. I mean come on, the Eircom phones use WEP. What's their excuse for that?

Hang on .... WHAT? You mean to tell me their new supposedly cutting-edge digital wireless phones use WEP? Or did I misunderstand? Please tell me I miss-understood

Bart.

pid()

Sponge Bob wrote:

And very few pre xp systems have a wireless card so its irrelevant.

Three words, wireless usb dongle.

pid()

bartificer wrote:

You can look at it that way but from a security point of view I look at it the other way round, they are obsolete because MS have ceased support. Since they are not being patched they are a pure liability.

I think you missed my point there dude, I was laying the blame with MS for ceasing support

bartificer wrote:

Like you I'm also not going on anything more than and education guess here but 33% sounds very high to me. When a PC gets to be three years old it is really starting to get obsolete. Add two more years to that and you get to 5 years old. By one year after the introduction of XP I very much doubt Dell were still selling Win2K machines. So, being conservative, it's only machines that were bought more than five years ago that can't go with WPA.

I'm not entirely sure if Dell were or were not selling Win2k a year after XP had been launched, but I will say this. The only reason they are still selling XP now is because of consumer interests. Enough customers / potential customers said they did not want Vista, and that's the only reason you can still by XP on selected models from Dell.

bartificer wrote:

One other point though, even if Eircom were to go fully WPA that would not exclude pre-SP2 machines from connecting to the net, it would just exclude them from connecting over WiFi. The Netopia comes with ethernet ports. I can't remember if it's three or four but it's certainly enough to allow old machines connect the old way.

Well yeah, it only affects the medium, obviously. I know lots of people who have their modem so far away from their computer that using an ethernet cable is not fesable (packet loss and physical annoyance combined).

bartificer wrote:

Hang on .... WHAT? You mean to tell me their new supposedly cutting-edge digital wireless phones use WEP? Or did I misunderstand? Please tell me I miss-understood

Bart.

Nope, I said nothing about their new phones.



Also, can I just say I find it interesting that both Spongebob and Bart are friends, and it was Bart who claimed he had been 'anonymously' sent information on this flaw and posted it on his blog. Admit it Bart, there was nothing anonymous about it, it was Spongebob who gave it to you. Fame lads, that's a shocking motive to have.

How's Maynooth?

bartificer

pid() wrote:

Also, can I just say I find it interesting that both Spongebob and Bart are friends, and it was Bart who claimed he had been 'anonymously' sent information on this flaw and posted it on his blog. Admit it Bart, there was nothing anonymous about it, it was Spongebob who gave it to you. Fame lads, that's a shocking motive to have.

How's Maynooth?

Hang on a sec ... why do I seem to be the only person who has no idea who anyone else is? I honestly have no idea who spongebob is on these boards or indeed who you are ... assuming yee are both fellow Maynoothians, what's your Mikado/MiNDS> usernames? (that way I know who you are yet you still remain anonymous ... see, I can do smart I can)

Maynooth is grand ... though we just got a fresh infestation of students. I'm telling yas, the college runs so much more smoothly without them

Bart.

pid()

You don't fool me mate.

Knock knock, who's there lads?

bartificer

pid() wrote:

You don't fool me mate.

Knock knock, who's there lads?

ARG ... yes, yes I am being serious! I think I know who lonewolf is but that's it as far as this thread is concerned.

bartificer

http://www.bartbusschots.ie/blog/?p=540

My finaly thoughts on this matter along with a scan of the reply I got from Eircom.

Bart.

Martyr

Bart, did you read the code i wrote for exploiting this problem?

You say - as does lonewolf, and many others now i see on blogs - that changing the SSID helps defeat the exploit, which is incorrect.

I acknowledge you recommending to switch over to WPA, but changing the SSID does nothing to improve the security of the router.

i admit it is probably less of a target..but not entirely, those with the knowledge will still try connecting to it anyway.

The serial number is in the MAC, and its a waste of time converting the SSID to serial number.

you don't need the SSID, everything is in the MAC!!

alot of people are already mis-informed on how to fix this.

But i realise now, this is because initially, you didn't understand how to decode the SSID properly, (hit-and-miss code) therefore didn't know it was derived from the MAC.

you did say it was trivial to decode the SSID with some C++ program you received, but this wasn't completely accurate from the code i saw.. others that saw it too, downplayed and almost dismissed the problem as "over-hyped"

Basq

Is it me or did this make the national news this morning? Am convinced i heard it on 2FM at 8.30 as the first news story but just caught the news of it.

Thankfully i always use WPA2 also.

thehomeofDob

I'll be bringing it to the attention of our eircom rep this morning, I'm sure they already know, but the more places this info is coming for the better. We have an eircom demo in store, so I can show her how easy it is to do.

h57xiucj2z946q

its mentioned here http://www.ireland.com/newspaper/frontpage/2007/1002/1191223002351.html along with boards.ie

stylers

Well it seems that eircom now have an advisory up on the broadband support site, but how many of the ordinary joe soaps out there ever look at that or even know that it exists ?. I would sadly guess that most of eircoms customers are the type of people that they portray in their ads, who only want to surf and watch youtube etc., and couldnt really care less about how their broadband is set up, once it works out of the box thats it "got a new laptop - oh the internet works - yay !". Ask them what operating system they have ! :rolleyes:

I do a lot of troubleshooting and virus cleaning work for people i know. I try to disable wireless connections where possible and set them up properly where needed. I was once setting up someones router and couldnt believe the amount of neighbouring routers i could needlessly see, and probably very easily use. I reckon that a lot of FN's are probably well into borrowing wireless connections, once they have been shown how to by google.

unless they get a few emails out or advertise it a bit better, its likely to go unnoticed by the vast majority..

Owen.

Sponge Bob

Nothing short of advertising/publicity will make any real difference .

lynchie

Damien was on Newstalk just before 9 talking about it..

Prisoner6409

Eircom has said that this particular issue only effects the netopia routers models 2247 and 3000 so ppl who got modems in the last 6-9 months should be ok. Having said that I would not use WEP in any case. WPA-PSK while not uncrackable is more secure and just as easy to set up. Problem is a lot of ppl want plug and go solutions.

ZeRoY

On RTE news Website, first article:

http://www.rte.ie/news/2007/1002/eircom.html

Hobart

Headline item on 10:00am this morn on the Rte Radio 1 news. They also wheeled out some security expert on the PK show to dampen down the hysteria.