Background info:
About 50% of the ADSL and cable internet access in Germany (and presumably parts of the EU) goes over AVM Fritz routers, either verbatim or rebranded as e.g. "1&1 Home Server" or "T-Online Box".
These are embedded MIPS systems with a couple of ethernet ports, an ADSL or similar plug, and other optional stuff (DECT, WLan, USB ports) running a Linux (2.6 ???) derivative.
About three weeks ago, an exploit became known which allowed gaining root access to the router. The exploit has apparently been used to call service numbers on the Falklands, charging unwitting users.
AVM's first public press release was that this was not a serious threat (what else would they say!) because it requires remote access being enabled, which is not the case by default, and which most users don't have enabled anyway.
A few days later, it was revealed that the exploit has nothing to do with remote access at all, and that someone could take over your router if you merely visited an otherwise harmless website which contains a page with malicious code. An OS update was released the same day.
Yesterday, it was alleged that a detailled description is being published on "specific hacker sites" while several millions of routers remain unpatched (i.e. vulnerable).
Questions:
1. How could such an exploit, conceptually and practically work?1. When you visit a website (or do pretty much everything else), your browser runs a DNS query and opens a TCP connection to the remote host. The router relays your DNS query and then NATs your SYN packet (and the SYN-ACK, and all following datagrams).
In other words, the router is pretty much copying packets from one ethernet port to another (updating the IP checksum after NAT, but that presumably happens in hardware anyway, but either way software implementations of TCP checksum have been stress-tested for 40 years, they're pretty much rock-solid?). Basically, as if doing a splice
from one socket to the other, except it happens in the network stack.
One should seriously hope that merely forwarding a packet to another port works 100% reliably with no exceptions and no means whatsoever of being exploited! The router doesn't validate or execute anything inside the datagrams, there is no reason for the router to even look at the "binary blob" inside each packets (... and as far as I know, it doesn't do any content filtering?).
I'm baffled how such an exploit could realistically work. Any idea?
2. Seeing how "Linux packet filter is bugged" looks like the only plausible explanation (what else could it be?), do I have reason to start panicking about my Debian server?
1Note that I'm not looking for a how-to recipe, and I don't want to run an exploit.