The weak link in the chain…

Tripwire has released the results of an extensive analysis of security vulnerabilities in small office/home office (SOHO) wireless routers. As part of the research, Tripwire sponsored a study of 653 IT and security professionals and 1,009 employees who work remotely in the US and UK

Collectively, this research strongly shows that critical security vulnerabilities are endemic across the entire SOHO wireless router market, and a surprising number of IT professionals and employees who work remotely do not use basic security controls to protect their wireless routers.

SOHO wireless router security vulnerabilities present significant cyber security risks to employees and enterprise networks.

Routers are an ideal target for cyber attackers because they can be used to eavesdrop on traffic sent to and from nearby enterprise access points. After an attacker has gained control of a router, they are able to monitor, redirect, block or otherwise tamper with a wide range of online activities. Once a router is compromised, devices guarded by the router’s firewall become targets for additional network-based attacks. Even technically oriented users find it difficult to identify a wireless router cyber attack because router user interfaces are minimal, and the traffic sent from a compromised device to cyber attackers is typically invisible.

Tripwire’s Vulnerability and Exposure Research Team (VERT) has analyzed the security provided by the most popular wireless routers used in many small and home offices and found that 80 percent of Amazon’s top 25 best-selling SOHO wireless router models have security vulnerabilities. Of these vulnerable models, 34 percent have publicly documented exploits that make it relatively simple for attackers to craft either highly targeted attacks or general attacks targeting every vulnerable system they can find.

A few key security practices can help users can effectively limit wireless router cyber attacks. However, Tripwire’s study of wireless router security practices among IT professionals and employees who access corporate networks from remote locations shows that these practices are not widely used.

Key study findings include:

30 percent of IT professionals and 46 percent of employees do not change the default administrator password on their wireless routers. With access to the configuration interface, attackers can easily compromise the device.
55 percent of IT professionals and 85 percent of employees do not change the default Internet Protocol (IP) address on their wireless routers, making cross-site request forgery (CSRF) attacks much easier for cyber attackers.
43 percent of IT professionals and 54 percent of employees use Wi-Fi Protected Setup (WPS) – an insecure standard that makes it simple for attackers to discover a router’s encryption passphrase, regardless of its complexity or strength.
52 percent of IT professionals and 59 percent of employees have not updated the firmware on their routers to the latest version, so even when security updates from router vendors are available, most users do not receive the additional protection.

More details.

•Date: 24th February 2014 • UK/US •Type: Article • Topic: ISM

Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.

How to advertise on Continuity Central.

To submit news stories to Continuity Central, e-mail the editor.

Want an RSS newsfeed for your website? Click here