UPDATE: According to Softpedia, Netgear has now produced beta firmware as a response to the bug. FlashRouters still recommends using alternative firmware like DD-WRT and Tomato in place of Netgear firmware.
The US-CERT is the United States Computer Emergency Readiness Team. It is an organization within the Department of Homeland Security’s National Protection and Programs Directorate. On Friday Dec 9, US-CERT issued a vulnerability advisory concerning the Netgear R7000 and the R6400. Users have also come forward to add that much of the popular Netgear Nighthawk line of WiFi routers – R8000, the R7500, the R7800, the R8500 and the R9000 are vulnerable to the Netgear firmware bug.
While US-CERT revealed this bug on Friday, it should be stated that the Twitter user Acew0rm discovered this flaw four months ago. So much for corporate responsibility and government efficiency…
Here is a video of Acew0rm revealing the hack:
Consequently, this firmware bug may also be affecting any Netgear model using default or stock Netgear firmware i.e. the security hole ridden routers that have been exploited many times before.
What Can Happen If Your Router Is Exposed?
If a router is affected by this bug, it is open to takeover attacks. A remote attacker can execute arbitrary commands with root privileges on routers possessing the Netgear firmware bug. US-CERT has not offered a solution. The only advisory warning pushed forward to Netgear users has been to “discontinue use.”
How To Avoid The Netgear Firmware Bug
While some philanthropic techies are offering “temporary fixes” to the Netgear firmware bug, FlashRouters can offer something a little more permanent. For the temporary fix, here is the solution offered by Bas:
1. Verify that your router is affected by going to this URL: http://[router-address]/cgi-bin/;uname$IFS-a
If that shows you anything but an error (or an empty page), you’re affected.
2. Point your browser to the following URL to terminate the web server process (which facilitates the vulnerability) on your router:
3. (optional) Verify that the URL in step (1) is no longer accessible.
On the other hand, FlashRouters does not recommend using default firmware. In fact, all of our devices arrive freshly modified to remove the ever user bug-filled, underperforming, poorly developed stock firmware. Using Open Source firmware will allow you to bypass any factory installed backdoor or default firmware bugs.
It has been reported that Netgear users can be exposed to this vulnerability just by clicking on ad like those featured on Google (Google Adsense). Open Source firmware will help you avoid backdoors and bugs, but it can help you avoid malicious ads as well.
Open Source firmware like DD-WRT and Tomato also contains embedded ad-blocking features such as Privoxy that can assist in blocking malicious ads on all of your devices in your network with one setup. That’s one-time plug-n-play network-wide protection. You ain’t gonna get that from a standard Amazon device.
Router Manufacturer Recall or Bug Protocol
In fact, there is really no protocol for pulling these devices of the shelves, it is up to the user to pay enough attention to see that their router completely unsecured and exposed.
Furthermore, you can always purchase an Open Source router from FlashRouters. FlashRouters offers many of the Netgear models pre-installed with open-source firmware and the embedded hol-patching and security included in that. FlashRouter Netgear models like the Netgear R7000 and R8000 come pre-flashed with DD-WRT firmware.
FlashRouters Support Plan
Additionally, if you already own of the affected WiFi routers, there is no need to panic. FlashRouters offers a Remote Support Plan to help with remote TeamViewer installation and support of this firmware security enhancement.
Incidentally, there is no need to ship the router into FlashRouters. Moreover, the flashing process takes about 30 minutes. By the same token, purchasing a subscription to our Support Plan will fix the vulnerability issue concerning your router, and you won’t even have to leave the house. It also includes a minimum of 3 months of expert tech support to get you up and running.
Need Some Help?
Have a question about the Netgear Firmware Exploit or FlashRouters Services? Feel free to reach out to our expert networking team to experience true network security expertise.