DLink backdoor | Defend the Web

0xDC
11 years ago | edited 11 years ago

3

A security researcher of /dev/ttyS0 reverse engineered the firmware of a DLink DIR-100. He found it was possible to gain access to the administrative interface of this device by changing the browser’s user-agent to “xmlset_roodkcableoj28840ybtide” (without the quotes).

Read more here. It is also believed that this works on other DLink models as well.

If you own a DLink router, please test this and report the model number in this thread.

Thanks!
0xDC

Here’s a list of affected models:

DLink

DIR-100
DI-524
DI-524UP
DI-604S
DI-604UP
DI-604+
TM-G5240

Planex
Planex routers also seem to use the same firmware.

BRL-04UR
BRL-04CW

/dev/null

daMage
11 years ago

0

An interesting article, to say the least. Thanks for the link (and info) ;)

daMage

CygnusH33L
11 years ago

0

DLink have released firmware updates for this now http://thehackernews.com/2013/12/d-link-releases-router-firmware-updates.html
just seen it on twitter and thought I’ve seen this somewhere before, guessed it was here :)

I would love to change the world, but they won’t give me the source code.

Pete Maynard [Osaka]
11 years ago

0

You can find some routers through shodan with a little bit of research.

Folding@Home Stats | Official Thread | Team Number: 223679