POISONING THE WELL —
Vulnerability in 3rd-party libraries can send devices’ users to malicious sites.
Dan Goodin
– May 3, 2022 9:15 pm UTC
Getty Images
Hardware and software makers are scrambling to determine if their wares suffer from a critical vulnerability recently discovered in third-party code libraries used by hundreds of vendors, including Netgear, Linksys, Axis, and the Gentoo embedded Linux distribution.
The flaw makes it possible for hackers with access to the connection between an affected device and the Internet to poison DNS requests used to translate domains to IP addresses, researchers from security firm Nozomi Networks said Monday. By feeding a vulnerable device fraudulent IP addresses repeatedly, the hackers can force end users to connect to malicious servers that pose as Google or another trusted site.
The vulnerability, which was disclosed to vendors in January and went public on Monday, resides in uClibc and uClibc fork uClibc-ng, both of which provide alternatives to the standard C library for embedded Linux. Nozomi said 200 vendors incorporate at least one of the libraries into wares that, according to the uClibc-ng maintainer, include the following:
Linksys WRT54G – Wireless-G Broadband Router
NetGear WG602 wireless router
Most Axis network cameras
Embedded Gentoo
Buildroot, a configurable means for building busybox/uClibc-based systems
LEAF Bering-uClibc, the successor of the Linux Router Project that supports gateways, routers, and firewalls
Tuxscreen Linux Phone
The vulnerability and the lack of a patch underscore a problem with third-party code libraries that has gotten worse over the past decade. Many of them—even those like the OpenSSL cryptography library that are widely used to provide crucial security functions—face funding crunches that make the discovery and patching of security vulnerabilities difficult.
“Unfortunately I wasn’t able to fix the issue by myself and hope someone from the rather small community will step up,” the maintainer of uClibc-ng wrote in an open forum discussing the vulnerability. uClibc, meanwhile, hasn’t been updated since 2010, according to the downloads page for the library.
What’s DNS poisoning, anyway?
DNS poisoning and its DNS cache-poisoning relative allow hackers to replace the legitimate DNS lookup for a site such as google.com or arstechnica.com—normally 209.148.113.38 and 18.117.54.175, respectively—with malicious IP addresses that can masquerade as those sites as they attempt to install malware, phish passwords, or carry out other nefarious actions.
First discovered in 2008 by researcher Dan Kaminsky, DNS poisoning requires a hacker to first masquerade as an authoritative DNS server and then use it to flood a DNS resolver inside an ISP or device with fake lookup results for a trusted domain. When the fraudulent IP address arrives before the legitimate one, end users automatically connect to the imposter site. The hack worked because the unique transaction assigned to each lookup was predictable enough that attackers could include it in fake responses.
Internet architects fixed the problem by changing the source port number used each time an end user looks up the IP number of a domain. Whereas before, lookups and responses traveled only over port 53, the new system randomized the port number that lookup requests use. For a DNS resolver to accept a returned IP address, the response must include that same port number. Combined with a unique transaction number, the entropy was measured in the billions, making it mathematically infeasible for attackers to land on the correct combination.
The vulnerability in uClibc and uClibc-ng stems from the predictability of the transaction number the libraries assign to a lookup and their static use of source port 53. As Nozomi researchers Giannis Tsaraias and Andrea Palanca wrote:
Given that the transaction ID is now predictable, to exploit the vulnerability an attacker would need to craft a DNS response that contains the correct source port, as well as win the race against the legitimate DNS response incoming from the DNS server. Exploitability of the issue depends exactly on these factors. As the function does not apply any explicit source port randomization, it is likely that the issue can easily be exploited in a reliable way if the operating system is configured to use a fixed or predictable source port.
Nozomi said it wasn’t listing the specific vendors, device models, or software versions that are affected to prevent hackers from exploiting the vulnerability in the wild. “We can, however, disclose that they were a range of well-known IoT devices running the latest firmware versions with a high chance of them being deployed throughout all critical infrastructure,” the researchers wrote.
On Monday, Netgear issued an advisory saying the company is aware of the library vulnerabilities and is assessing whether any of its products are affected.
“All Netgear products use source port randomization and we are not currently aware of any specific exploit that could be used against the affected products,” the device maker said. Representatives from Linksys and Axis didn’t immediately respond to emails asking if their devices are vulnerable.
Without more details, it’s hard to provide security guidance for avoiding this threat. People using a potentially affected device should monitor vendor advisories for updates over the next week or two.
