Critical Flaws Found in NETGEAR Network Management System

Netgear, one of the most popular router manufacturers, has been vulnerable to two different flaws that could allow hackers to compromise your corporate network and connected devices.

Reported critical vulnerabilities reside in the Netgear's ProSafe NMS300 Model (Network Management System) – a centralized and comprehensive management application for network administrators that enables them to discover, monitor, configure, and report on SNMP-based enterprise-class network devices.

SNMP (Simple Network Management Protocol) is a network management protocol which facilitates Netgear's ProSafe NMS300 application to gather data from various network devices such as servers, printers, hubs, switches, and routers.

Remotely collected data includes CPU load, routing tables, and network traffic statistics.

Serious Flaws in Network Management System

A joint security dug conducted by Pedro Ribeiro (Security Researcher of UK Based firm Agile Information) along with CERT Committee divulged the vulnerabilities in the web interface of the router that could allow attackers to:

• Upload and Execute any malicious file remotely (CVE-2016-1524)
• Download any file from Server (CVE-2016-1525)

Unauthorized Arbitrary File Upload Flaw: This flaw comes with the default installation of NMS300, allowing an unauthorized attacker to upload an arbitrary file and execute (Remote Code Execution) malicious code with SYSTEM privileges.

Upload location: http://:8080/fileUpload.do
Upload location: http://:8080/lib-1.0/external/flash/fileUpload.do
Execurition Location: http://:8080/null

Directory Traversal Attack: This vulnerability allows authenticated users to read and download any restricted file by manipulating ‘realName’ parameter of POST request tohttp://:8080/data/config/image.do?method=add URL.

The security vulnerabilities affect Netgear Management System NMS300, version 1.5.0.11 and earlier.

How to Protect Your Network from Hackers

Since there are no patches yet available from Netgear to fix these vulnerabilities, the only solution that network admins could implement here is strengthening the firewall policy by restricting the untrusted sources.

As threats continue to evolve and increase in volume and frequency, you can no longer rely on static network security monitoring.

Network administrators are strongly encouraged to monitor network-based services or protocols on a continuous basis using security monitoring solutions like (USM), which also includes (IDS) and  to help administrators to quickly identify and remediate threats on their network.

Netgear had not yet commented to this issue.

Read More

602 Gbps! This May Have Been the Largest DDoS Attack in History

Cyber attacks are getting evil and worst nightmare for companies day-by-day, and the Distributed Denial of Service (DDoS) attack is one of the favorite weapon for hackers to temporarily suspend services of a host connected to the Internet.

Until now, nearly every big website had been a victim of this attack, and the most recent one was conducted against the BBC's websites and Republican presidential candidate Donald Trump's main campaign website over this past holiday weekend.

Out of two, the largest DDoS attack in the history was carried out against the BBC website: Over 600 Gbps.

Largest DDoS Attack in the History

The group calling itself New World Hacking claimed responsibility for taking down both the BBC's global website and Donald Trump's website last week.

The group targeted all BBC sites, including its iPlayer on-demand service, and took them down for at least three hours on New Year's Eve.

At the moment, the BBC news organization announced that the outage was caused due to some "technical" fault, but later it stated that "New World Hacking" group had claimed responsibility for launching a DDoS attack against BBC, as a "test of its capabilities."

BangStresser DDoS Attack Tool

One of the members of the New World Hacking group, identified himself as Ownz, claimed that the group allegedly used their own tool called BangStresser to launch a DDoS attack of up to 602 Gbps on the BBC's website.

As a proof, the group provided ZDNet a screenshot of a web interface that was allegedly used to attack the BBC website.

Although the authenticity of the screenshot has not been verified, if the attack size is proven true, it would vastly surpass the largest DDoS attack record of 334 Gbps, recorded by Arbor Networks last year.

The recent massive DDoS attack apparently utilizes two Amazon Web Services servers that employ a large number of automated detection and mitigation techniques in order to prevent the misuse of the services, Amazon previously claimed.

"We have our ways of bypassing Amazon," said Ownz. "The best way to describe it is we tap into a few administrative services that Amazon is use to using. The [sic] simply set our bandwidth limit as unlimited and program our own scripts to hide it."

More details about the attack have yet not disclosed, but Ownz claimed that their main purpose behind the development of the BangStresser DDoS tool is to unmask ISIS and possibly end its online propaganda.

"We have been taking down ISIS websites in the past," said Ownz, "this is just the start of a new year."

A similar group named Lizard Squad, conducted a marketing campaign for promoting their DDoS tool, known as the Lizard Stresser, using which the group took down Sony's PlayStation Network and Microsoft's Xbox Live last year on Christmas Eve.

Read More