Netgear router security flaws finally patched after six months

Netgear has issued patches to fix security vulnerabilities in two of its routers which can be exploited by an attacker to take full control of the devices remotely.

The two devices that have received patches are the R6400v2 and R6700v3. However, 77 of Netgear's other routers reportedly still remain vulnerable to a zero-day vulnerability that was reported to the company back in January of this year.

The vulnerability, which lies in the HTTPD daemon used to manage the routers, was discovered independently by both Grimm's Adam Nichols and d4rkn3ss from Vietnam's VNPT ISC through the Zero Day Initiative (ZDI).

ZDI has released a report that includes some information about the vulnerability while Nichols has written a lengthy blog post describing it in detail, a Proof of Concept (PoC) exploit and even scripts to find vulnerable routers online.

Zero-day vulnerability

Based on the reports about the vulnerability, affected router models have an HTTPD daemon which does not adequately check the length of data supplied by a user and this allows an attacker to create a buffer overflow when data is copied to a fixed-length variable.

To exploit the flaw in Netgear's routers, an attacker would need to create a specially crafted string capable of executing commands on the device without having to authenticate first. In his blog post, Nichols explained that while stack cookies would normally be able to mitigate this vulnerability, many of Netgear's routers don't use them, saying:

“In most modern software, this vulnerability would be unexploitable. Modern software typically contains stack cookies which would prevent exploitation. However, the R7000 does not use stack cookies. In fact, of all of the Netgear products which share a common codebase, only the D8500 firmware version 1.0.3.29 and the R6300v2 firmware versions 1.0.4.12-1.0.4.20 use stack cookies. However, later versions of the D8500 and R6300v2 stopped using stack cookies, making this vulnerability once again exploitable.”

By default, the HTTPD Daemon these routers is only accessible via LAN, although router admins can enable it so it can be accessed remotely over the internet. However, attackers can still create malicious websites using JavaScript to perform DNS rebinding attacks which would allow them to execute commands remotely on routers that are not accessible over the internet.

If you have Netgear's R6400v2 or R6700v3 router you can download hot-fixes for the vulnerability now but if you have one of the 77 other affected routers, you're out of luck until the company releases patches for them.

Via BleepingComputer

TechRadar – All the latest technology news

Read More

Motorola Razr finally goes on sale in India today

Motorola’s much-anticipated Razr foldable made its comeback to the market a few months ago and was launched in India. However, the phone never went on sale due to the nation-wide lockdown. After about two months of the launch, the Motorola Razr foldable phone is finally set to go on sale in India starting today.  

Motorola Razr Price and offers

Priced at Rs 1,24,999, the Motorola Razr will go on sale in India via Flipkart. It is available in the noir black colour variant. Originally, the Razr was set to go on sale in India from April 2. But, Motorola had to postpone due to the Covid-19 outbreak. The sale was then pushed to April 15 and again to May 6. Due to the lockdown extension, the company once again postponed the sale, and finally, the phone is going on sale in India today. Deliveries are likely to be slow or delayed in most parts of the country.

As far as offers are concerned, there is Rs 10,000 cashback when you purchase the Motorola Razr using Citibank credit and debit cards. 

Motorola Razr specs

The Motorola Razr comes with a clamshell design similar to the original Razr. It offers a 6.2-inch pOLED primary 21:9 display when unfolded. It has a 2,142 x 876 pixels resolution with a notch cutout on the top. When folded, the Razr offers a 2.7-inch OLED display on the front.

The second screen can be used to quickly glance through the notifications. It is also touch-enabled and allows you to see, respond, and move on. The handset lacks the 3.5mm headphone jack and therefore comes with Type-C Razr earbuds in the box. 

Under the hood, it is powered by an octa-core Qualcomm Snapdragon 710 processor and Adreno 616 GPU. It is packed with 6GB RAM and 128GB internal storage. To power all the internals, it houses a 2510 mAh that supports 15W TurboPower via Type-C. The fingerprint scanner is present at the front of the device and can be used even when the phone is folded.

The Motorola Razr sports a 16MP rear with ToF 3D depth sensor, dual-LED flash, and gyroscope-based EIS. There is a 5MP front camera with f/2.0 aperture. The device is running on Android 9 Pie and is also splash-proof with water-resistant nanocoating. 

Other features of the device include bottom-firing speaker, Dual SIM, 4G VoLTE, Bluetooth 5, 802.11 a/b/g/n/ac, Wi-Fi 2.4 + 5GHz, and A-GPS, LTEPP, SUPL, GLONASS, Galileo for navigation. 

TechRadar – All the latest technology news

Read More

Vodafone Australia finally launches its 5G network, will offer 5G roaming overseas

Living vicariously through the old adage of 'better late than never', Vodafone has finally fired up its 5G network in Australia, with the telco switching on its first 5G sites today around Parramatta in Sydney's west.

Vodafone's 5G services will be progressively switched on from mid-2020 across parts of Sydney, Melbourne, Brisbane, Adelaide, Perth and Canberra, with 650 sites planned as part of the telco's first 5G rollout phase, and "thousands more on our roadmap over coming years," according to Vodafone CEO Iñaki Berroeta.

The best part of this announcement? Berroeta also revealed that “When 5G arrives to our customers with 5G devices, they will get 5G network access at no extra charge,” a prospect that should be very enticing to those looking for a reason to upgrade.

Additionally, Vodafone's AU$ 5 international roaming fee will soon extend to 5G, allowing the telco's customers to access super-fast mobile data while travelling in selected 5G-ready countries.

Along with the above announcements, Vodafone Australia also revealed that it will be selling its first 5G enabled devices, namely Samsung's Galaxy S20 range, both in-store and online from tomorrow.

TechRadar – All the latest technology news

Read More