A bug in Wi-Fi ‘extenders’ could give a hacker full control over the devices

The vulnerability in a piece of TP-Link gear is just the latest bug to be found in popular home networking equipment.

If you’re looking to strengthen the Wi-Fi signal in your home or business, be sure the equipment you use doesn’t have a vulnerability that could give free rein to hackers.

IBM X-Force researcher Grzegorz Wypych has found such a firmware flaw, one that would let an attacker execute code remotely without having to log into the wireless device. The vulnerability is in an “extender” — a piece of gear used to expand Wi-Fi coverage — made by networking company TP-Link Technologies. Often available for cheap through electronics retailers, Wi-Fi extenders are used in homes and small businesses to boost connectivity. But, as Wypych pointed out, the extenders can also make their way into larger businesses looking for easy internet access for employees.

The research is another reminder that internet of things (IoT) devices, although prized for their convenience, can come with big security risks.

Wypych found that by altering an HTTP request to an extender, a hacker could remotely execute any shell command on the device. The entire device would be at the mercy of the attacker because the processes running on it all include “root-level access” to the device, he said. In terms of impact, the attacker could, for example, conscript the compromised device into a botnet.

“Running as root by default is quite risky because anyone who may compromise the device could perform any action on it,” Wypych wrote in a blog post Tuesday.

The vulnerability is just the latest bug to be found in popular home networking equipment. Last year, the cybersecurity industry came to appreciate how attackers could abuse home internet routers at scale with the discovery of the malware VPNFilter, reportedly authored by Russia-backed hackers, which infected half a million devices in 2018 before U.S. officials disrupted the botnet. And this past April, cybersecurity company Tenable published a warning about vulnerabilities in Verizon Fios routers that, if exploited, could allow a hacker full control of a wireless home network and access to devices connected to them.

The insecurity of IoT devices has been a concern for policymakers for some time. A report issued last May by the departments of Commerce and Homeland Security warned that IoT vendors do not have the cost incentives to build more security into their products. Lawmakers are trying to correct that perceived market failure. A bill approved by the House Oversight and Reform Committee last week would require minimum security standards for IoT products sold to the government.

In terms of fixing the vulnerability in TP-Link Wi-Fi extenders, Wypych referred readers to the company’s website for firmware updates.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure