Old D-Link routers come with backdoor?

It is the “embedded device hacking” blogg devttys0.com that has found out that a backdoor exists in some of the older D-Link routers which allows a user to access the router without any password challenge and also change device settings.

The blogg post is worth reading as it is an interesting look into how someone can hack and deconstruct the software and find out how things “tick”. In this case they figured out that if the user-agent is set to the string “xmlset_roodkcableoj28840ybtide” (remove the numbers and reverse and you get: edit by joel backdoor) then the login and authorization check is actually bypassed and you get right into the router.

In other words, if your browser’s user agent string is “xmlset_roodkcableoj28840ybtide” (no quotes), you can access the web interface without any authentication and view/change the device settings …

The routers affected are mostly older models:

• DIR-100
• DI-524
• DI-524UP
• DI-604S
• DI-604UP
• DI-604+
• TM-G5240
• Planex BRL-04UR
• Planex BRL-04CW

An update to the blogg post seems to suggest that this might not be a NSA-type of backdoor (meaning someone installed it to get in and snoop on people) but a lazy way to let some program/services change settings without having to get the users username/password. Still, not a good idea to put in such a backdoor as someone will in the end find it and post it on the internet.

Source: devttys0.com