Story image

Opinion: Router security leaving major cyber exposure gap

02 Nov 18

Article by Tenable A/NZ country manager Bede Hackney

The security of networked devices is often an afterthought as organisations and consumers embrace IoT devices.

A testament to the importance of securing some of these less obvious, but highly risky, attack surfaces has been demonstrated over the past year with hackers exploiting a security flaw in 200,000 MikroTik routers, allowing them to mine cryptocurrency, as well as the VPNFilter malware campaign that targeted MikroTik routers, allowing cybercriminals to run code remotely.

Tenable Research recently revealed that it discovered several vulnerabilities in RouterOS, a proprietary operating system (OS) used in MikroTik routers, that holds the potential to expose hundreds of thousands of devices.

At the most critical level of these vulnerabilities, attackers can potentially gain full system access allowing them to modify and eavesdrop on network traffic.

This is particularly concerning when looking beyond the individual attacks to the broader impact.

Exploiting this router vulnerability could give attackers the power to access a victim’s entire internal network.

When users step up and secure their personal networks, they’re more likely to pay attention to the security of laptops and mobile devices, those considered to directly hold personal and valuable data, than looking to routers.

Hardware is frequently tossed to one side upon installation and left to fester without security updates, leaving them exposed to outside threats and easy to manipulate.

The reality of modern computing is that every single piece of technology — from software to hardware — can broaden the cyber exposure gap.

Routers are easily exploited by hackers because they’re often left insecure by a lack of basic cyber hygiene.

Unfortunately, home and corporate routers alike are rarely patched, meaning the door is left wide open for cybercriminals.

On an individual level, the consequences could be tragic, such as lost or exposed personal data.

When it comes to the corporate world, the consequences could be business-critical, such as compromised customer data.

CISOs and business leaders need visibility into their entire attack surface - including overlooked devices like routers and IoT devices.

Kiwis concerned about being scammed – survey
This unease is warranted given the growing sophistication of scammers and their activities, and numbers of attempted fraud.
With a mighty roar, Rocket Lab blasts off to space
Success! It definitely was business time for Rocket Lab yesterday as its Electron launch vehicle blasted off from the Māhia Peninsula yesterday (November 11).
Trust us, we’re Nvidia: GeForce RTX 20-series GPU preview
When I caught up with Brian Burke, Nvidia’s gaming tech PR guy, at PAX AUS in Melbourne, I didn’t hold back. I asked him why should Kiwis part with such a huge amount of money for something that, right now, doesn’t do a lot.
Xiaomi fans bubble over at Mi Store grand opening
The fans filled Auckland’s Westfield Sylvia Park to take advantage of the opening specials and get their hands on some Xiaomi tech.
Hola, Ola! NZ's newest ridesharing service comes to town
Ridesharing service Ola is now live and active in Auckland, Wellington and Christchurch/
Hands-on review: TablePlus database management app for Mac
TablePlus is a new desktop application developed with the goal to make database management easier, faster, and more efficient.
OPPO R17 Pro a smartphone for photography lovers
OPPO has clearly seen the value of producing reasonably high-specced smartphone cameras: The R17 is staking its marketing claims on ‘redefining the limit of smartphone cameras’.
Hands-on review: The Tesla Model X P100D
Never have I been in a car which has been this much of a conversation starter. Almost everywhere we parked, I’d have people come up and ask questions about the Model X.