Story image

Opinion: Router security leaving major cyber exposure gap

02 Nov 18

Article by Tenable A/NZ country manager Bede Hackney

The security of networked devices is often an afterthought as organisations and consumers embrace IoT devices.

A testament to the importance of securing some of these less obvious, but highly risky, attack surfaces has been demonstrated over the past year with hackers exploiting a security flaw in 200,000 MikroTik routers, allowing them to mine cryptocurrency, as well as the VPNFilter malware campaign that targeted MikroTik routers, allowing cybercriminals to run code remotely.

Tenable Research recently revealed that it discovered several vulnerabilities in RouterOS, a proprietary operating system (OS) used in MikroTik routers, that holds the potential to expose hundreds of thousands of devices.

At the most critical level of these vulnerabilities, attackers can potentially gain full system access allowing them to modify and eavesdrop on network traffic.

This is particularly concerning when looking beyond the individual attacks to the broader impact.

Exploiting this router vulnerability could give attackers the power to access a victim’s entire internal network.

When users step up and secure their personal networks, they’re more likely to pay attention to the security of laptops and mobile devices, those considered to directly hold personal and valuable data, than looking to routers.

Hardware is frequently tossed to one side upon installation and left to fester without security updates, leaving them exposed to outside threats and easy to manipulate.

The reality of modern computing is that every single piece of technology — from software to hardware — can broaden the cyber exposure gap.

Routers are easily exploited by hackers because they’re often left insecure by a lack of basic cyber hygiene.

Unfortunately, home and corporate routers alike are rarely patched, meaning the door is left wide open for cybercriminals.

On an individual level, the consequences could be tragic, such as lost or exposed personal data.

When it comes to the corporate world, the consequences could be business-critical, such as compromised customer data.

CISOs and business leaders need visibility into their entire attack surface - including overlooked devices like routers and IoT devices.

Royole's FlexPai: So bendable phablets are a reality now
A US-based firm called Royole is delivering on that age-old problem of not being able to fold up your devices (who hasn't ever wished they could fold their phone up...)
Hands-on review: Having fun in Knowledge is Power: Decades and Chimparty
They don’t revolutionise social video gaming, but they are enjoyable enough to occupy you during a wet weekend. 
Kiwis losing $24.7mil to scam calls every year
The losses are almost five times higher compared to the same period last year, from reported losses alone.
Tile's Mate & Pro Bluetooth trackers land in NZ
If your car keys (or your tablet) have disappeared into the void at the back of the couch or if you left them somewhere in your car, retracing your steps to find them could be a thing of the past.
Government still stuck in the past? Not on GovTech's watch
What exactly is GovTech and what’s been happening in our capital city?
"Is this for real?" The reality of fraud against New Zealanders
Is this for real? More often than not these days it can be hard to tell, and it’s okay to be a bit suspicious, especially when it comes to fraud.
Hands-on review: The iPhone Xs
The iPhone Xs is a win that brought numerous new and exciting features to the market.
How much does your Amazon Prime Video subscription really get you?
For our NZ$8.90 per month, the average cost per title is US$0.00126 - but we only really get a choice of 416 TV shows and 4321 movies. Choice is a little bit limited compared to other countries.