Recently identified guest network security issue(s)

[DartVadr]

Long time lurker on this forum, but first time poster. I really appreciate the knowledge and experience of the folks that frequent this forum!

I just read the article at the first link below and then decided to check out the associated web page and whitepaper. I'm no security expert, but it sounds like most/all wireless routers are likely vulnerable to "covert channel" attacks between their host and guest networks. I'm guessing that it won't be long until bad actors are actively exploiting the techniques identified in the paper.

Sounds like the router manufacturers that were contacted either aren't taking these vulnerabilities seriously or the issues aren't fixable. Posting this information for awareness and maybe a bit of discussion about what might be done to mitigate the issues within alternative firmware such as Asuswrt-Merlin.

https://techxplore.com/news/2019-08-router-guest-networks-lack-adequate.html
https://orenlab.sise.bgu.ac.il/p/CrossRouter
https://www.usenix.org/system/files/woot19-paper_ovadia.pdf

 

[RMerlin]

Some of these are non-issue, or have zero to do with guest networks, quite frankly. For instance, they complain that you can conduct a DoS attack by repeatedly attempting to connect over SSH, something that has nothing to do with the presence of a guest network, and something that some manufacturers already handle through throttling connection attempts...

In short: no, the sky isn't falling. And their tests were limited to only products from four manufacturers, at least two of them known for their general poor security. They didn't test any product from Netgear or Asus, and their most recent product tested is from 2017. So, "all the manufacturers we tested" is somewhat melodramatic.

 

[ColinTaylor]

So, "all the manufacturers we tested" is somewhat melodramatic.

Yes that was my thought as well. They only tested 7 "home" WiFi routers and in their introduction they say:

.....Based by this recommendation, the U.S. Department of Veterans’ Affairs created the Medical Device Isolation Architecture (MDIA) [1], which mandates the use of software-based mechanisms to isolate medical devices and restrict their traffic from entering the hospital’s network.

Quite frankly if you're attaching cheap "home" products with already questionable security to a hospital network you ought to be fired.

But apart from the potential for DoS attacks their main point is not to "hack into" the router or your network. As I understand it they are just creating a covert way of transferring data between two malicious devices, one on the guest network and the other on the non-guest network. So there is an assumption that your trusted LAN has already compromised by something that has the capability to collect sensitive information. This just provides a different path to exfiltrate that information rather than sending it directly to the internet.

All quite interesting from an academic perspective and potentially useful if you're an operative of the CIA or FSB sneaking into an enemy base, but not particularly relevant to your typical home user IMHO.

 

[RMerlin]

As I understand it they are just creating a covert way of transferring data between two malicious devices, one on the guest network and the other on the non-guest network.

That was also my impression. So it is more a white paper on the effectiveness of network isolation as implemented by these four vendors rather than real specific security issues (note that I didn't study ALL of their reported points, I gave up after reviewing two of them an determining they were non-issues).

Quite frankly if you're attaching cheap "home" products with already questionable security to a hospital network you ought to be fired.

Indeed - if security is a primary concern, then you shouldn't have one single device shared between private and public networks, but have separate APs, isolated through VLANs.

These SOHO routers are considered "good enough for home and small businesses", but I wouldn't trust them in a high-security environment, or a large 250+ employees company.

 

[DartVadr]

Appreciate the prompt responses. Seems as though the news article overstated the risks of the techniques outlined in the whitepaper. Sorry for the false alarm!

 

[RMerlin]

Sorry for the false alarm!

No problem. Security-minded discussions are always a positive thing, as long they don't fall in the paranoid conspiracy theory side of the fence. These white papers are often very hard to understand for the average user, as they are quite technical.