Thread: Do not upgrade D-Link new "CAPTCHA supported Firmware"

D-Link Wireless Routers with New 'Security Feature' Are susceptible to Network Intrusion'


Well, D-Link has caught on with their latest router range which boasts Captcha-capability built-in, hoping to prevent more attacks from malware and spyware. The new firmware also works great with current models, where the familiar distorted letters and numbers combination are added to common router settings pages. The D-Link router models that feature CAPTCHA include the DIR-615, DIR-625, DIR-628, DIR-655, DIR-825, DIR-855, DIR-685 and DGL-4500.

Source: D-Link CAPTCHA-enabled Router

DO NOT UPGRADE FIRMWARE

lks at the SourceSec Security Research blog showed how the upgrade could be manipulated to steal a WPA (or Wi-Fi protected access) password without even bothering to solve the test. That’s because the new firmware logs in using a GET request containing a salted MD5 hash of the password, along with with input that’s unique to the CAPTHCHA image. It turns out all that’s required to access the router’s setup page is the hash, so the feature provides an easy way for anyone within range to access the panel that controls all kinds of sensitive settings and contains the WPA password.


Source: D-Link Wireless Routers With New ‘Security Feature’ Are Susceptible To Network Intrusion | CyberInsecure.com

Thanks for sharing