A Router is often the last contact device in a network, that connects the entire network to external networks and the Internet. If the router is somehow compromised, it is easy to compromise all the devices – computers, printers, scanners and even smartphones – connected to it. The Misfortune Cookie has made around 12 million routers vulnerable, in 189 countries, since 2005 and patching it is difficult process, as there are many manufactures involved. This article explains what is the misfortune cookie syndrome and then compiles a list of affected router brands.
What is Misfortune Cookie vulnerability
According to CheckPoint,
“Misfortune cookie vulnerability is a critical vulnerability that allows a cyber criminal to take over a gateway remotely and use it to compromise all devices interconnected to that gateway.”
Further, the Checkpoint researchers say that the vulnerability is present on millions of devices all over the world – from different manufacturers and from different brands. The Misfortune Cookie allows any intruder to take over any network easily by using the vulnerability. It also says that exploits are already available in the deep Internet and people are actively using them for their own gains.
To date over 12 million devices have been detected as carrying this vulnerability!
Why name it Misfortune Cookie
In simple words, since it the vulnerability is based on a HTTP cookie and brings misfortune to the device owner, it is named Misfortune cookie in lines of fortune cookies.
To be more technical, Misfortune cookie is because of a fault in HTTP cookie management mechanism in the router/gateway software. This allows criminals to determine the vulnerability of connection request by sending different cookies to the gateway or the router. In most networks, the router is the gateway and hence the Checkpoint employs the word “gateway”.
“Attackers can send specially crafted HTTP cookies that exploit the vulnerability to corrupt memory and alter the application state. This, in effect, can trick the attacked device to treat the current session with administrative privileges – to the misfortune of the device owner.”
Is your Router affected by Misfortune Cookie?
The Misfortune cookie has affected many routers or other type of gateways that contain a certain type of software. This software, Rompager from AllegroSoft, is used by different manufacturers in building routers and hence the vulnerable devices are spread all over the world. The Rompager is embedded into the firmware of routers. The vulnerability has been present since 2005 and despite patches by Allegrosoft, many devices are still vulnerable as people (users) do not know of this vulnerability.
You have been compromised if you cannot get to the configuration page of the router. There are no other methods to identify if you have been affected. To know if you are vulnerable, check out the list of Misfortune Cookie Vulnerable Devices, towards the end of this post.
Protection & prevention against Misfortune Cookie
There is not much you can do on your own. You have to ask your vendor for a patch and then flash your firmware with the patched firmware. However, this is not much practical as many vendors have not created patches as yet, though the vulnerability is present from 2005 or prior.
Checkpoint asks you to use an exceptionally good firewall that may reduce your chances of being compromised. However, I do not understand how a firewall would prevent an intruder if he or she has already compromised your network gateway (router).
In short, you have to wait a little longer to get a patch from your vendor. Though Allegrosoft has issued both security advisory and patch, the vendors have been shipping vulnerable devices. This is a serious problem as you have to wait till the vendors issue the patch to its customers.
List of Misfortune Cookie Vulnerable Devices
The above is not a comprehensive list of affected devices. Until a patch is available, turn on both the router firewall while having a software firewall as well. Though the article explains what is misfortune cookie and lists some of the vulnerable devices, I could not come up with a proper method to keep yourself safe, except waiting for the patch by your vendor.
Reference:
CheckPointtwc
