Ep 5: #ASUSGATE

A default username and password on network devices can pose a significant security risk. Kyle Lovett discovered that going through a simple routine check-up on his network router and protecting it from the most basic vulnerabilities eventually helped him avoid sharing his data with the entire world. Though as common as it might sound, a security check on routers should not be taken lightly, as it could be an open invitation for hackers to exploit vulnerabilities and gain access to personal information stored within the network. Routers hold the key to a person's private life, and securing them should be a top priority for everyone.

The Asus router has multiple security vulnerabilities, including clear text passwords in unprotected directories and default passwords which increases the risk of unauthorized access to user's files, network and VPN. The AI Cloud feature of the router exposes the password of the router to anyone on the internet. Therefore, anyone with this router has an insecure home network. It is important for users to change default passwords and enable authentication and encryption. Users need to stay informed about the latest security patches and updates to ensure the safety of their network. Employing penetration testing may help in identifying vulnerabilities before attackers do.

The Shodan website can identify vulnerable IPs with open ports, which can lead to issues such as unauthorized access and attacks on users. Kyle discovered that a high-end router had major security vulnerabilities that could be exploited to access over 100,000 private networks around the world. Zero-day vulnerabilities like these can be dangerous and can lead to hackers using the networks to carry out malicious activities. Kyle, being ethical and responsible, contacted Asus to report the issue, but the vendor failed to respond or release a fix for two months. It emphasizes the importance of prompt response and action by vendors to address security vulnerabilities for ensuring user privacy and safety.

Full disclosure of security vulnerabilities can be a double-edged sword. While it makes the customers aware of the potential threats, it also provides the keys to hackers. Independent researchers often resort to full disclosure when vendors do not take security vulnerabilities seriously. However, it can lead to legal threats and exploitation of the system. Asus took four months to respond to Kyle's emails reporting the security flaw, and it was only after public embarrassment via online disclosure that they took action. The security community debates the need for full disclosure versus partial disclosure, which is informing the customers about the vulnerability without providing too much detail.

Asus customers were vulnerable to a security issue where their hard drives and files were accessed by unwanted strangers due to a feature, not a security bug, and without a password. This act was not clearly criminal because there was no restriction for keeping people out. The feeling of being violated due to the unauthorized access to private files is unexplainable and horrible. The news of the hackers exploiting this security issue went viral, and Asus eventually fixed all the bugs reported by Kyle. These incidents highlight the importance of implementing secure features and restricting unauthorized access to personal files and data to protect individuals from being victimized.

Asus was found to have accessed customer data and mismanaged security issues, resulting in a case and settlement with the FTC. Orders were given to address the issues, including conducting security audits and publicly notifying customers of security updates. However, even years later, thousands of Asus routers remain unpatched and vulnerable, highlighting the ongoing issue of inadequate security measures and customer negligence. It is important for companies to prioritize cybersecurity and work with security researchers to address vulnerabilities. The Department of Homeland Security's US-CERT is a resource for such efforts. Despite progress, many vendors still need to improve their security mindset and testing processes to prevent further security breaches.