Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Netgear Routers DoS UWisc Time Server

Posted by michael on Fri Aug 22, 2003 12:23 PM
from the RISKs-fodder dept.
numatrix writes "For the last few months, hundreds of thousands of netgear routers being sold had hardcoded values in their firmware for ntp synchronization, causing a major denial of service to the University of Wisconsin's network before it was filtered and eventually tracked down. Highlights how not to code embedded devices." A really excellent write-up of the incident.
+ -
story

Related Stories

[+] Technology: D-Link Firmware Abuses Open NTP Servers 567 comments
DES writes "FreeBSD developer and NTP buff Poul-Henning Kamp runs a stratum-1 NTP server specifically for the benefit of networks directly connected to the Danish Internet Exchange (DIX). Some time last fall, however, D-Link started including his server in a hardcoded list in their router firmware. Poul-Henning now estimates that between 75% and 90% of NTP traffic at his server originates from D-Link gear. After five months of fruitless negotiation with a D-Link lawyer (who alternately tried to threaten and bribe him), he has written an open letter to D-Link, hoping the resulting publicity will force D-Link to acknowledge the issue. There are obvious parallels to a previous story, though Netgear behaved far more responsibly at the time than D-Link seem to be."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • and now... (Score:5, Funny)

    by Anonymous Coward on Friday August 22 2003, @12:24PM (#6766611)
    slashdot has hard coded a link to the UWisc CS server, sending a DoS to them too

    oh, and fp.
  • by OneIsNotPrime (609963) on Friday August 22 2003, @12:24PM (#6766614)
    And we would have gotten away too, if it weren't for those meddling kids!
  • So who got fired? (Score:4, Interesting)

    by eln (21727) on Friday August 22 2003, @12:25PM (#6766622) Homepage
    Simple mistake that should have easily been found and fixed during the testing phase. I hope whoever let this thing be released without following proper testing procedures got canned.

    Yah right. Some hapless low level programmer probably got all the blame for putting test data in there in the first place.
    • by Cali Thalen (627449) on Friday August 22 2003, @12:46PM (#6766870) Homepage
      Simple mistake, sure. Barely a trickle of wasted bandwidth, hard to even believe it matters...

      Bah.

      This is one 'simple mistake' by one company that namaged to send a constant "250,000 packets-per-second (and over 150 megabits-per-second)".

      Now I know Netgear is a pretty big outfit, but there are LOTS of companies like that out there, and these little mistakes can add up. How much network traffic could be avoided with proper programming?

      Also, this kind of makes me think about the useless network activity my XP box (bleh) tries to send out. Multiply that by millions and millions, and you get a number a whole lot bigger than the one above.

      Who pays for all that wasted bandwidth?

      • by Malc (1751) on Friday August 22 2003, @02:25PM (#6767780)
        Not their first simple mistake though. Ask the people behind dyndns.org what they think of the Netgear RT314's (and other products like the RT311????) implementation of the dyndns.org client. Trust me, they have nothing nice to say.
    • by Dr. Blue (63477) on Friday August 22 2003, @01:34PM (#6767309)
      In the full description, you'll notice that they include the "strings" output from the netgear software, which includes hardcoded IP addresses.
      Netgear reported that the non-UW addresses were used for debugging by the developers.

      Here's the interesting part: at least two of those are 12.* addresses --- cablemodems with attbi.com. So if you want to know who the developer responsible is, it might be a reasonable guess it's whoever lives at those IP addresses! :-)

      • by NulDevice (186369) on Friday August 22 2003, @01:12PM (#6767111) Homepage
        Becasue it's not just a use of a public service, it's a complete abuse of a public service. It'd be like you damming up the colorado river for your own personal use and then telling LA to upgrade their water supply.

        This was a big screwup - when an NTP query fails, you don't start retrying every second until it comes back. You don't hardcode a single server address for it. And you don't put this in 700,000 pieces of released hardware.
  • Poor uWisc (Score:5, Funny)

    by mobiGeek (201274) on Friday August 22 2003, @12:25PM (#6766623)
    First the NTP flood.


    Now the /. effect.

  • by Hayzeus (596826) on Friday August 22 2003, @12:25PM (#6766627) Homepage
    Highlights how not to code embedded devices

    Or any other kind of software for that matter.

  • by eschasi (252157) on Friday August 22 2003, @12:26PM (#6766637)
    I did that to myself once. It was a piece of software that went to comp.sources.unix (or something similar) and was default-configured to send error mail to an alias that pointed to me. A patch was released very shortly afterwards.
  • by lightspawn (155347) on Friday August 22 2003, @12:26PM (#6766640) Homepage
    I'd just send the wrong time back to netgear routers. I bet they wouldn't try that again.
    • Alas, not true... (Score:5, Informative)

      by OmniGeek (72743) on Friday August 22 2003, @01:01PM (#6767016)
      The problem is, if one reads the article (nudge, nudge), that 1) at least some of the routers do this with NO operator interface or settability, and 2) some older routers would keep hitting the hardcoded server address even when configured to use some other address. Plus 3) there were some fixes that weren't. The routers in question accept ANY response, even if it isn't an NTP packet! Sending the wrong time would have zero impact. (Why does a home-network router need a clock so badly, anyway? It's not like they do useful remote logging or anything...)

      This is a case of ill-designed, badly written, poorly debugged, wretchedly tested code. The article details the testing of a code fix that still didn't fix things properly. On the bright side, Netgear is trying to Do The Right Thing now, and they deserve credit for that.
  • by ndogg (158021) <the.rhorn@[ ]il.com ['gma' in gap]> on Friday August 22 2003, @12:27PM (#6766654) Homepage Journal
    It's not nice to kick someone when they're down.
  • by BMonger (68213) on Friday August 22 2003, @12:27PM (#6766662)
    "Quick! Block port 80!"
  • by Jammer@CMH (117977) on Friday August 22 2003, @12:27PM (#6766666)
    Were this a Haxor attack, there would be criminal liability. I'm willing to believe that it was a simple mistake, with no criminal intent, but would NetGear be liable civilly?
    • by HBI (604924) <pelander@@@eyemud...com> on Friday August 22 2003, @12:39PM (#6766775) Homepage Journal
      Of course there is liability - liability means that 'is Party X responsible for the damage'. Netgear quite clearly was responsible for the damage. Even if they allege negligence on the part of their employee, it hardly matters: Netgear had a duty to assure that the software would not cause material harm to others. This is a classic product liability case, far as I can see.

      As for the damages, those are somewhat vague. Sure, maybe they could be made to pay for the bandwidth used. The big hit would probably be punitive damages unrelated to the actual loss.

      This would be a fun case and I would encourage them to sue. So many frivolous lawsuits floating around - this one would actually have some merit.
      • by barfomar (557172) on Friday August 22 2003, @01:03PM (#6767034)
        Rather than enrichen the lawyers, Netgear should just donate cash and appropriate equipment to the University.

        It would probably be deductable, passing some of the cost on to we taxpayers; but would sit alot better with public perceptions of the company.

        Set up a few CS scholarships or funding a chair at the University would help.

        They could turn it into a publicity coup and end up paying out less in the long run (and screw the lawyers too). Some (not all) insurance companies have finally discovered that it's usually cheaper to negotiate with the plaintiff right away, avoiding all of the sabre rattling and lopping off a third (or more) of the total probable cost.

        Litigation is rarely the best answer.

    • by seanadams.com (463190) * on Friday August 22 2003, @12:53PM (#6766924) Homepage
      They probably would be liable. What surprised me was that the article made no mention of the financial impact of the flood... are the guys who run the network so far removed from the guys who pay the bills that they have no idea, or do the universities get such sweet deals on bandwidth that it doesn't matter?

      I mean, we're talking 150+ Mbps here, for months on end. That's $15K/mo in bandwidth, assuming they have a really good deal and pay only $100/Mbps/mo.
    • by ShortSpecialBus (236232) on Friday August 22 2003, @12:55PM (#6766952) Homepage
      We are discussing several options with NetGear. I can't really go into them at the moment, but NetGear has been VERY cooperative throughout this whole thing.
  • by eaddict (148006) on Friday August 22 2003, @12:28PM (#6766669)
    to hardcode an address into thier systems? Do you need permission? There was a law a few years ago about 'deep-linking' and even linking... isn't getting the time somewhat the same thing?
  • by joeldg (518249) on Friday August 22 2003, @12:28PM (#6766673) Homepage
    Wow, that list of Analysis Tools used for tracking this down had a bunch that I was not familiar with.

    RRGrapher, FlowScan and Cflow being ones I have never messed with..

    Cool.. new tools to play with!

  • by ryanvm (247662) on Friday August 22 2003, @12:28PM (#6766679)
    I love the irony of trying to read an article about a DoS from a site that's experiencing one because of the article. Yummy.
  • by jefbed (666411) on Friday August 22 2003, @12:31PM (#6766706) Homepage
    It is foolish to code code dependencies on servers in firmware. There are two problems that result from this. The first is that specified in the article, the denial of service. The second is the high potential for broken network dependencies if, for example the hardcoded site goes offline or the ip address changes. Technically each site should be running their own ntpd to ease the load on the primary servers. ntp syncronization should not be the job of the router, but instead the job of the network administrator.
  • by sczimme (603413) on Friday August 22 2003, @12:36PM (#6766750)

    Highlights how not to code embedded devices

    I think this highlights a "how not to code" idea, period. In 1986, when I was taking a BASIC (boo, hiss) course in high school, I learned that values should be expressed as variables even if the coder does not expect them to change. So instead of using (32 feet/second^2), one should instead declare g once, using whatever units are appropriate, and thereafter refer to g instead of a hardcoded value. If g changes, the coder need only update one line.

    Note: I am not a programmer/coder/developer in any sense of any of the words, so technical nits should remain unpicked; however, if I am completely out in left field, please feel free to point that out.
    • by Bryan Ischo (893) * on Friday August 22 2003, @12:43PM (#6766829) Homepage
      Good point, but irrelevent. Even if you declare a global variable, you still have to hardcode its value. The fact that the IP address only showed up 1 time in their string search of the binary would indicate that they did exactly what you said.

      So you're not in left field, it's just that the developer who wrote the software apparently did exactly what you said, which was not relevent to the mistake at hand, which was more about the faulty implementation of the NTP service, and the fact that it was hardcoded to a single IP address.

    • by lightspawn (155347) on Friday August 22 2003, @12:44PM (#6766832) Homepage
      The (official) reason "Alien Front Online" (a game with the word "Online" in the title!) went offline less than a year after its release is that SEGA developers hard coded the server's IP address, and did not provide any means of changing it. When the company hosting the server went under (gameloft?) it couldn't be moved to a different company since it wouldn't have the same address. Hence, buy a game advertised as "online", never be able to play it online.

      It's not a new story, but I think it bears repeating as a showcase of stupidity.

    • by tommck (69750) on Friday August 22 2003, @12:44PM (#6766839) Homepage
      Of course if the gravitational constant changes, we've got bigger problems than updating your high school programming assignments! :-)

    • by jeffy124 (453342) on Friday August 22 2003, @12:56PM (#6766965) Homepage Journal
      that is indeed still the case today. This past spring I was a TA for a freshman programming course, and was instructed to deduct points for those who didnt follow such practices -- pi, hours/day, minutes/hour, etc. On exams, the prof would write "-5 - use of magic numbers."

      oh, and we laughed long and hard at the guy who put down:
      const int SIXTY = 60;
      const int TWENTY_FOUR = 24;
  • by Phil John (576633) <phil@w[ ]tarsltd.com ['ebs' in gap]> on Friday August 22 2003, @12:36PM (#6766751)
    IMHO, since this is blatantly a case of Netgear cocking up their appliance they should not only a)refund any monies spent by the university in this problem and b)send out patches, at their own cost, to all users of affected routers. For heavens sake, so many people don't have anti-virus software installed, don't patch, why would they with a router? They just think "I plug this in to my cable modem, plug my computer in and I dun got thar intarnet workun" why would they know that they need to upgrade the products firmware?
  • And then we got a ridiculous number of HTTP requests about the problem, which caused our server to explode and rain tiny bits of hazardous material into Lake Michigan. Fortunately, the indigenous wildlife was not affected, because nothing lives in Lake Michigan.
  • Simple Fix (Score:5, Funny)

    by Boss, Pointy Haired (537010) on Friday August 22 2003, @12:40PM (#6766795)
    UWisc hard codes the date/time on their time time server to 2038-19-01 03:14:00.

    After 6 seconds, the netgear will crash and burn as a result of the Y2K38 problem and the requests will be no more.
  • Think Strata (Score:5, Informative)

    by n9fzx (128488) on Friday August 22 2003, @12:40PM (#6766796) Homepage Journal
    Dave Mill's original clock distribution architecture ala NTP was based loosely on the Bell System's inverted tree structure. Only the top level servers are locked to the national servers; the next level is locked to the top level, and so on. In theory, it's a perfectly scalable infrastructure, with terrific fan-out.

    Unfortunately, the code droids seem to think that there's something magical about being at Stratum 2 instead of Stratum 3 or Stratum 4; also, they seem perfectly willing to take advantage of a nonprofit consortium (the owners/operators of public Strat 1 clocks) instead of spending the $500 or so on hardware to service their own customers, who presumably paid them for something.

    Anyone else remember the Good Old Days when it was considered polite to ask first before using someone else's clock?

    [Truechiming since 1987...]

  • I can't get to the article, so in the meantime, here's the text of an email about this with some details that was sent to an ntp.org mailing list back in June:

    David L. Mills wrote on 2003-06-26 10:55:

    > Guys,
    >
    > I find myself on the review team for an incident taking place at U Wisconsin/Madison. Apparently, the Netgear folks have manufactured some 700,000 routers with embedded SNTP clients configured to use the public U Wisconsin NTP server. The server address is unchangeable and the client cannot be disabled. If that isn't bad enough, if the client gets no replies, it starts sending packets at one-second intervals until forever and without backoff.
    >
    > The U Wisconsin folks determined some 285,000 different IP addresses are now sending between 300 and 700 packets per second requiring between 150 and 400 megabits per second. Apparently, the principal eason for this flux is misconfiguration of the firewall component of the router. This is costing them $266 per day.
    >
    > The Netgear folks were slow to respond until U Wisconsin folks emailed the entire senior management and others known to be U Wisconsin alum. Netgear says they have no way to recall those routers and no way to insure the products are updated from the web site. The products cost between $20 and $40 depending on rebate.
    >
    > U Wisconsin have considered several ways to deflect the tide, the most promising may be noting the source port 23457 unique to these products and tossing them at the doorstep. The products do not use DNS and are not configurable. Another way considered is to configure a subnet visible to BGP and convince the ISPs to punch holes in the routing fabric. Send money.
    >
    > I never thought it could get as bad as that. My reasoned recommendation was to fire up the lawyers and sue the bastards for costs and punitive damages and to injoin the company from selling any products until proved safe. There is apparently some standards group that allegedly reviews and certifies new products for Internet use. The Netgear products were all certified, which surely says nothing about the standards group.
    >
    > Include me in any replies; I am not on any ntp.org list.
    >
    > Dave
  • Poor UWisc (Score:5, Funny)

    by EmagGeek (574360) <[eric.hidle] [at] [gmail.com]> on Friday August 22 2003, @12:46PM (#6766867) Homepage Journal
    First the time server

    Then the e-mail server (from the helpdesk requests)

    Then the webserver (from /.)

    What next?
  • by Anonymous Coward on Friday August 22 2003, @12:51PM (#6766911)
    This didn't only generate trouble for U of Wisconsin, it also generated a lot of cost for some people using the router. Since the server was down, the Firmware has been trying to connect to the time server constantly, thereby keeping the connection from timing out. (Who wrote that algorithm?) For people whos connections are on metered internet access, this ment the connnection was never closed and they are stuck with the bill.

    Aparently there are a lot of Netgear users in Germany who are stuck with horrendous bills now. I wonder if Netgear is going to pick those bills up?
  • Spytime (Score:4, Insightful)

    by aero6dof (415422) <aero6dof@yahoo.com> on Friday August 22 2003, @01:03PM (#6767036) Homepage
    Now if NetGear had coded it to their own NTP server it might have been a nice method to estimate how many products you have deployed on the open internet. Of course, Slashdot might then have complained about the company spying on its users. :)
  • Someone on the coding team at Netgear needs to be taken outside and shot; they never seem to learn their lesson about abusing other people's services.

    Story:
    I used to work/volunteer for DynDNS.org. The Netgear firmware client for DynDNS tried to update regularly (I believe every 5 minutes) whether or not the IP address had actually changed AND whether or not it got a response. Once enough of these got out into the market, this became quite a problem for DynDNS, especially with users complaining that we "blocked" their hostnames updated with the Netgear client when their router advertised specifically that it worked with our service.

    I believe after a year or so of nagging the Netgear people, they finally released a firmware update that actually fixed the problem.
  • by SamMichaels (213605) on Friday August 22 2003, @02:48PM (#6768037)
    Seriously. THANK YOU for not filing law suits, hiring the FBI, CIA, Marines, calling upon Patriot Act, etc.

    To Netgear, THANK YOU for not calling upon the DMCA, filing NDA law suits, etc.

    It was resolved in a diplomatic and professional manner...and the write up explaining the entire incident was educational and informative.

    Now, if it had been SCO or Microsoft involved......
  • by wacko-Netgear (700822) on Friday August 22 2003, @08:34PM (#6770429)
    First off i would like to disclaim that my views do not represent the company's views. With that said, I can say that I worked at Netgear for a short period of time in the area of support.

    This specific issues was raised back in may... I can say within that same week they had already started testing firmware to fix the issue. The issue comes with the huge break between Netgear engineers and Netgear support. Umm often times the supports reps do not know of the release of the product until like 2 days or 3 days after its already hit the market. On top of that there is very little communication between the two on firmware and whats the latest version. Its been only in the past couple weeks have they really started to communicate.

    Along with that Netgear did not have a device testing program until i would say about 3-4 months ago, before that it was just people there who had the time to test products... woudl test them. I know being one of those who has and still does test there products, that the communication is not very stable and that sometimes issues like these get short-cutted for other major issues such as security and hardware stability.

    I am also sure anyone in the hardware market understands the rush that sometimes comes with products; in netgear this is not different. I can this was an issue that was not expected and was fixed as soon as it was reported. It should have never gone out as is and the products should have been tested throughly in the consumer enviorment. But, to Netgear's credit the company does sell pretty good products and there customer support although you may not always be able to get your answer to the issue or may not be able to sometimes understand the reps any and all issues do esclate to people who can fix them. If you issues are not getting fixed at that point the president of the company does read your mail and does forward them to the Head of the customer support. I can say that issues like these will become less of a problem now that Netgear has started a beta program and engineers are required to speak to support engineers on a regualr basis
    • Re:Err why ? (Score:5, Insightful)

      by NetJunkie (56134) <jason@nash.gmail@com> on Friday August 22 2003, @12:34PM (#6766735)
      Logging. You want your log files to have the right time. I've used my router log files many times.
    • Re:Err why ? (Score:5, Interesting)

      by rusty0101 (565565) on Friday August 22 2003, @12:42PM (#6766821) Homepage Journal
      Routers tend to log activities such as access, configuration changes, firewall violation detection, etc. and it is often handy to know when that event occured.

      Home centric routers do not tend to have their clocks set before shipping as there is no assurance that a battery keeping that clock powered will be doing so ver the entire span of time from manufacture to customer plugging it in. Even if it did the drift involved would give some inaccuracy as well.

      There are two correct solutions. One is that Netgear should operate their own time server and hard code that server as a secondary or fallback time server. The primary time server should be aquired from the internet service provider when they get their network ip address via dhcp.

      -Rusty