Most routers used at home have a “guest network” feature nowadays, providing friends, visitors and contractors the option to get online without (seemingly) giving them access to a core home network. Unfortunately, a new report from researchers at Israel’s Ben-Gurion University of the Negev has now suggested that enabling such guest networks introduces a critical security vulnerability.
The advice from the researchers is to disable any guest networks—if you must have multiple networks at home, they warn, use separate hardware devices.
The implication isn’t that your plumber or telephone engineer might be in the employ of Iranian hackers, so don’t let them online—it is that the architecture of the router has a core vulnerability, one that enables contamination between its secure and less secure networks. The issue is more likely to hit through a printer or IoT device that has basic in-house access, but which you don’t think has access to the internet.
Because there is this contamination within the router itself, an attack on either network could open the other network to data leaks or the planting of a malicious hack. This means an attack on a poorly secured guest network would allow data to be harvested from the core network and delivered to a threat actor over the internet. None of which would be caught by the software-based defensive solutions in place.
The research team exposed the vulnerability by “overcoming” the logical network isolation between the two different networks “using specially-crafted network traffic.” In this way, it was possible to make the channels “leak data between the host network and the guest network,” and the report warns that an attack is possible even where an attacker “has very limited permissions on the infected device, and even an iframe hosting malicious JavaScript code can be used for this purpose.”
The methods did not enable the researchers to pull large amounts of device, but did break the security system and open the door. A targeted attack might only be looking for certain data, medical information or credentials for example. The vulnerability enables such an attack even where a guest network is not connected to the internet, but might have internal-only connectivity, the attack would then jump the fence and provide data to the outside actor.
What this means in practice is overloading the router such that it falls back on its covert internal architecture in an attempt to measure and manage its own performance. “Blocking this form of data transfer is more difficult, since it may require architectural changes to the router.” The researchers claim shared hardware resources must be made available to both networks for the router to function.
The same issue impacts businesses operating multiple networks without physical network separation—but organisational network security introduces other vulnerabilities around numbers of sign-ons and different levels of sensitivity. Air-gaps and access point control is on a different level to what is being reported here. But with almost all popular routers now offering the convenience of guest networks and with the researchers warning that “all of the routers surveyed—regardless of brand or price point—were vulnerable to at least some cross-network communication,” this is an issue that should concern home users first and foremost.
And while software tools can be deployed to plug some of the gaps uncovered, the researchers believe that to close the vulnerability without shutting down the functionality would require “a hardware-based solution—guaranteeing isolation between secure and non-secure network devices.” There is simply no way to guarantee security without hardware separation of the different networks.
As billions of new IoT devices are bought and connected, the levels of security in our homes and businesses becomes more critical and more difficult to manage. The bottom line here is that even providing restricted access to an IoT devices that might not seem to have any external connectivity could still allow that device to attack the core host network. And given that most of those IoT devices will be connected and forgotten and—dare I say it—made in China, that is an exposure.
The vendors of the tested hardware have been informed of the research findings—we await to see if any changes follow.
In the meantime, is your guest network under attack from foreign or domestic agents—should you panic and pull the plug? Of course not. But there is a vulnerability—it’s real and it has been tested and reported. The software-based network isolation used by your router, simply put, is not bulletproof and it should be. And so the advice is the same as it would be anyway—give some thought to whether a guest network is needed and to what devices and which people connect to your system.