2023/05/04

Multiple vulnerabilities in Zyxel NBG-418N V2

As part of Fitsec's service offering our labs conduct device audits and research to find new vulnerabilities that might affect our customers. Fitsec's labs come across a wide variety of devices, ranging from consumer products to enterprise devices. In the past, these have included devices such as utility grid monitoring (electricity & water), routers, smartphones and even engine control units (ECU).


During December 2022 we had an internal training session where the objective was to find vulnerabilities in common IOT devices.

For this purpose we purchased a few units of Zyxel NBG-418N V2 home routers, as they were on the low-end in terms of price and features, which makes them popular for consumers and small businesses alike.

To begin with, we first dumped the firmware from the internal Macronix EEPROM chip. We reverse engineered the bootloader in order to gain access to the actual code that was being run in the device.



After dumping, UART connection was also established to capture logs.
We were able to discover 5 unique vulnerabilities in the target device:

  • XSS (Cross-site scripting) in the web management interface
  • Persistent XSS in the web management interface
  • Kernel stack overflows in the CLI (Command Line Interface) app
  • Kernel format string vulnerabilities
  • Denial of service condition (kernel crash and reboot)


The first issue was already known by Zyxel, but the other 4 were new vulnerabilities.

Based on our findings and reporting, Zyxel has released a firmware update and a security advisory. In case you have a vulnerable device in use, we recommend updating the device to the latest firmware.

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nbg-418n-v2-home-router

2023/05/01

LEAN 365 – grab the cyber security tips of April

During April we shared a total of 30 cyber security tips in LinkedInTwitter and Instagram.
Here is a compilation of the posts. Jump in together with Fitsec – and stay cyber safe!


91. It’s a good idea to password protect personal documents containing sensitive data

WHY? 

Even if your device is compromised, the data in these documents will be harder to access

92. Before giving away your phone, do a factory reset

WHY? 

A factory reset erases all your information from the device

93. Don’t use your car’s audio system for sensitive phone calls

WHY? 

In most cases the audio can easily be heard outside the car 

94. Never connect your own device to your organization’s network without approval

WHY? 

Your device may compromise the safety of the network and your company

95. Disable auto filling your account details on any websites

WHY? 

If your device is compromised, the attacker will automatically have access to your accounts

96. Beware of scams during major holidays

WHY? 

It’s common to offer “special deals” during major holidays, make sure that the offers are legitimate

97. On Windows machines, make sure Autorun/Autoplay features for media are turned off

WHY? 

It prevents external media infected with malicious code from being automatically executed

98. Make sure your Wi-Fi has strong password protection

WHY? 

Having a weak password on your Wi-Fi network makes it easier to attack

99. Install apps on your phone only from official sources (Google Play, Apple Store etc.)

WHY? 

Apps from official sources have been verified and are usually safe

100. If your printer supports secure printing, use it

WHY? 

Secure printing requires you to be present at the printer, thus making sure that no one can see your documents

101. Don't use passwords that contain your personal information, like date of birth

WHY? 

This makes your password easier to guess and your account more vulnerable

102. Don’t share your property information on the internet

WHY? 

Sharing your cabins etc. location or other information is not recommended and can lead to theft of your property etc.

103. Use a credit card for online purchases

WHY? 

If you get scammed, you can dispute the charge and get your money back

104. Don’t use admin account for everyday tasks

WHY? 

Using a regular user account will give less privileges to a possible attacker

105. Don't store sensitive data in the cloud; keep it entirely disconnected from the web

WHY? 

Keeping your sensitive data offline and requiring physical access keeps your data safe

106. If your device has a webcam, use a privacy cover. A piece of tape works just fine.

WHY? 

On some occasions, the webcam may be activated without an indicator light

107. Only connect with people you know on LinkedIn

WHY? 

In addition to giving more information about yourself to strangers, criminals have been known to use this extra information to attack other people as well

108. Exercise your right to be forgotten

WHY? 

Online services and companies in general, may otherwise retain your data indefinitely

109. Shred your old bank and credit cards

WHY? 

This makes them unusable, and it is near impossible to gather any data from a well shred card

110. You should turn off Windows timeline from privacy settings

WHY? 

The Windows timeline/activity history has to keep a lot of information about you to work and sends this information to Microsoft by default, turning it off is an easy way to gain more privacy

111. When taking a screenshot on your device, always double-check the picture before sharing

WHY? 

Using a regular user account will give less privileges to a possible attacker

112. Don’t trust any popups on websites that claim you have malware and prompt you to download an antivirus or call a number

WHY? 

This is a common method to get you to download malicious software on your device

113. Think twice before trusting free apps

WHY? 

Non-governmental free apps often make their money by selling personal data. Avoid giving any permissions related to data access if a free app asks for it

114. Never access your email or accounts on a device that you don’t own

WHY? 

It helps to prevent account hijacking and prevents leaking your information to a third party

115. Try to read news about new cyber attacks/scams

WHY? 

This might inform you of new ways hackers could be attacking you and help to keep you safe

116. Disable background webapps from your browser settings

WHY? 

Some apps might keep running even when you close your browser. This setting prevents them from doing so.

117. Be careful when taking or sharing workplace photos

WHY? 

There might be something in the background that could reveal/leak information that is private

118. If you are an EU citizen you have the right to ask for all the data that a company has about you

WHY? 

European union GDPR (General Data Protection Regulation) states that a person must get a copy of the data about them when asked

119. Periodically check which devices are logged into your account if the service has such an option

WHY? 

If there is a new device that you don't recognize, your account may have been compromised

120. Make sure your phone is always locked when you are not using it

WHY? 

It helps to protect your data in case your phone gets stolen