HNAP Protocol Vulnerabilities - Pushing The "Easy" Button

Ease and Security Don't Mix

In the eternal quest to create easy ways for systems to communicate with people and other systems, embedded device manufacturers have created new protocols. One of the first was UPnP, or Universal Plug and Play, which has had its share of security problems. The latest protocol to emerge is called HNAP, or Home Network Administration Protocol. Its goal is to "allow advanced programmatic configuration and management by remote entities." The protocols primary purpose is to aid device manufacturers in supporting remote devices such as printers and wireless routers. HNAP allows remote configurations to be both viewed and changed remotely using an HTTP SOAP-based protocol. While this sounds wonderful, someone decided to push the "easy" button:

"HNAP was designed to be a simple, light weight protocol that is easy to implement inside of small cost-constrained hardware such as network routers, cameras and other small devices. Because the protocol is based on existing HTTP-SOAP standards, it is very flexible and easily extensible."

The first phrase that raises a red flag for security-minded people is "simple, light weight". This almost always means that in order to simplify the design to make it "light weight", the first thing to go is security. Further reading of the Cisco Systems whitepaper on HNAP reveals an entire section dedicated to "Protocol Security", which states:

"HNAP leverages the same simple security mechanism available in most consumer network devices today – BASIC authentication, defined in RFC 2617, located at http://www.ietf.org/rfc/rfc2617.txt. "

Really? Did they just use the term "BASIC authentication" in the "Protocol Security" section? While some level of authentication is good, it’s not a very high level (such a simple mechanism that calling it “security” is a stretch). One of the major problems with embedded device management protocols, such as SNMP and TELNET, is they use plaintext passwords. BASIC authentication relies on Base64 encoding, which is a way to encode data, not encrypt it. The implementation of this protocol continues along a beaten path of poor embedded systems security, that includes default usernames and passwords, HTTP-based management enabled by default instead of HTTPS and several major embedded systems vulnerabilities in widely deployed routers.

HNAP Vulnerabilities

HNAP contains interesting information about the system it is running on. Without authentication I was able to pull some example data. The router used in all of these examples is a WRT310N version 1.0 running Linksys Firmware 1.0.09. First, I used a browser to load the default HNAP page (http:///HNAP1/):

The information above was obtained without specifying credentials and reveals the router model and version as well as the version and build of the firmware. Further investigation into the text on this page revealed:

The above values in the "URL" tags represent pages that should only be accessible with proper authentication. Disclosing the existence of those pages makes it easy for attackers to automate the discovery of authentication bypass vulnerabilities that have been disclosed on Linksys routers in the past.

On my particular router, I was unable to find a way to disable HNAP!

Finding HNAP in Your Network

The Tenable research team has created a couple of different plugins to help identify devices on the network that support HNAP. The plugin simply detects the presence of HNAP on a port:

You can use this plugin on your network to identify devices supporting this protocol and determine how much information can be gathered from them.

References

Home Network Administration Protocol (HNAP) Whitepaper
Dlink router with HNAP vulnerability
D-Link Routers: One Hack to Own Them All
Scanning Embedded Systems In The Enterprise With Nessus