Heartbleed Strikes Again: Android Devices, Wi-Fi Routers Vulnerable

By Matt Paulson June 03, 2014

Just when you thought you've heard the last of the Heartbleed bug, it rears its ugly head again almost seven weeks later. As we learn more about the flaw that tricks servers into dumping recent user information to those devious enough to learn how, more vulnerabilities are arising. The most recent one, named Cupid by the Portuguese security researcher Luis Grangeia who discovered it, exploits local Wi-Fi signals to make an attack against what is essentially the same vulnerability. Despite the cute name, Cupid poses a significant security risk that must be identified and addressed immediately.

Instead of targeting remote computer servers over the Web in the way that Heartbleed originally struck, Cupid instead performs the same procedure by targeting Wi-Fi routers. Since Wi-Fi routers were never (knowingly) targeted by the Heartbleed bug, they never received the same protections. That means that any hacker with access to a Wi-Fi router can access every computer and mobile device connected to that network. Whether dealing with a private home Wi-Fi router or a large-scale enterprise router network, the bug has access and can have the router spit back data including passwords, usernames, account details and more.

What's worse is that there is no list that denotes which devices are safe from this kind of an attack. Grangeia has urged vendors and administrators to upgrade their routers to prevent these attacks, and he has posted the proof of concept in order to aid this process. He has also identified that the most vulnerable targets rely on EAP-based routers that require both an individual password and login, as hackers can easily gain that information and then explore the network at their leisure. Android devices running the 4.1.1 Jelly Bean OS are also vulnerable to the bug.

Thankfully, Grangeia says that the damage will be far more contained than the original Heartbleed leak. Hackers will have to physically travel to Wi-Fi networks to break into them, which is more difficult and time-consuming than simply accessing a server through the Internet. This will allow for plenty of time to upgrade routers before the problem becomes too widespread.


Edited by Rory J. Thompson

TechZone360 Contributing Writer

SHARE THIS ARTICLE
Related Articles

ITEXPO's IBM Keynoter: AI is Here Today

By: Paula Bernier    2/20/2018

Many folks think the artificial intelligence is something we'll see in the future. That's true. AI will be employed in a broader variety of more sophi…

Read More

The Blockchain Event Draws a Crowd

By: Paula Bernier    2/20/2018

The Blockchain Event in Fort Lauderdale draws a crowd, offers some answers, and raises lots of interesting questions. Why have some cryptocurrencies g…

Read More

Hughes: WAN Optimization Expertise, Homegrown Solution Differentiate SD-WAN

By: Paula Bernier    2/16/2018

The SD-WAN marketplace is a crowded one. But Hughes Network Systems says it brings unique expertise and proven technology to the table. And that, Jeff…

Read More

Juniper Security Expert: Behavior Analytics Helps Address Threat Complexity

By: Paula Bernier    2/16/2018

Organizations are changing their cybersecurity strategies, says Juniper Networks Cybersecurity Strategist Nick Bilogorskiy, who presented the closing …

Read More

Welbitz Wins ITEXPO's Idea SHOWCASE

By: Paula Bernier    2/16/2018

It was a sweep. Both the audience and the judges at ITEXPO's IDEA Showcase Thursday picked Welbitz as the winner. The company went up against fellow s…

Read More