Netgear Security & Privacy Breach Disclosure

In working on reporting a few bugs with a major Modem & Wifi Router, I came across a very serious Security & Privacy Breach that puts a consumer's private data out in open text and renders them in a seriously vulnerable state.

After some functional issues were reported to the Manufacturer’s Modem & Router support portal, I was asked to provide debug logs off the router using usual methods whilst you are within the LAN network (see below for instructions on how to generate and retrieve debug logs). It took me less than 3 days for the router to collect logs. At the end of it, it produced a zipped package containing many log files. Upon inspection, what I found left me completely stunned. Router Admin username & password, all 2.4G and 5G WiFi SSIDs and their passwords were sprinkled across the multiple files in clear text. Boy, I was glad I reviewed the debug logs (But, how many consumers actually do that?). There was no attempt to obfuscate this private data.

In addition, I was instructed by the support personnel to send the zip file over email (unencrypted, not instruction to password protect it) that is subject to a man in the middle attack, besides what’s to say a disgruntled employee having access to all debug logs containing admin passwords and WiFi credentials won’t take this data and release it out in the open quite easily.

Upon reporting this to the support, I was given canned responses. I provided them with fair warnings of going out to the media reporting this serious Security & Privacy breach that almost happened had it not been for my curiosity, but they cared less. So here I am, with this report. The Manufacturer is Netgear and the device in question is Nighthawk CAX80. And here is their response:

As stated from the email, this is part of the Data Collection Analytics and we're sincere apologize if this seems to be not quite good for you as you may see. Hence, we wish to inform you that even that admin passwords and also user name are being showed up from the debugs logs, NETGEAR Support are not allowed to copy nor duplicate those such information from our customers

Please be advised that our NETGEAR products are programmed to gather data collectively, and the intention is definitely not to acquire their passwords, it just happened that it is part of the analytics data. Technical data about the functioning and use of NETGEAR routers and their WiFi networks will help NETGEAR improve its products. This data collection will enable us to:

• Isolate and debug general technical issues,

• Improve router features and functionality,

• Improve the performance and usability of NETGEAR routers.

https://kb.netgear.com/000038665/What-is-router-analytics-data-collection-for-my-NETGEAR-router

The distillation of Netgear’s official stance is “Insider / Rouge Employee Threat” or “Man In the Middle Attack” is essentially out of scope and the vulnerability report was ignored.

As one may see from above, Netgear has refused to consider this as a bug in their design or even an unintentional collection of our private and sensitive information. Netgear assumes that this was intentional collection and that it is a normal practice to collect consumers' WiFi passwords.

Anyone that has a CAX80, must be aware to not collect debug files and send them to Netgear for any reason; their engineering will have access to all your wifi and admin passwords if you choose to do so, or if you have already done so in the past (please change your admin password & all your WiFi passwords).  I am currently exploring my legal options. 

Here is the method used to collect and retrieve logs off the Netgear Nighthawk CAX80 Modem-Router Unit:

1. Make sure you are logged in to the local WiFi or Ethernet hosted by the Nighthawk CAX80.
2. Open any web browser (I used Safari on a Mac) and type the following address - http://<Modem’s IP address - eg. 192.168.1.1>/debug.htm 
   
   
   
   
   
   
3. Hit enter
4. You will be asked to enter your admin and password for the router. Enter it and hit “Log In"
   
5. You will see the following screen. Hit “Start Capture” 
   
6. Here I spent around 2 days to allow for the logs to capture, then I hit the “Save Debug Log”. It takes a while for the log to download if allowed to collect for 2 days (One can simply allow a few seconds and still collect the logs). Hit the “Close” button, and the log file will be downloaded when done. 
   
7. You should see a zip file in your download location - “Debug_log.zip”
8. Un-zip and search for your admin passwords or your wifi passwords. You will find your admin password in UNPND.txt.0, and wifi passwords in wifi_vendor_hal.log / console.log / 5g_WIGetDriverStats.txt, 5g_WIGetDriverCfg.txt, 2g_WIGetDriverStats.txt, 2g_WIGetDriverCfg.txt files, all in clear text.

Here are some of the attacker profiles due to the two vulnerabilities:

1. Insider / Rouge Employee attack - A disgruntled employee can collect all the log files accessible to him/her and siphon out 1)Admin Passwords & 2)WiFi SSIDs and corresponding passwords from the debug logs and leak them out in the open.
2. Man In The Middle Attack - Debug logs emailed to Netgear unencrypted could be collected by an adversarial sniffer tool and 1)Admin Passwords & 2)WiFi SSIDs and corresponding passwords from the debug logs can be made available in the open.

I would like to thank all the reviewers who provided guidance during the responsible disclosure of this issue - Prabhu Jayanna, Sudhir Mathane & Florian Lukavsky / Julia Alunovic (our friends @ iot-inspector.com)

Raj Kapoor

Visit to Stanford

DEXA scan revealed Osteopenia, a progression towards Osteoporosis. But I am not too worried about it (yet). Pain in the right arm was gone by Saturday evening that day. It has been fairly quite since then with occasional pain but not lasting more than an hour or so. Visit to Stanfords was relieving. Dr. Utz stressed - once again - on the European regimen of usage of Cyclophophamide. They use 1.5 - 2.0 mg / kg of Cytoxan for 3 - 6 months and start tapering it withing the next 3 months adding Imuran to the list. It will be 1 year in April since I was started on Cytoxan. Prolonged use of Cytoxan can cause toxicity in the body that can lead to bladder, lymph nodes or bone marrow cancer. Need to get Shapiro to start tapering Cytoxan asap. We have an appt. with him today hoping to convince him...

Moving Along!!!

Who said life's fair? - So my trip to Helsinki was fun ... with Rajni and didi (Uma)... kids stayed at home with Senaka and Lalani (God bless them!). Labs have been fairly OK so far. Sugar levels were at 111 mg/dL, but that was w/o fasting. Dr. Moness ordered a cholestrol lab, that turned out to be on the high side, however the glucose was at 88mg/dL, well below the normal. I have been feeling pain all over my body lately when I sleep at night. Not quite sure what that is... Dr. Moness also ordered a dexa scan, results are not in yet. Have been feeling OK otherwise for the most part, however deep down there I feel something is not quite right. Noticed some blood traces in nasal discharge last night. This had completely subsided, but seems to have swung back. Flare? - dont really know. Still on 133mg of Cytoxan but only 9mg of Prednisone. As always taking one day at a time, and keeping my spirits high!

Merry Chritmas!

It's Christmas! Time to think back and thank the god for all that I have today, I have a lot to thank him for, thank him for what I would have lost or my family would have... I am blessed. Merry Christmas to all!

Yeah, it's been a while... things have improved a lot... a lot's happened between then and now. I am still on the "duo from hell" - cytoxan and prednisone. But I can't complain... Nose bleeds, seem to be resolving since a month or so but it continues to remind me I am not well and so does pulsating pain in the right lungs lobe. In the meanwhile a gram of solumedrol IV pulse continues on a monthly cadence, with the daily oral intake being tapered rapidly. Hearing remains impaired with lots of ringing as if I was just slapped a few seconds ago. Weight continues on the upwards trend, it being in the vicinity of 178lbs.

This disease has made me humble and I have learnt to respect it knowing how much of a damage it can inflict on you. BUT I AM GOING TO SNEAK BEHIND IT'S BACK & BEAT IT ONE DAY! :)

Herpes and Yeast infection now like a good friends never seem to leave me alone :) They flare up every once in a while. But that is OK... My fear of LFT's flaring up lingers, although they have been fairly quite for a while now. Dr. Low is happy that it is not chronic. He does not want to see me anymore. Phew! one done three to go. yeah! now that is positive...

So I was pulsed once again with 1g Solumedrol and that evening - Sat 26th Dec. (actually has been this way since about a week or so) for some reasons unknown my heart started racing, so much so I could not sleep. It was irritating... So I decided to slip out of the house to the ER. It was 1 am. The ER got the tests started right away, my BP was on the higher side and so was my heart rate. The ER doc. Dr. Goldberg explained that this could be due to several reasons, dehydration, blood clot in the lungs, thyroid malfunction etc. Blood work was normal, CT-Scan showed no clots in the lungs, EKG was normal. I was discharged with a diagnosis of Tachycardia-Nonspecific. Follow up was suggested.

I had a follow up with Dr. Moness and she suggested a lipid panel soon and if it comes back then we will do an Echocardiogram. Since I have again been infected with some virus or bacteria, I am back on Tamiflu and Azithromicin. Did I mention I was diagnosed with H1N1 a few weeks back? Swab tests were run. Let's see what the results would be.

Flying to Helsinki for a week on a biz trip toward the end of Jan. Will be taking some strong antibiotics along with me.

More on Dr. Shapiro's Visit

So, my last LFT study came out real good...

• AST (SGOT) - 33 [10 - 40]
• ALT (SGPT) - 132 [9 - 60]
• Alkaline Phosphatase - 75 [40 - 115]
• Bilirubin - 0.5 [0.2 - 1.2]
• Iron 440 [250-425 U/L]

I think if I draw my blood today the numbers are now probably in the exceptable range.

So, got into a bit of an argument with Dr. Shapiro, on Bactrim and how the declining LFT pattern did not follow discontinuing of Bactrim. I was blunt and so was Dr. Shapiro. I had corrected Dr. Shapiro before when he assumed that Cytoxan was discontinued after the LFTs had started dropping and not before it. He was much relieved to know that. This time around his analysis did not seem right either and i am a tad bit concerned. He said LFTs were in a declining pattern because of bactrim. How can that be? The data that I had suggested otherwise. I came back home and plotted a graph to convince my self. Here's it... (click on the picture to blow it up)

I will fax it to him...

Anyways the infusion was ordered and scheduled for the next day. I had bled during a sinus rinse right before the infusion, and none after it. The next morning i felt real peachy :). Felt a lot hyper, but that was the 1g prednisone doing that to me. I don't feel the head cold anymore either. Well so far so good... More for next when I have an update...

I had promised myself to update this blog regularly, but dang, no excuses for laziness, and here I am with some time in hand to cope up with my laziness.

So, some 3 months have passed since I came back from the hospital. Things have been a roller coster for me, as has been for all my fellow weggie people.

My Ottolaryngologist (fancy name for ENT) was very happy with my progress during my 1st month visit. He assured me that the hole in the TM of the left ear was resolving, my nasal passages looked much better. I had been using nasal saline spray to keep it hydrated and remove crusts, but bleeding persisted all this while. I suggested me to use Nasal Rinse, and boy it was a MIRACLE! Lots of thick crusts came out of my sinuses in the first few usages. How could I have survived without it. Here's a link for the interested - http://www.neilmed.com/usa/sinusrinse.php. Anyways I was happy with my visit to the ENT. I have been visiting the ENT on a monthly candence since then.

My next visit was to the Rheumatologist (Dr. Robert F. Shapiro), a real nice guy with a lot of experience in his field. So he decides to take over all the prescriptions, and have all the specialists report to him with my condition as they diagnose it each month. Well pretty straightforward.

I was on 125mg of Cytoxan and 60mg Prednisone (Doug from the WG discussion group calls it the duo from Hell - :)), and on my first visit to Dr. Karmakar (Pulmonologist) he tapered it to 40mg. Well this was before Dr. Shapiro had taken over my prescriptions. Yeh! Making some good progress...

I had started Yoga, and walking in the first month, followed by some jogging on uphills... I now jog about a mile every day and feel real good telling my lungs "who's the boss".

In a months time I developed rashes or something that appeared like rashes all over my bottom and immidiately saw my primary physicians who thought it might be Herpes and suggested I see a dermitologist. My Rheumatologist secured me an appointment with Dr. John Kasch, another real nice guy with tonnes of experience. He diagnosed it to Herpes Zoster (Shingles) at the back and Fungus infection at the groin area. Well medications started (Valtrex for antibiotics and a whole bunch of creams - hydrocortizone, econozole, triamnicinolone) and things started to improve in about a weeks time. Had a real hard time until things quitened down a bit. It is much better now, but I still continue with the medications (minnus the valtrex).

A note on Herpes Zoster:

"Shingles" results from reactivation of the virus that causes chicken pox (Varicella zoster). Nearly everyone who is now older than five had chickenpox at one time, generally as a child. Normally, even after the rash and other symptoms of chickenpox subside, the virus that caused the sickness continues to reside in the body in a dormant state, "hiding" in the root of one of the nerves somewhere along the spine. Decades later, as the immune system wanes slightly with age (a normal part of the aging process) or when the immune system is suppressed (by medications like cyclophosphamide), the virus becomes active again.

When it reactivates, Varicella zoster usually causes a painful rash in the distribution of a single nerve, such as over one side of the face or down one arm. The rash is characterized by groups of small vesicles (blisters) sitting on a base of reddened skin, and may be extremely painful. "Shingles" is treatable with anti-viral medicines such as Acyclovir or Famcyclovir. These should be instituted as soon as possible. Narcotic pain medicines may also be necessary for several weeks. In a small minority of cases, "shingles" results in pain that can last for months. This condition is called "post-herpetic neuralgia".

Two months down the road, the 2nd ENT appointment went quite well, with a Tympanometer reading suggesting that my TM was fixable via surgery if it failed to resolve naturally. Dr. Kearns was just not very keen on performing any surgery just yet, maybe September-ish timeframe, he says.

In the meanwhile (still at around 2 months) Dr. Karmakar informed me that my last CXR readings we very encouraging, with the nodules resolving and the patch that was about 7 cms is now about 4cms. Yes! something to celebrate... although I have been still bleeding through my nose, and I still feel head cold (kind of like stuffy feeling in the head), I take this as a positive sign of improvement.

June 11th 2009, Dr. Shapiro orders a bunch of tests that included Urinalyis, CMP, CBC, ESR, IgG, IgA, IgM, Urine Culture etc. I still had traces of protine and RBC in my urine, however the sed rate (ESR) had gone down to 2mm/h (another reason to celebrate!). Hepatic Panel was normal as well.

June 15 2009 Dr. Moness ordered a bunch of other tests TSH, Lipid Panel, CBC, VitB12, CMP, VitD, 25Hydroxy, LCMSMS, Urinalysis. To our surprize the liver enzymes had shot up the roof.

• AST (SGOT) - 250 [10 - 40]
• ALT (SGPT) - 896 [9 - 60]
• Alkaline Phosphatase - 147 [40 - 115]
• Bilirubin - 0.9 [0.2 - 1.2]

I was not really feeling anything as far as my body was concerned. Dr. Moness ordered a few other tests including acetamenophene, hepatitis, Alpha1 Antytripsin in addition to the LFTs. All but LFTs were negative. This had started to get get Dr. Shapiro and Monness worried. The LFT's peaked with AST at 1500s. I was now referred to Dr. Low (GI) who had suggested that it either may be due to Bactrim or a Viral.

• AST (SGOT) - 334 [10 - 40]
• ALT (SGPT) - 1510 [9 - 60]
• Alkaline Phosphatase - 191 [40 - 115]
• Bilirubin - 1.3 [0.2 - 1.2]

Dr. Shapiro feared it was due to the pulsing he ordered on June 18th not realizing that the LFTs started to rise on June 15th which was before the pulsing. Phew! he was much relieved :) Pulsing? 1000mg of solumedrol (prednisone on fire - as if it is not hell to begin with) over IV. this allows Dr. Shapiro to taper my daily intake of Prednisone by 5mg every month. My next one was scheduled for last weekend, but due to dental issues he suggested we take care of thagt first and watch for any infection for a week.

Anyways going back to the LFTs... So Dr. Low thinks it might be viral since I had been running around car dealerships between June 11th and 15th (the time of possible infection). June 25th 2009, LFT's started declining by a small bit. We started monotorin the LFTs daily, it was certainly in a declining pattern. Nevertheless Dr. Low ordered taking off the Bactrim of my regimen. Why? cuz it is a bad drug. Hmm! Now what about protecting me from PCP (Pneumocystis Carinii Pneumonia)? This is a serious infection mainly affects the lungs, but it can also affect other organs, including the skin. However, it's much better to avoid getting PCP in the first place. I will talk to Dr. Shapiro in my next visit (tomorrow). So finaly, the last lab reading (July 09 2009) was quite encouraging...

• AST (SGOT) - 41 [10 - 40]
• ALT (SGPT) - 292 [9 - 60]
• Alkaline Phosphatase - 113 [40 - 115]
• Bilirubin - 0.5 [0.2 - 1.2]

... still awaiting results from July 16th 2009. I will update the blog when I have them.

Fortunate to have a great family support and prayers from friends, I am now enjoying my two month of sabbatical from work.

A NEW LEASE OF LIFE !

BACKGROUND
I had been suffering from allergies from pollen, grass, weed, plants etc since about 6 years now (2009 as of this writing). It was almost a year round thing where I had to take OTC Loratadine and Pseudophedrine (combination of Claritin-D) once every day. Without this life was bad with breathing problems, scratchy eyes and what not. About a year or two back, I started noticing crusts in my nose that would bleed profusely upon removal. Of course I had no means to remove them than using my finger, without which my nose would remain blocked and I had to breathe through my mouth.
I travel a lot for work and also started noticing something was not right with my ears when I would take off and land in planes. The ears would have a hard time adjusting to the changes in pressure in the plane. But that was really not a huge problem. I noticed but had not complains.

TRIP TO INDIA
March 2009 I flew to India for my Dad’s CABG. On landing in Seoul my left ear got blocked and I could not adjust the pressure in the middle ear back to normal. It was terrible. With all the noise from the airport funneling from different directions into one ear, my brain was a perfect chaos, trying to decipher and distinguish the total cacophony. Anyways I took the next flight to Bombay and in the meanwhile the ear was still a mess. Luckily the TM did not burst. My eustachian tubes were clogged. In India I tried to self remedy the ear problem but in vain.
The next problem… Between home and hospitals I started feeling chills and fever (similar to two weeks before I left for India – but that lasted over the weekend only) and weak. I found a way to subside it – Combiflam (Ibubrufen – fever reducer and Paracetamol – pain killer). Life moved on. My sister who flew from New Jersey was right beside me noticing what I was going through. But things were still under control until this pain! Excruciating pain in my right side near my lower lung lobe. For a while I hoped it would be muscular but I could feel it was not. It would pain mostly in the nights when I would try to lie down to sleep. I tried to keep this to myself for a while, but had to open up as it was going nowhere.
I first started with the ENT who put me on antibiotics (Ezithromycin), next showed to a pulmonologist who initially suspected Pneumonia and asked me to continue Ezithromycin and ordered a CXR. As expected there was a patch in the lower right lobe of my lungs. A sigh of relief! A diagnosis was made and treatment was well in its way.
5 days in and no improvement. The antibiotics should have done the magic on Pneumonia. By this time my uncle (Gynacologist) suggested changing the antibiotics to Augmentine, and I did. Dr. Parag Mehta (Pulmonologist treating me) suggested a CT scan immediately. I was getting this bad feeling of something is not right. The CT scan of the lungs had not yet arrived but the Dr. alerted me to the possibilities of tumor.
By this time the mission for which me and my sister were in India was over. Dad’s CABG was a huge success and dad was back from the hospital, well on his way to recovery from the surgery. What a strong guy with an awesome will power! My sister was back in the US.
I updated my cousins in India of the situation and called up my sister and wife in the US. They freaked out. We all decided to pull in my flight back to the US immediately. My wife got me booked for the next available flight back to US. In the meanwhile Dr. Parag Mehta called me up with the CT scan results that suggested 7.5 cm x 4 x 3 cms size mass tumor which could be benign or malignant. The dr. suggested a biopsy immediately. By this time I was getting ready to get on to my flight back and we decided to conduct the rest of the tests in the US.

BACK TO THE US
My flight back was not pleasant. On takeoff from Seoul my left ear TM had ruptured. I was getting very weak. The plane with 400 passengers for 20 odd hours flight time, and the chances of me getting worse was high. By the time I landed in SFO I was pale, tired, exhausted and lifeless. My wife and kids came to receive me. That was the most pleasant sight after a long time. I drank some Gatorade, and rested at the airport for a little while before I came back to some senses. Two hours of driving time, and we were back. I took a quick shower and rested for a couple hours and we decided to hit the ER.

At the Folsom Mercy ER: The Folsom Mercy ER was not very chaotic. In about 15 mins I was assigned a bed. The ER doctor feared I may have generated blood clots during the long flights. So he first ordered a D-Dimer blood test that indicates any signs of clots. It came up positive. Scarry once again… Next, to determine if that was indeed the case we went for a CT scan, that proved otherwise. A sigh of relief! CT scan results matched results from the India CT scan suggesting the tumors. No clots! This was a Saturday. I was discharged with a suggestion to follow up with my Physician on Monday.
So we see Dr. Parween Moness the following Monday, who puts us on a broad antibiotic and refers us to Dr. Amit Karmakar (Pulmonologist). Dr. Amit suggested that we not do the biopsy just yet as I was on antibiotics and test results would get affected, besides it cannot possibly be cancer as I was having chills and fever. 5 days had passed by. No improvement. My shoulders started hurting. We consulted Dr. Amit again and he suggested getting admitted and would be easier for him to diagnose in an in-patient environment.
At the San Juan Mercy ER: We rushed to the ER at San Juan Mercy. It was very chaotic. Dr. Jennifer Buttler was assigned as the general physician to me at the hospital. Dr. Amit came by soon. We had ordered a CXR that indicated elevated levels of the effusion in the lungs. He performed Thoracocentesis which is a technique that allows the removal of an abnormal accumulation of fluid or air in the pleural space through a catheter or a needle, inserted percutaneously into the chest cavity to the pleural space. A 300ml liquid was extracted and sent to the lab. I was able to breathe a bit easier although through my mouth. I was still in the ER.
My sister was worried and flew down to California. My in-laws flew across from India. It was not pretty. Was is a tumor? Was still a question. By this time Dr. Buttler (reminds me of Dr. House) had established to doctor – patient connection with me. She and Dr. Amit were like a god sent angels, consoling me every time updating me of all the happenings, assuring me everything was going to be just fine. She had noticed a murmur in the heart soundings and coordinated cardiologist visits along with ENT. Morphine helped reduce the murmur to almost nil. Dr. Hemphill (always with a smile telling me I had a strong heart and had nothing to worry about) ordered an echo cardiogram, that revealed a good heart. That was very good to know.
CT assisted biopsy was performed and it would take around couple days for the results to come back. Right around that time (3 days in the hospital) Dr. Buttler came up to me informing that there could be a possibility of something called Vasculitis – Wegener’s Granulomatosis. A rare form of auto immune disorder where the immune system turns around and starts attacking your own organs. ANCA tests were done that came positive.
With immediate effect I was put on IV Prednizone and Cytoxan. Three days and I seemed to have improved a lot. I was discharged with follow ups scheduled with ENT, Pulmonologist and Rheumotologist.

Back Home: I still have some pains at the sight of the Thoracocentesis, perhaps the mass is still lingering around, perhaps getting bigger? I do not know. Crusts keep forming but manageable – I use the Deep Sea Saline water to spary in the nostrils to soften the crusts. They do come out big and large. But not as bloody as before.
My ears are still a mess. I have a follow up with Dr. Kerns tomorrow (May 5th).
In all I am keeping up my spirits. With prayers form family and friends and due diligence on the team of doctors I was able to get my life back.

There are so many people I would like to thank, my wife Rajni and sister Uma who stayed besides my bed day and night listening to my fears and cries consoling me I would live and become healthy again, my in-laws who rushed to take care of the house and the kids, Senaka and Lalani who supported us during all our pains that we went through, Gurdarshan and Hardev who at a moment’s notice rushed to SFO to receive and pick up my in laws. Preety and Ashok, caring and loving... brought food for kids and family. My family in India including my cousins who so selflessly supported my dad’s CABG and then went through the pains of taking me around the city hospital. All my cousins, People who I did not even know - Pastor Robin Martin who prayed for us to give us the strength to cope up with this disorder. Placida who we did not know very well (met her at Senaka and Lalani's party) performed nine prayers a day for nine days for me, what a selfless great soul. My cousin Suman and her husband Kaushik and Uma who kept researching on this disease and feeding us with valuable information from the internet while we were all in the hospital (they still continue to do so while I rest at home). My team at work who covered for me while I was out fighting with odds, wished me luck and added me to thier prayers. God listened to all of their prayers’ and sent me back with a new lease of life! – I once again would like to acknowledge all their prayers, wishes and help with a deep sense of gratitude. I now am starting to view the world with a different angle that brings hope and wish a good life to everyone.