Data on thousands of hard drives connected to Asus is easily accessible from the Internet due to insecure default settings, according to tests conducted by experts at PC World Norway.
Broadband Routers with USB ports that allow users to connect external hard drives directly to the router are becoming increasingly common. Shared space accessible over the internet using protocols such as FTP is quite useful but has significant security risks.
If the products are not configured correctly, personal data is exposed to anyone with basic technical knowledge. There have already been several reported incidents involving people using Asus.
The problem starts with how routers are configured. Access to an external hard drive connected via USB to a router using FTP can be enabled manually or using the driver. However, both cases leave the router exposed.
The wizard lets the user choose between 3 settings, the default unrestricted access with options for permissions, limited access and admin permissions, but with little information about what each means. The limited access permissions also include an option that creates a user named 'family' and suggests the family password instead of asking each user to create their own password.
This particular issue is affecting users all over the world, including users in the US. The strange thing is that these routers passed all the security tests used by Asus without any problems.
To solve the problem, the company is developing a firmware update that will be distributed worldwide, making the security settings clearer.
We warmly thank SecTeam member @Walkin.
