Fritz!Box security warning 2014-01

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Fritz!Box security warning 2014-01

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#139384 7-Feb-2014 08:05

Received this morning:

Important security information for all FRITZ!Box users with MyFRITZ! service enabled

You are receiving this message as a user of AVM MyFRITZ! at the e-mail address registered with this service.

In recent days there have been several reports of fraudulent use of telephone services connecting through FRITZ!Box routers. AVM has notified its customers and published revelant security instructions. How this abuse has taken place has yet to be established conclusively.

As a temporary safety precaution, AVM recommends that all FRITZ!Box users disable Internet access to the FRITZ!Box via HTTPS (port 443). This also disables access to your FRITZ!Box user interface from any location using MyFRITZ!. Please go to www.avm.de/en/sicherheit for brief instructions.

After disabling Internet access via HTTPS (Port 443), FRITZ!Box services like MyFRITZ! and FRITZ!NAS are no longer available and the FRITZ!Box user interface can no longer be accessed from on the go. But you can continue to use all Internet and home network applications safely at home.

If you saved e-mail addresses in your FRITZ!Box, for example to use push service, we recommend changing the mail password at your e-mail provider for this mail address as a precaution. Any other e-mail addresses not stored in the FRITZ!Box are not affected.

See www.avm.de/en/sicherheit for the latest news. We will inform you as soon as you can resume using both services without restrictions.

If you need further support, our support team with experts on this topic is ready to assist you: contact us at security@avm.de or call +49 30 39 004 554.

We apologize for the temporary limitations to access from on the go, but have decided to recommend these instructions as a securtiy precaution.

1 | 2 | 3

4705 posts

Uber Geek

Trusted

#981633 7-Feb-2014 09:04

Thanks. Disabled both MyFR!TZ and external access via HTTPS on my 7390.

Do whatever you want to do man.

Oblivian

7296 posts

Uber Geek

ID Verified

#981676 7-Feb-2014 09:57

Hmm, doesn't the provisioning tool use https port for access? or just the userbase within.

As that will make snapsupport automated changes fun for a while :)

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#982529 9-Feb-2014 08:48

Just received:

Security Update Available for Your FRITZ!Box - Please Install!

You are receiving this message as a user of AVM MyFRITZ! at the e-mail address registered with this service.

For your FRITZ!Box AVM has made a security update available to prevent any further attacks. We urgently recommend installing this update.

Two steps to the update:

Open the user interface of the FRITZ!Box by entering fritz.box in your web browser.
Click "Update" in the "Wizards" menu and follow the instructions.
If you used remote access previously, it cannot be ruled out that your access data and additional passwords may have been stolen. AVM urgently advises you to change all passwords and login data stored in the FRITZ!Box. These include, for instance, the password for the e-mail account used for push service and the password for free VoIP providers like sipgate.

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#982539 9-Feb-2014 08:55

From mine:

A new FRITZ!OS 06.03 is available for your FRITZ!Box Fon WLAN 7390. You are currently using FRITZ!OS version 06.01.

For information about the new features included in the new FRITZ!OS, go to: ftp://ftp.avm.de/fritz.box/fritzbox.fon_wlan_7390/firmware/english/info.txt

New Features

         Security: removes possibility for unauthorized access to FRITZ!Box.
         New with FRITZ!OS 6:

         Wireless LAN Guest Access new as "private hotspot"
         Ready for vectoring
         Parental control with shared budget for multiple devices
         Improved and expanded push services with automatic email notifications
         New MyFRITZ! access to answering machine, Smart Home and FRITZ!NAS for mobile devices
         Smart Home functionality now even more convenient and with more information
         FRITZ!Fon with media player and much more

BlakJak

1275 posts

Uber Geek

Trusted

#982543 9-Feb-2014 09:12

Just used the internal updater to do an update on my 7340. Have now found the Web UI doesn't work in Firefox.

No signature to see here, move along...

wallarro

16 posts

Geek

#982552 9-Feb-2014 09:56

DO NOT UPGRADE TO 6.03!

I upgraded and now the internet is kaput. Rang Snap and was told NZ dsl setting is not included in the new firmware so I have to roll back to previous one.

Currently using my mobile to search Fritz site which make this painful. Appreciate it if anyone can post link to the 6.01 or even older firmware here.

richms

28168 posts

Uber Geek

Trusted

Lifetime subscriber

#982555 9-Feb-2014 10:00

I've changed my 2talk password but the hopeless user interface on the fritz isn't letting me update it giving me an error at the top about a field in red but there are no red fields.

FFS don't want to have have to remove the the accounts and re add them and reset up which handset gets which number.

Also it seems it hasn't updated my dyn dns since January sometime. New password on that too.

Then the fun of a wifi psk change begins.

Richard rich.ms

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

NZSimplicity

135 posts

Master Geek

#982557 9-Feb-2014 10:01

I just upgraded to the latest version on my 7340 and this is the result:

FRITZ!OS is the FRITZ!Box software. The following version is currently installed on your FRITZ!Box: FRITZ!OS installed: 06.03

I did have to manually UNPLUG my fritz and then plug it back in AFTER doing the upgrade to make things work tho :) :)
Seems to be working perfectly, and I can also view the fritz using firefox.

BlakJak

1275 posts

Uber Geek

Trusted

#982567 9-Feb-2014 10:29

Im running 6.03 and my DSL sync is fine (perhaps down a bit... 8mbit or so down, pretty sure i've had 9 or 10mbit before).

Can't explain the firefox thing. Sent a help request and a screenshot to the avm.de folks.

No signature to see here, move along...

richms

28168 posts

Uber Geek

Trusted

Lifetime subscriber

#982568 9-Feb-2014 10:31

Down to 18 downstream on the fritz. My slingshot adsl connection is 16 meg. Used to have over 20 vdsl sync.

Really liking the idea of buying the netcomm now.

Richard rich.ms

nathan

5695 posts

Uber Geek
Inactive user

#982569 9-Feb-2014 10:31

same DSL synch here on mine after upgrade 58/10

No problems with SNAP VDSL after upgrading. Easiest firmware upgrade I ever did, IE11, never even had to move off the couch, the web UI did it all and rebooted sweet as.

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#982572 9-Feb-2014 10:35

No problems here.

NZSimplicity

135 posts

Master Geek

#982588 9-Feb-2014 10:46

BlakJak: Can't explain the firefox thing. Sent a help request and a screenshot to the avm.de folks.

That's weird, I running 27.0 version of firefox and am haivng no trouble at all connecting to my fritz web UI,

TheHoss

36 posts

Geek

#982618 9-Feb-2014 11:56

No problems with the upgrade here on Snap UFB connection.

andrewb

34 posts

Geek

#982648 9-Feb-2014 12:15

So, I'm officially confused - is this firmware update compatible with NZ VDSL settings or not? I don't want to update if it means I need to then roll back somehow. For now I've disabled the remote access etc.

1 | 2 | 3