RCE on Telia Routers
full-disclosure.eu
RCE on Telia Routers
1–10 of 51 posts
Re: RCE on Telia Routers
#2Telia is just horrible. I use them because I have no other option where I live, which is very unusual in Sweden. Their support is absolute horse shit. You can't get a static ip unless you have a company and it regularly goes down for hours.
If you login on your account on their homepage you get this popup 1 time each day:
Where they utilize a dark pattern to make users check the boxes and have their customers web traffic data monitored and analyzed for ad purposes. The only other option is "Svara senare" which translates to "Answer later". If you login after 24 hours, the same popup will be shown until you tick those boxes.
This should be illegal.
Re: RCE on Telia Routers
#3Threatening the researcher really is the cherry on top here
Re: RCE on Telia Routers
#4Telia is just horrible. I use them because I have no other option where I live, which is very unusual in Sweden. Their support is absolute horse shit. You can't get a static ip unless you have a company and it regularly goes down for hours. If you login on your account on their homepage you get this popup 1 time each day: https://imgur.com/Y0Gx8EY Where they utilize a dark pattern to make users check the boxes and ha…
Oh, and they sold data about torrent users. That's right. A Swedish ISP selling personally identifiable information. Not giving it out because of a court order.
I have steered many people away from them over the years. They would have to have at least a decade of good behaviour and a sun shining out of their ass before I would pick them.
Re: RCE on Telia Routers
#5So this issue affects Telia Lithuania clients.
But I wouldn't be surprised if the same (or similar) issue affects clients in Sweden.
The article mentions a leaked password hash from 2014, but as far as I know, there were at least 3 password (not hash!) leaks over the last 10 years.
Generally, I recommend people buy their own routers and never use the "Self Service" for managing passwords.
As for hostility of service providers - the situation isn't that good.
Some years ago, a white hat reported some data leak vulnerabilities in a medical "self service" portal.
Vulnerability: change your personal code/id (SSN for folks in US) to another person's number in the POST, and voila - you get the medical history of another person.
What happened is that the white hat got blamed for "hacking" that system.
Result: Vulnerabilities aren't getting reported. Bad guys are exploiting them left and right. White hats don't bother disclosing them.
I personally know at least 5 exploitable vulnerabilities in some government websites, but I won't be disclosing them, since that will land me in a lot of trouble.
EDIT: grammar
Re: RCE on Telia Routers
#6Telia is just horrible. I use them because I have no other option where I live, which is very unusual in Sweden. Their support is absolute horse shit. You can't get a static ip unless you have a company and it regularly goes down for hours. If you login on your account on their homepage you get this popup 1 time each day: https://imgur.com/Y0Gx8EY Where they utilize a dark pattern to make users check the boxes and ha…
Oh, and they sold data about torrent users. That's right. A Swedish ISP selling personally identifiable information. Not giving it out because of a court order. I have steered many people away from them over the years. They would have to have at least a decade of good behaviour and a sun shining out of their ass before I would pick them.
Telia's consumer business survives (in Sweden) because older people have a very hard to disrupt instinctive brand trust for them. I've been trying to get my mom off them for five years now...
The carrier business is a lot more sane.
Re: RCE on Telia Routers
#7Telia is just horrible. I use them because I have no other option where I live, which is very unusual in Sweden. Their support is absolute horse shit. You can't get a static ip unless you have a company and it regularly goes down for hours. If you login on your account on their homepage you get this popup 1 time each day: https://imgur.com/Y0Gx8EY Where they utilize a dark pattern to make users check the boxes and ha…
Oh, and they sold data about torrent users. That's right. A Swedish ISP selling personally identifiable information. Not giving it out because of a court order. I have steered many people away from them over the years. They would have to have at least a decade of good behaviour and a sun shining out of their ass before I would pick them.
And not to speak about their involvement with dictatorships and bribes.
https://www.svt.se/nyheter/granskning/ug/teliasonera-i-milja...
Re: RCE on Telia Routers
#8So this issue affects Telia Lithuania clients. But I wouldn't be surprised if the same (or similar) issue affects clients in Sweden. The article mentions a leaked password hash from 2014, but as far as I know, there were at least 3 password (not hash!) leaks over the last 10 years. Generally, I recommend people buy their own routers and never use the "Self Service" for managing passwords. As for hostility of service…
Do you have the self service thing in Sweden? Granted I’m not a telia customer here in FIN, but have never seen this kind of functionality on my own home routers. Plain router admin always.
Re: RCE on Telia Routers
#9So this issue affects Telia Lithuania clients. But I wouldn't be surprised if the same (or similar) issue affects clients in Sweden. The article mentions a leaked password hash from 2014, but as far as I know, there were at least 3 password (not hash!) leaks over the last 10 years. Generally, I recommend people buy their own routers and never use the "Self Service" for managing passwords. As for hostility of service…
Would the ability to anonymously disclose vulnerabilities help? I fear that disclosures like that would just be ignored, though.
Re: RCE on Telia Routers
#10I really don't get the "Using malicious SSH server to trigger server side RCE" section. The language would do well with being a bit more clear wrt exactly which client and which server, and exactly where the RCE is happening.
> In order to exploit RCE we needed to build a virtual test environment that fully copies Telia's PHP client. Step by step we have gone through the sequence of Telia's commands sent over the SSH. And finally we got a malicious SSH server and a test libssh2 client running in our test lab. With this server we could fully control the protocol and start fuzzing.
> In the first few days of the fuzzing we got some crashes and partially confirmed that RCE may be exploited.
My first understanding of this:
- They eavesdropped on the "requests" (HTTP? Is there TCP tunneling involved?) using a malicious SSH server
- They replicated the HTTP (?) requests using some php code they wrote
- They then caused segfaults/infinite loops in their own PHP code
(Witness the task manager in that screenshot gif running on their own windows machine showing high cpu usage for a PHP process.)
This seems a bit away from an actual "Remote Code Execution on Telia Routers", unless I'm misunderstanding this fundamentally.
Perhaps their high-level thought process is like this?
1. The version numbers in the "php client", triggered by the change-your-wifi-password website, from a trusted IP (10.0.98.251) indicate that this client runs a version of libssh which allows for the password eavesdropping they did, and the php runtime, which is sometimes insecure.
2. Someone could perhaps use the fact that Telia is using PHP to hack their "remote management client" using a malicious ssh server at a customer endpoint.
3. Profit?
This is a very poorly written vulnerability report.
Anyway, @dang - I think the title "RCE on Telia Routers" is pretty incorrect. Suggestion: "Possible Telia consumer router security issue".