Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN users unmasked by zero-day vulnerability in Virgin Media routers

portswigger.net

Post reply on HN
Print view View original

81–90 of 97 posts

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#81

Post by yardstick »

billyjobob wrote: post #53

Why is the web browser allowing the Javascript program to access a different server than the one it was loaded from? They call this a "DNS rebinding attack", and it seems it could compromise any router that doesn't have a password set, not just this router? So isn't the real problem here the browser running untrusted code and giving it access to your local network because it didn't check if the DNS had changed?

I wish browsers would solve the problem by using TLS (ok that’s a website operator issue) and discarding any javascript loaded from a different certificate for the same domain.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#82

Post by inetsee »

inetsee wrote: post #78

This may be a very naive question, but is there a way for someone who is not knowledgeable about all the internet security issues discussed here of checking if my IP address is, in fact, being leaked when I'm using my VPN service?

Never mind. I checked ProtonVPN's support page and there is a web page provided that shows my public IP address when I'm connected through the VPN, which is different from my IP address when I'm not connected through the VPN.

Am I correct in assuming that this means that I'm not exposed by the vulnerability described in the article?

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#83

Post by chenxiaolong »

silisili wrote: post #79
treesknees wrote: post #33

Earlier quoted context omitted.

This is one of the few positives I'll give to Comcast/Xfinity. I'm able to purchase my own DOCSIS modem (as long as it's on their compatibility list) instead of renting one from them. AT&T U-verse I couldn't bring my own modem, and I understand that they're not a DOCSIS network either.

ATT is really weird about it. They apparently decided a few years back that they'd not allow third party devices on their network, and keep doubling down on it. Some folks smarter than myself figured out how to mimic the ONT handshakes or some such that they could use their own devices. IIRC, they were pulling the certs from the ATT box. ATT then came in and installed new stuff at the station to not allow that anymor…

Any chance you have more details on this? I set up wpa_supplicant on my router to do the 802.11x auth to the ONT and short of a single "your modem/router is not phoning home"-type email, it's been working great the past year. Hoping this does not break in the future.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#84

Post by aaronmdjones »

stordoff wrote: post #76
madjam002 wrote: post #22

These endpoints are available in modem only mode, but everyone I’ve asked who has a SH3 says that they’re not affected by this and the endpoint doesn’t return the IP address. If you’re in modem only mode, block HTTP traffic to 192.168.100.1 outbound from your firewall just to be sure. Seems relatively low impact, but still pretty bad. Not surprising from VM given the quality of their firmware.

> everyone I’ve asked who has a SH3 says that they’re not affected by this and the endpoint doesn’t return the IP address What does it return in modem only mode? I've verified that /snmpGet?oid=1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1 on my Hub 3 returns: > { > "1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1":"$xxxxxxxx" [public IP address encoded in hexadecimal] > } but I can't currently test it in modem only mode.

I did SSH port forwarding through my router so that I could access the modem;

    $ ssh -L 127.0.0.1:1234:192.168.100.1:80 root@router 
    $ curl 'http://127.0.0.1:1234/snmpGet?oid=1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1'
    {
        "1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1":"$00000000"
    }
It does not appear to work in modem mode.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#85

Post by LilBytes »

lxgr wrote: post #73
LilBytes wrote: post #48

Earlier quoted context omitted.

Can't speak for all Telco's but in Australia, DOCSIS modems are registered by their MAC address on the modem it's self. Not by IP address. I can't imagine this is different else where so it's likely the replying comment above yours is incorrect. Source: I was previously a network engineer for a national Telco. Other sources: DOCSIS 3.0 registration info: https://volpefirm.com/docsis-3-0-cable-modem-registration/

Registration/network access and management are two different things, no?

Not always, with Telstra the MAC address was also responsible for authentication.

Though I believe it's since changed, my last interaction with DOCSIS was 4-5 years ago. I seem to recall there's a captive portal involved now but previously it was solely MAC.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#86

Post by silisili »

chenxiaolong wrote: post #83
silisili wrote: post #79

Earlier quoted context omitted.

ATT is really weird about it. They apparently decided a few years back that they'd not allow third party devices on their network, and keep doubling down on it. Some folks smarter than myself figured out how to mimic the ONT handshakes or some such that they could use their own devices. IIRC, they were pulling the certs from the ATT box. ATT then came in and installed new stuff at the station to not allow that anymor…

Any chance you have more details on this? I set up wpa_supplicant on my router to do the 802.11x auth to the ONT and short of a single "your modem/router is not phoning home"-type email, it's been working great the past year. Hoping this does not break in the future.

I don't have time to re-research it all ATM, but a quick Google search, I think this is the thread -

https://www.dslreports.com/forum/r32839785-AT-T-Fiber-Gatewa...

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#87

Post by SAI_Peregrinus »

colejohnson66 wrote: post #67
zdragnar wrote: post #65

Earlier quoted context omitted.

Yes and no. Having no rules means you have a maximum search space. However, a general audience means that the top X% (lets say 70 to be arbitrary) are going to be in a very small search space... An English word with maybe some numbers substituted in for a letter or two. OTOH, having password rules means that you eliminate the smallest areas of the search space, so every password resides in a restricted version of the…

Maximum lengths only make sense if your password field is stored as a SQL CHAR(10) (or COBOL if they’re into that). Basically a fixed width field and that’s too small for a hash. But even then, they’re a horrible idea.

They also make sense if you're using bcrypt since it has a 72-byte max input length. More modern password hashing fuctiions don't have such a short limit, so you can set a much bigger max length to prevent excessive network traffic & processing (eg 1kB). Since functions like Argon2 have very large max limits (2^32-1 bytes for Argon2) it can make sense to set a shorter limit.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#88

Post by mindslight »

lxgr wrote: post #77
mindslight wrote: post #32

Earlier quoted context omitted.

Yes, but you do want deliberate access to specific services on the local network. Mainly NFS exports and the like.

Yes, but that's a deliberate security–convenience trade off then. One solution is to use proxy servers or per-app VPNs (without local network access) instead of a system-wide VPN, and effectively partition applications into trusted and untrusted ones.

I've done that partitioning with virtual machines. I don't see how it's a "tradeoff". Yes, every additional service you expose can have its own security flaws, but you have to get data in/out of a VPN'd VM somehow. Even if I allocated more local storage to the VM and only ssh'd in to send/receive files, the ssh client could have a hole in it. nfsd, samba, sshd, and ssh are designed to do singular jobs. The issue in this case is the exposing of a consumer router that was never designed for security from the local network.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#89

Post by bsd44 »

lol768 wrote: post #15
Angostura wrote: post #13

For context. This is Virgin Media which demands your passwords (including e-mail passwords) must be no longer than 10 characters, must begin with a letter, not a number and cannot include any special characters. Security is not their priority.

The same Virgin Media of "Posting it to you is secure, as it's illegal to open someone else's mail." infamy.... [0] [0] https://twitter.com/virginmedia/status/1162756227132198914?l...

That happened to me. I wanted to reset my account password so they agreed to send a "password reminder" via post. I thought that was weird. I expected a temporary password which I will be forced to change upon login. To my surprise they printed my existing account password and sent it to me via postal mail! WTF! I went on Trustpilot immediately and saw they had 1/5 stars from 40k reviews.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#90

Post by AlpineG »

thejetset wrote: post #3
johnklos wrote: post #2

Nobody should use ISP provided equipment for anything security sensitive, ever. ISPs don't care about security at all, aside from "security" as a sales term, and aside from when they're getting a bad name because of egregious failures. ARRIS shouldn't be given a year embargo, either. They're the same company who've known since 2016 about hardware issues which cannot be corrected in software in the Intel PUMA chipsets…

I think generally you don't get a choice when it comes to DOCSIS equipment. You can't just connect up your own (or at least no to Virgin Media's network)

Virgin Arris routers can be put in modem mode you put your own router behind it. I guess this solves most shortcomings and security issues.
Post reply on HN