Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN users unmasked by zero-day vulnerability in Virgin Media routers

portswigger.net

Post reply on HN
Print view View original

91–97 of 97 posts

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#91

Post by Crosseye_Jack »

cmsj wrote: post #68
Crosseye_Jack wrote: post #43

Earlier quoted context omitted.

In the UK, Virgin Media (The biggest cable provider, I think there maybe a couple of minor regional cable providers still dotted around the country) are the largest cable provider after buying up the smaller regional companies (My regional provider was brought up by Telewest). Long story short, their was tons of regional providers, they were brought up by one of two players which basically devided the country into be…

Last time I had a modem upgrade from VM, the guys said I should keep the old modem and VM would contact me to send it back. Five months later I sent it off for recycling because i'd heard nothing. Two months after that they asked for it back and then charged me £80 for not having it anymore.

Back in the day they never bothered chasing up the modems even though they had wording in the contract they could charge if the equipment wasn’t returned, the equipment was never given to the customer but loaned for “free”, they were more pissy about their TV boxes, when I left them they kept sending threats to charging me for the boxes, I kept asking them to either collect them or send me pre-paid postage and I would send them back (was always “well mail one out” and they never did). One day I was in a pissy mood after another treat, drove down to the regional head office (at the time it was about 4 miles away) slapped them down on the receptionists desk with the threat letter and demanded a receipt.

Never heard from them again.

BT do the same these days with their hubs (or at least were planning to, dunno if they changed their minds after the backlash), BTs excuse is to reduce electronics waste. Not that we’re going to reuse the gear themselves more that they would recycle it.

BE (before they were brought out by o2) would send you out a “cat trap” modem on the condition you returned it if you left (so they could give it to ant or customer as a cat trap) but didn’t really give a crap about the primary modem.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#93

Post by ziml77 »

johnklos wrote: post #2

Nobody should use ISP provided equipment for anything security sensitive, ever. ISPs don't care about security at all, aside from "security" as a sales term, and aside from when they're getting a bad name because of egregious failures. ARRIS shouldn't be given a year embargo, either. They're the same company who've known since 2016 about hardware issues which cannot be corrected in software in the Intel PUMA chipsets…

I was happy when I switched to gigabit internet from Verizon because MoCA can't handle that speed, so they made an ethernet run from the ONT to my apartment (well sort of, they couldn't actually make a new run, but they were able to use the wiring that had been used for the telephone lines). Ever since then I've had my own OPNSense box handling routing. The Verizon router is stuffed away in a closet. I don't know if the Verizon router has backdoor remote control capabilities, and now I don't have to care at all if does.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#94

Post by chenxiaolong »

silisili wrote: post #86
chenxiaolong wrote: post #83

Earlier quoted context omitted.

Any chance you have more details on this? I set up wpa_supplicant on my router to do the 802.11x auth to the ONT and short of a single "your modem/router is not phoning home"-type email, it's been working great the past year. Hoping this does not break in the future.

I don't have time to re-research it all ATM, but a quick Google search, I think this is the thread - https://www.dslreports.com/forum/r32839785-AT-T-Fiber-Gatewa...

Thanks for the link!

> No, it's when they port you over to a new splitter in your neighborhood's PFP cabinet seems to be what I'm following. Then you will be connected to a different OLT port at the CO(central office) that supports XGS-PON as well as standard GPON. > > Older Gateways will work on the newer OLT gear. But the 10Gbps XGS-PON will only work on the newer OLT ports. This newer port has an added management layer to support 10Gbps which needs authentication on top of the certs needed by both GPON and XGS-PON.

That's good to know. They already dragged their feet getting fiber available in my area (fiber laid 13 years before service was available). Hopefully they'll drag their feet with this "upgrade" too.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#95

Post by saurik »

hellbannedguy wrote: post #10
saurik wrote: post #6

Earlier quoted context omitted.

(I bought my DOCSIS 3.whatever cable modem to use with Cox Cablevision myself at Best Buy after deciding which one I thought would be the best.)

Bestbuy likes to push the $300 modems. They do carry a $69 one on the bottom shelf, if it's stocked.

I didn't ask Best Buy which one they wanted to sell me... I simply bought one at Best Buy explicitly after deciding which one would be the best (and I had to drive two hours to find a Best Buy that carried it).

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#96

Post by wyager »

CodesInChaos wrote: post #59
wyager wrote: post #29

Earlier quoted context omitted.

I have a seedbox set up on freebsd with two jails. One jail runs wireguard and pf. The other jail runs transmission. They are connected by a virtual Ethernet cable (epair). The transmission jail can only talk to the internet via the VPN jail, which it is not aware of.

Jails/Containers should be fine as well. Just need to make sure host applications don't see the network interface provided by the VPN gateway, so they don't accidentally leak it (linking it to your real IP). A typical example are browsers when using WebRTC.

FreeBSD Jails using vnets cannot see any of the network interfaces belonging to the host (or other jails), so there's little risk of a compromise that way.

The only way (in theory) someone could figure out my IP from this setup is A) if they have a jail escape (unlikely) or B) if I screw up my firewall config and accidentally let some packets through that aren't going straight into the VPN (plausible)

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#97

Post by dangerface »

stordoff wrote: post #76
madjam002 wrote: post #22

These endpoints are available in modem only mode, but everyone I’ve asked who has a SH3 says that they’re not affected by this and the endpoint doesn’t return the IP address. If you’re in modem only mode, block HTTP traffic to 192.168.100.1 outbound from your firewall just to be sure. Seems relatively low impact, but still pretty bad. Not surprising from VM given the quality of their firmware.

> everyone I’ve asked who has a SH3 says that they’re not affected by this and the endpoint doesn’t return the IP address What does it return in modem only mode? I've verified that /snmpGet?oid=1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1 on my Hub 3 returns: > { > "1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1":"$xxxxxxxx" [public IP address encoded in hexadecimal] > } but I can't currently test it in modem only mode.

I tested mine in modem mode and it returns 0s for the public ip address, it could be safe or it could just need a different oid or something. I blocked the ip from my router just to be on the safe side.

{ "1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1":"$00000000" }

Post reply on HN