Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking millions of modems and investigating who hacked my modem

samcurry.net

Post reply on HN
Print view View original

81–90 of 282 posts

Re: Hacking millions of modems and investigating who hacked my modem

#81

Post by nness »

longsword wrote: post #76

i'm really glad that i can use my own modem. In germany every ISP is by law required to accept self brought modems. They can't force you to use their often shitty hardware. My current modem/router is up for 3 months without a single interruption to my connection.

I've noticed it gets quite murky when dealing with fibre-to-the-premises, particularly in the UK. Although I don't think an ISP would disallow BYOD, I imagine they'd just not be as likely to support it.

I recently moved ISP, partly because of cost, but also because they offered a great home router as part of their bundle. The installer could not utilise any of the existing wiring in my house, had to be all drilled a second time...

Conversely, my last ISP used some awful Nokia modem that barely supported any kind of routing or customisation and I picked them specifically because it was a rental and the fibre wiring had already been done.

It's fairly common for ISP's in Australia to also give you a choice of BYOD or buying one of theirs. Usually you pay outright for the modem, however, so its yours to keep. That said, this is changing with the national fibre roll-out. But with ADSL being the de-facto choice, BYOD makes sense.

Re: Hacking millions of modems and investigating who hacked my modem

#82

Post by zdimension »

unclebucknasty wrote: post #73
imadr wrote: post #31

Earlier quoted context omitted.

I assumed they offered a bounty for bug disclosure? You mean to tell me that an internet provider with 11 billion in revenue can't pay someone that found a bug impacting all their clients? Frankly he could have just sold the vulnerability to the highest bidder

> ...can't pay someone that found a bug impacting all their clients?...he could have just sold the vulnerability to the highest bidder This attitude is why "independent security researchers" offering to present unsolicited findings to companies in exchange for payment feels exactly like extortion.

At the same time, Cox is a commercial entity that makes money by providing services. Cyberattacks make them lose money, so it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those.

We're not talking about a grandma losing her wallet with 50 bucks in it and not giving money to the guy that found it and gave her back.

Re: Hacking millions of modems and investigating who hacked my modem

#83

Post by sandreas »

hifromwork wrote: post #43
biosboiii wrote: post #36

Earlier quoted context omitted.

In Germany it is common for vendors to acknowledge the security flaw you send to them, but if you want to publish it (and damage their reputation by doing so) they are going to try you in court, and win. Sometimes they even try you in court if you don't publish it (yet)

To be fair, Germany is unusually harsh on security researchers. As far as I know (but German law is not my forte) there's no exclusion for "ethical hacking". I remember reading about many German cases that went like: * A security researcher discovers that the main database of some service is available publicly with default password * They notify the company * They get sued for unauthorized access to the company's dat…

That's why I would never do this Kind of research from my home Internet and don't send any responsible disclosure from my private email.

There is no reason to give any information but details about the security issue...

Re: Hacking millions of modems and investigating who hacked my modem

#84

Post by taink » 

  One of the things I'll never understand was why the attacker was replaying my traffic? They were clearly in my network and could access everything without being detected, why replay all the HTTP requests? So odd.
I was thinking about this while reading. My guess is that the vulnerability was limited to reading incoming requests (to the modem) or something along those lines, not full control of the network. Replaying the requests is a good way to get both ends of the traffic if you can only access one. For instance, a login + password being authenticated. Just a thought!

EDIT: I'd be hard-pressed to know how one could exploit this, given TLS would encrypt the requests. Maybe they're counting on using badly encrypted requests, encrypted with e.g. TLSv1.0?

Re: Hacking millions of modems and investigating who hacked my modem

#85

Post by 8organicbits »

cjbprime wrote: post #30
voidUpdate wrote: post #26

Earlier quoted context omitted.

If it was a request to a bank, say, it could have included all the cookies and tokens that would allow the request to go through successfully, and the attacker would gain access to their bank page (though if it was something super high security, you'd hope it would have single use tokens and stuff)

A request to a bank that doesn't use TLS would be near-criminal negligence (by the bank) in itself. If the request does use TLS, then even a compromised router should be unable to decrypt it. TLS is end-to-end encryption. If the request doesn't use TLS, then the compromised router can already see the request and response that it is relaying. So why does it have to replay the request from somewhere else? It can just e…

That's a good guess.

Test systems often don't use HTTPS. Test systems often have credentials that work in production (even though they shouldn't), or are useful for finding vulnerabilities in production.

Re: Hacking millions of modems and investigating who hacked my modem

#86

Post by vladvasiliu »

nness wrote: post #81
longsword wrote: post #76

i'm really glad that i can use my own modem. In germany every ISP is by law required to accept self brought modems. They can't force you to use their often shitty hardware. My current modem/router is up for 3 months without a single interruption to my connection.

I've noticed it gets quite murky when dealing with fibre-to-the-premises, particularly in the UK. Although I don't think an ISP would disallow BYOD, I imagine they'd just not be as likely to support it. I recently moved ISP, partly because of cost, but also because they offered a great home router as part of their bundle. The installer could not utilise any of the existing wiring in my house, had to be all drilled a…

> I've noticed it gets quite murky when dealing with fibre-to-the-premises, particularly in the UK. Although I don't think an ISP would disallow BYOD, I imagine they'd just not be as likely to support it.

In France, I've noticed that some ISPs (Free for FTTH and SFR for FTTC + cable attached to the router) they'll offer the possibility of configuring the provided router in "bridge" mode, where you basically get the external IP to whichever equipment is hooked up to their router.

I've also had FTTH with SFR, which have a separate device which terminates the optical connection (ONT) and speaks ethernet with the main router. I don't remember if the main router was able to work in bridge mode. It was possible to connect your own router to the ONT but you had to jump through hoops [0] to actually receive a working DHCP response.

Bouygues also had the separate device for terminating the optical connection, connected via ethernet to the main router. The only catch was that it talked over vlan 100 for some reason, but other than that it was smooth sailing.

I've never had Orange, but I hear it's a pain to replace the actual router with them.

---

[0] IIRC you had to send some custom DHCP options pretending more or less to be an actual SFR router.

Re: Hacking millions of modems and investigating who hacked my modem

#87

Post by longsword »

nness wrote: post #81
longsword wrote: post #76

i'm really glad that i can use my own modem. In germany every ISP is by law required to accept self brought modems. They can't force you to use their often shitty hardware. My current modem/router is up for 3 months without a single interruption to my connection.

I've noticed it gets quite murky when dealing with fibre-to-the-premises, particularly in the UK. Although I don't think an ISP would disallow BYOD, I imagine they'd just not be as likely to support it. I recently moved ISP, partly because of cost, but also because they offered a great home router as part of their bundle. The installer could not utilise any of the existing wiring in my house, had to be all drilled a…

BYOD is really easy here with DSL. With fibre they try to push the legal limits by arguing that their device is required because its part of their network. But because the law explicitly says the network has to end at a passive point, they got fined. If they don't provide the login and vlan id's, you can just report them to the authorities and they will handle it.

Re: Hacking millions of modems and investigating who hacked my modem

#88

Post by Bluecobra »

What sucks about this situation is when your ISP forces you to use their modem or router. For example, I have AT&T fiber and it does some kind of 802.1X authentication with certificates to connect to their network. If they didn't do this, I could just plug any arbitrary device into the ONT. There are/were workarounds to this but I don't want to go through all those hoops to get online. Instead, I ended up disabling everything on the AT&T router and have my own router that I keep up to date plugged into that. Unbeknownst to me, the AT&T router could be hacked and I would never notice unless it was adversely affects my service.

Thank god most things use HTTPS these days.

Re: Hacking millions of modems and investigating who hacked my modem

#89

Post by prettyStandard »

randomcarbloke wrote: post #59
rwmj wrote: post #28

> After reporting the vulnerability to Cox, they investigated if the specific vector had ever been maliciously exploited in the past and found no history of abuse Would you trust a thing they say? It seems their whole network is swiss cheese.

if they say not, does that imply another vector that they may or may not know about given the author had already found a compromised device.

That was my first thought. That they didn't even find the original attack vector. But comments above this suggest something even worse they are in Cox's network actively wiping out their own logs.

Re: Hacking millions of modems and investigating who hacked my modem

#90

Post by IAmLiterallyAB »

mavamaarten wrote: post #5

What sort of authentication system just lets calls through randomly sometimes... The incompetence!

Found a similar big once. The API would correctly reject unauthenticated requests for exactly 10 minutes. Then, for exactly 1 minute, unauthenticated requests were allowed. The cycle repeated indefinitely. Would love to know what was going on on the backend...
Post reply on HN