Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor found in Linksys, Netgear Routers

github.com

Post reply on HN
Print view View original

91–100 of 144 posts

Re: Backdoor found in Linksys, Netgear Routers

#91

Post by keithnoizu »

superuser2 wrote: post #89
maxk42 wrote: post #72

About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had configured the thing in a manner I thought to be fairly secure -- strong password, no broadcast, etc.. One day the internet goes down and my friend doesn't know what to do. She calls the ISP and asks them what's wrong. They say they can't release any information a…

>Time Warner had left a backdoor in all their modems that gives them administrative access to my private connection Yes, their modems. On the connection that they provide for you. A cable modem is considered CPE (customer premise equipment), meaning it is part of the infrastructure a telco uses to provide you with connectivity. Usually they own it, but in any case they have full control over it, as they should - it's…

Yeah, this is why I just shell out for my own docsys 3 cable modem whenever possible.

Re: Backdoor found in Linksys, Netgear Routers

#92

Post by earlz »

vinhboy wrote: post #58
earlz wrote: post #35

Interesting. Reminds me of the hack I did on a (mandatory) modem/router forced on AT&T users. They had a bunch of problems with it, so one day I got fed up after the millionth disconnect and cracked it open. Got a serial root shell by using the "magic !" command (completely randomly discovered) and dumped the source to the web UI(in Lua/haserl). From there found the equivalent of a SQL injection vulnerability and use…

do you have a write up with more details about those exploits?

Yea I wrote it up on my blog here. Just didn't want to risk spamming heh.http://earlz.net/view/2012/06/07/0026/rooting-the-nvg510-fro...

Re: Backdoor found in Linksys, Netgear Routers

#93

Post by earlz »

Istof wrote: post #66
earlz wrote: post #35

Interesting. Reminds me of the hack I did on a (mandatory) modem/router forced on AT&T users. They had a bunch of problems with it, so one day I got fed up after the millionth disconnect and cracked it open. Got a serial root shell by using the "magic !" command (completely randomly discovered) and dumped the source to the web UI(in Lua/haserl). From there found the equivalent of a SQL injection vulnerability and use…

AT&T have not forced me to use a specific modem with their DSL service.

This is with their u-verse service. Basically it's like DSL but using some different technologies and no easy way of bridging like PPPoE

Re: Backdoor found in Linksys, Netgear Routers

#94

Post by superuser2 »

keithnoizu wrote: post #91
superuser2 wrote: post #89

Earlier quoted context omitted.

>Time Warner had left a backdoor in all their modems that gives them administrative access to my private connection Yes, their modems. On the connection that they provide for you. A cable modem is considered CPE (customer premise equipment), meaning it is part of the infrastructure a telco uses to provide you with connectivity. Usually they own it, but in any case they have full control over it, as they should - it's…

Yeah, this is why I just shell out for my own docsys 3 cable modem whenever possible.

Even when you "bring your own modem" ISPs tend to demand exclusive control while it's in service. It really is intended to be part of the ISP's network rather than yours, so while (unlike a rental unit) you could walk away with it and take it to another provider, sell it, run your own copper infrastructure, etc. you usually still can't modify the settings of existing connection.

One of my cable installers told me that rate limiting is done in the cable modem, so people would run pirate firmware that eliminated the artifical limits and run at the natural limit of the connection. People had fun with this for a while until the network engineers figured it out, and now people exceeding the speed limit get their connections shut down pretty quickly. But anyway, it makes sense the the cable modem really isn't the customer's to control.

I own and control my own wireless router because I want to play with things like DD-WRT, use OpenDNS, etc., but I see the cable modem as no different from the utility box down the street.

Re: Backdoor found in Linksys, Netgear Routers

#96

Post by dspillett »

maxk42 wrote: post #72

About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had configured the thing in a manner I thought to be fairly secure -- strong password, no broadcast, etc.. One day the internet goes down and my friend doesn't know what to do. She calls the ISP and asks them what's wrong. They say they can't release any information a…

That is very common with provider issued equipment. Anything you get from your ISP should be considered their equipment rather than yours and your's should assume therefore that they maintain some sort of control over it. For serving very non-technical home users this is actually an advantage.

Over here when you are BT's FTTC setup through any ISP the vDSL modem that hangs off your master socket (which can do more but is used in this arrangement to simple pick up the connection from the phone line and provide PPPoE on the ethernet port) is very definitely BT/OR's: they tell you not to mess with it, people who want to mess with it have to use hacks to get access to the UI (which is otherwise locked off), and if you plug something else in at that point you are officially not supported. If the router that you plug in to that came from your ISP then that is their's (usually you have to return it when you leave).

If you buy your own router (or "make" your own, people who have a small Linux machine on 24/7 for various things just set that up to talk PPPoE directly and skip the router altogether, neatly avoiding the limits of many "consumer grade" units (shoddy IPv6 support for instance) without shelling out for a much better device) only then do you truly have control of security at that point in the topology. But some ISPs won't support you if you don't use the provided router (though if you know enough to purchase your own router you might not find such an ISP's tech support much help anyway).

Re: Backdoor found in Linksys, Netgear Routers

#97

Post by jauer »

maxk42 wrote: post #72

About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had configured the thing in a manner I thought to be fairly secure -- strong password, no broadcast, etc.. One day the internet goes down and my friend doesn't know what to do. She calls the ISP and asks them what's wrong. They say they can't release any information a…

Many (most?) large providers use TR-069 in the CPE that they provide. This is how they push out firmware & config updates and provide some managed services to SoHo customers.

You might be surprised at how much a provider support rep can see with this. Here's two screenshots from Cisco's product to give you a idea: http://images.newsfactor.com/images/super/larger-12-ClearAcc... http://cdn-static.zdnet.com/i/story/60/01/072589/clearaccess...

Moral of the story: Use the most basic cable/dsl modem that they'll give you, make it as close to bridge mode as you can, and use your own router.

Re: Backdoor found in Linksys, Netgear Routers

#98

Post by ryanhuff »

superuser2 wrote: post #94
keithnoizu wrote: post #91

Earlier quoted context omitted.

Yeah, this is why I just shell out for my own docsys 3 cable modem whenever possible.

Even when you "bring your own modem" ISPs tend to demand exclusive control while it's in service. It really is intended to be part of the ISP's network rather than yours, so while (unlike a rental unit) you could walk away with it and take it to another provider, sell it, run your own copper infrastructure, etc. you usually still can't modify the settings of existing connection. One of my cable installers told me tha…

Time Warner wants nothing to do with my (own purchased) cable modem beyond allowing me to use it. The vendor will only provide firmware patches to cable operators, and Time Warner won't touch my modem to help get the firmware upgraded.

Re: Backdoor found in Linksys, Netgear Routers

#99

Post by ryanhuff »

mutantmonkey wrote: post #77
maxk42 wrote: post #72

About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had configured the thing in a manner I thought to be fairly secure -- strong password, no broadcast, etc.. One day the internet goes down and my friend doesn't know what to do. She calls the ISP and asks them what's wrong. They say they can't release any information a…

Of course they can. The way DOCSIS is designed, your cable company has full access to your modem; your modem receives configuration data via TFTP from them and in most cases the firmware can only be updated over the coax interface. In fact, it's very rare that there's any configuration you can change on the DOCSIS modem side of things at all, even on the most expensive modems. Lately cable companies have been pushing…

That wasn't my experience with Time Warner and my Motorola cable modem, at least as far as dealing with modem issues (firmware). They referred me to Motorola.
Post reply on HN