Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor found in Linksys, Netgear Routers

github.com

Post reply on HN
Print view View original

111–120 of 144 posts

Re: Backdoor found in Linksys, Netgear Routers

#111

Post by elvanderb »

voltagex_ wrote: post #27
sprobertson wrote: post #19

Earlier quoted context omitted.

Could you describe the whole reversing process in a bit more detail? Binary goes in, understanding comes out, you can't explain that (well I hope someone can).

I'm going to rush this, sorry. * Guy sees service running on 32764 and thinks that's quite odd * Gets very frustrated at useless forum posts from people with no clue * Downloads a copy of the firmware from the (horrible) modem-help.co.uk This is where it gets interesting: Binwalk ------ First off, a program called Binwalk is used. This is a combo of a really cool python script, the libmagic database (if you've used t…

Thank you for explaining my slides ;) They were designed to be read by people who understand reverse engineering.

There is some errors in your comments, I didn't exploit anything, I just highlighted a vulnerability in the backdoor :D

People, if you are confused by memes, don't do RE :D And for those who say I could have just written a simple text, well, text is not that simple to write especially when you're not a native english speaker :) and I had a lot of fun doing my draws

Re: Backdoor found in Linksys, Netgear Routers

#112

Post by mash-eh »

earlz wrote: post #35

Interesting. Reminds me of the hack I did on a (mandatory) modem/router forced on AT&T users. They had a bunch of problems with it, so one day I got fed up after the millionth disconnect and cracked it open. Got a serial root shell by using the "magic !" command (completely randomly discovered) and dumped the source to the web UI(in Lua/haserl). From there found the equivalent of a SQL injection vulnerability and use…

Thanks man, that hack saved me so much pain when I had a 510 and needed a router with uPnP. I've got a 5801 now which has a "DMZ+" mode, but AT&T makes me pay 6 bucks a month for it :/

Re: Backdoor found in Linksys, Netgear Routers

#116

Post by blueskin_ »

maxk42 wrote: post #72

About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had configured the thing in a manner I thought to be fairly secure -- strong password, no broadcast, etc.. One day the internet goes down and my friend doesn't know what to do. She calls the ISP and asks them what's wrong. They say they can't release any information a…

I've heard from others that the passwords are stored in plaintext and viewable by support too, at least at some ISPs.

Now combine that with the typical user's tendency towards password reuse...

Re: Backdoor found in Linksys, Netgear Routers

#117

Post by mdip »

earlz wrote: post #92
vinhboy wrote: post #58

Earlier quoted context omitted.

do you have a write up with more details about those exploits?

Yea I wrote it up on my blog here. Just didn't want to risk spamming heh. http://earlz.net/view/2012/06/07/0026/rooting-the-nvg510-fro...

U-Verse High Speed Internet service uses this type of modem (this is the "U-Verse" service that is a traditional ADSL type service, not their IPTV VDSL stuff -- it used to not carry the U-Verse name). I'm stuck with it at my extended family's summer home since there's no other service available. It's been incredibly flaky. Since the default configuration won't allow me to set the modem to respond to ICMP and we physically unplug electronics other than the modem when we're not there, I've run out of ways to monitor it remotely from my home two hours away (thereby eliminating the possibility of getting a monthly credit for every month this thing has been flaky).

I've had service techs out for the last two years trying to make it more reliable, but the biggest problem has been "proving" that the service has been down, and very frequently. Now I can get my local nagios instance graphing the terribly reliability. That should get ammunition to request monthly statement credits, hopefully increasing their motivation to fix the wiring in the area (everyone in this small town that has U-Verse complains about the reliability of the connection).

Re: Backdoor found in Linksys, Netgear Routers

#118

Post by wtallis »

VMG wrote: post #103
wtallis wrote: post #79

Earlier quoted context omitted.

There is no purely technological solution for the masses. Actually solving the problem requires either a political revolution to make shipping backdoors like this criminal rather than a favor to the government, or educating users enough that they can protect themselves with the existing technological methods that are easy to deploy given basic computer literacy. It's not really clear which one is less impossible.

this kind of stuff is far beyond basic computer literacy

No its not. Installing Tomato or DD-WRT is only very slightly more complicated than configuring your router with non-default passwords, and you really shouldn't be considered at all computer literate if you don't know how to take even the first step to secure your network.

Re: Backdoor found in Linksys, Netgear Routers

#119

Post by tylerkahn »

maxk42 wrote: post #72

About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had configured the thing in a manner I thought to be fairly secure -- strong password, no broadcast, etc.. One day the internet goes down and my friend doesn't know what to do. She calls the ISP and asks them what's wrong. They say they can't release any information a…

I had to call Comcast in order to disable the Wifi radio on my modem.

Not really a backdoor, just remote administration.

Re: Backdoor found in Linksys, Netgear Routers

#120

Post by tonyb »

keithnoizu wrote: post #91
superuser2 wrote: post #89

Earlier quoted context omitted.

>Time Warner had left a backdoor in all their modems that gives them administrative access to my private connection Yes, their modems. On the connection that they provide for you. A cable modem is considered CPE (customer premise equipment), meaning it is part of the infrastructure a telco uses to provide you with connectivity. Usually they own it, but in any case they have full control over it, as they should - it's…

Yeah, this is why I just shell out for my own docsys 3 cable modem whenever possible.

This doesn't help you at all.

The provider is able to change the settings through two primary methods.

1. DOCSIS configuration file - this is the file your modem downloads when it comes online and includes settings like your speeds (Upstream/Downstream service flows) and it also includes the SNMP settings (used for #2).

2. SNMP - The MSO can also remotely monitor and change your modem via SNMP. There is a large number of DOCSIS MIBs that every cable modem must support in order to get certified and there are also vendor specific MIBs that a modems manufacture will add to support specific features of that modem.

Without SNMP it would be very difficult to maintain a cable network. Other types of access networks have similar features.

Post reply on HN