Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor found in Linksys, Netgear Routers

github.com

Post reply on HN
Print view View original

131–140 of 144 posts

Re: Backdoor found in Linksys, Netgear Routers

#131

Post by MrBuddyCasino »

tonyb wrote: post #120
keithnoizu wrote: post #91

Earlier quoted context omitted.

Yeah, this is why I just shell out for my own docsys 3 cable modem whenever possible.

This doesn't help you at all. The provider is able to change the settings through two primary methods. 1. DOCSIS configuration file - this is the file your modem downloads when it comes online and includes settings like your speeds (Upstream/Downstream service flows) and it also includes the SNMP settings (used for #2). 2. SNMP - The MSO can also remotely monitor and change your modem via SNMP. There is a large numbe…

Not sure I got that - why is cable different in this regard from DSL? I'm pretty sure there is such thing built into adsl/vdsl routers or modems, at least not in Germany.

Re: Backdoor found in Linksys, Netgear Routers

#133

Post by superuser2 »

MrBuddyCasino wrote: post #131
tonyb wrote: post #120

Earlier quoted context omitted.

This doesn't help you at all. The provider is able to change the settings through two primary methods. 1. DOCSIS configuration file - this is the file your modem downloads when it comes online and includes settings like your speeds (Upstream/Downstream service flows) and it also includes the SNMP settings (used for #2). 2. SNMP - The MSO can also remotely monitor and change your modem via SNMP. There is a large numbe…

Not sure I got that - why is cable different in this regard from DSL? I'm pretty sure there is such thing built into adsl/vdsl routers or modems, at least not in Germany.

DSL is provided over a POTS ("plain old telephone service") line. The demarc for POTS, at least in my neighborhood, is a grey box on the side of your house, well upstream of your DSL modem.

I don't know why exactly it worked out that way, but the telephone system is designed to deal with consumer electronics and the coax cable system is not.

It didn't used to be - until the federal government busted AT&T's monopoly, it was illegal to connect non-AT&T equipment to the AT&T network, at least electrically. This is why in old movies you see people dialing ISPs by hand with a phone and then setting the handset down on a cradle - the cradle was the modem, and it interfaced with the telephone network acoustically. The demarc (at least as we know it today) was presumably introduced after the government told AT&T they had to let people have their own networks, rather than considering everything up through the phones to be part of the telco network.

Re: Backdoor found in Linksys, Netgear Routers

#134

Post by voltagex_ »

elvanderb wrote: post #111
voltagex_ wrote: post #27

Earlier quoted context omitted.

I'm going to rush this, sorry. * Guy sees service running on 32764 and thinks that's quite odd * Gets very frustrated at useless forum posts from people with no clue * Downloads a copy of the firmware from the (horrible) modem-help.co.uk This is where it gets interesting: Binwalk ------ First off, a program called Binwalk is used. This is a combo of a really cool python script, the libmagic database (if you've used t…

Thank you for explaining my slides ;) They were designed to be read by people who understand reverse engineering. There is some errors in your comments, I didn't exploit anything, I just highlighted a vulnerability in the backdoor :D People, if you are confused by memes, don't do RE :D And for those who say I could have just written a simple text, well, text is not that simple to write especially when you're not a na…

Hey, I hope I did okay explaining this - thanks for putting up a proof of concept!

Re: Backdoor found in Linksys, Netgear Routers

#136

Post by atmosx »

I live in Czech Republic and my Zyxel from O2 has port 7547 open (Allegro RomPager 4.07) and you can't do anything about it. There is no editor on the installed linux version (cropped down linux, probably openWRT or something similar), no package manager no nothing.

If I flash the firmware warranty is void and I have no user/pass to re-enable the ADSL. So basically, my router is a hostile AP.

Given the fact that, it's a common pattern among ISPs in order to offer quick service - I firmly believe that ISPs do it for practical reasons - and end up killing your security, the best thing is to put the router in bridged mode and get a cheap custom-made router like carambola2[1] and install FreeBSD[2] on it.

Disclosure: I donated one of these devices to Adrian Chadd[3] in order for him to port FreeBSD on this device, which enabled me to use PF[4] - my favorite firewall - but I have no affiliation otherwise with 8devices or FreeBSD.

[1] http://8devices.com/carambola-2

[2] https://wiki.freebsd.org/FreeBSD/mips/Carambola2

[3] https://wiki.freebsd.org/AdrianChadd

[4] http://pf4freebsd.love2party.net

Re: Backdoor found in Linksys, Netgear Routers

#137

Post by josh2600 »

superuser2 wrote: post #133
MrBuddyCasino wrote: post #131

Earlier quoted context omitted.

Not sure I got that - why is cable different in this regard from DSL? I'm pretty sure there is such thing built into adsl/vdsl routers or modems, at least not in Germany.

DSL is provided over a POTS ("plain old telephone service") line. The demarc for POTS, at least in my neighborhood, is a grey box on the side of your house, well upstream of your DSL modem. I don't know why exactly it worked out that way, but the telephone system is designed to deal with consumer electronics and the coax cable system is not. It didn't used to be - until the federal government busted AT&T's monopoly,…

These are called VRADs http://en.wikipedia.org/wiki/VRAD.

The demarc for your DSL is the modem. If you provide your own modem you still are subject to AT&T's rules. You cannot legally connect to sensitive national infrastructure (like the phone network) without the provider being responsible for your access.

As far as connecting equipment, that significantly predates divestiture. Most people point to Carterfone as the salient decision that changed this: http://en.wikipedia.org/wiki/Carterfone

In reality, there was actually a prior decision which I can't seem to find right now where AT&T refused to allow people to put plastic privacy guards over the mouth piece on the grounds that it would damage the phone network. Ludicrous, but sensible from an economic standpoint.

EDIT: Found it, 1956 Hush-a-phone: http://en.wikipedia.org/wiki/Hush-A-Phone_v._United_States

In short, Telecom is complicated, the demarc is important and you don't own any part of the network from the modem on up.

Source: I am a telecom junkie and I work at 2600hz, the open source telecom company.

Re: Backdoor found in Linksys, Netgear Routers

#140

Post by muyuu »

maxk42 wrote: post #72

About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had configured the thing in a manner I thought to be fairly secure -- strong password, no broadcast, etc.. One day the internet goes down and my friend doesn't know what to do. She calls the ISP and asks them what's wrong. They say they can't release any information a…

Proprietary software, firmware and hardware ultimately means you don't own the stuff you use. Goes on at all levels and people interiorise it to the point that they will take it as a given and justify uses that are not truly justifiable. ISPs do not need this kind of policy to operate, regardless what you'll read in this thread.
Post reply on HN