Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TCP backdoor 32764 – how we could patch the Internet (or part of it)

blog.quarkslab.com

Post reply on HN
Print view View original

1–10 of 22 posts

Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)

#4

Post by ancarda »

lotsofcows wrote: post #3

Anyone played with this? term1$ tcpdump -i en1 -X -n port 32764 term2$ telnet 192.168.0.1 32764 Output doesn't show the expected hex code. Is this naive?

Yeah, I tried but with my external IP:

    $ telnet [redacted] 32764
    Trying [redacted]...
    telnet: connect to address [redacted]: Connection refused
    telnet: Unable to connect to remote host
Does this mean my router has no backdoor? Is it clever enough to avoid detection?

Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)

#6

Post by mhurron »

ancarda wrote: post #4
lotsofcows wrote: post #3

Anyone played with this? term1$ tcpdump -i en1 -X -n port 32764 term2$ telnet 192.168.0.1 32764 Output doesn't show the expected hex code. Is this naive?

Yeah, I tried but with my external IP: $ telnet [redacted] 32764 Trying [redacted]... telnet: connect to address [redacted]: Connection refused telnet: Unable to connect to remote host Does this mean my router has no backdoor? Is it clever enough to avoid detection?

Are you running one of the affected hardware models?

Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)

#7

Post by eschulte »

The use of the vulnerability to repair the vulnerability is very cool. I've done some related work, which may be of interest when one wants to patch a bad binary on the router (instead of simply removing a bad binary as done in this article). http://eschulte.github.io/netgear-repair/pub/netgear-repair....

Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)

#8

Post by sil3ntmac »

ancarda wrote: post #4
lotsofcows wrote: post #3

Anyone played with this? term1$ tcpdump -i en1 -X -n port 32764 term2$ telnet 192.168.0.1 32764 Output doesn't show the expected hex code. Is this naive?

Yeah, I tried but with my external IP: $ telnet [redacted] 32764 Trying [redacted]... telnet: connect to address [redacted]: Connection refused telnet: Unable to connect to remote host Does this mean my router has no backdoor? Is it clever enough to avoid detection?

Check your internal IP as well, some models are only vulnerable on the LAN.

Metasploit has a check module for this, and will also get you a shell:

https://community.rapid7.com/community/metasploit/blog/2014/...

Re: TCP backdoor 32764 – how we could patch the Internet (or part of it)

#9

Post by dlitz »

I guess this is yet another reason not to rely on firewalls and outdated notions of "internal" and "external" networks for any kind of real security.

Increasingly, it seems that firewalls are doing less to improve actual security, while continuing to hinder legitimate network connectivity and the deployment of new protocols.

Post reply on HN