Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BTAgent – CPE backdoor

cryptome.org

Post reply on HN
Print view View original

11–19 of 19 posts

Re: BTAgent – CPE backdoor

#11

Post by chpp »

I'm always surprised how few network guys are on HN.

Every device in infrastructure should have a management address. This int is routed differently than the data interface. In a datacenter, management will be a separate physical int but telecom can't go running 2 cables into a house so it's a logical management int in that case. Comcast remotes into my modem all the time for management purposes (service magically goes out) and I doubt they login via my DHCP address from them. It's just good practice to manage a device from a management int and in a consumer environment this should be hidden from the user. Everyone in infrastructure knows, the less the user knows the better.

Tinfoil hat time - funny cowinkydink they chose a DoD subnet. Why wouldn't they use 10.0.0.0/8 like the rest of the world? Could be them being different, could be something more. Convenient for the DoD to own the management subnet, just saying.

Re: BTAgent – CPE backdoor

#12

Post by tacoman »

The only technically interesting thing here is the lousy remote management setup BT seems to be using.

It's not mentioned in the article, but I'm not aware of a DSL provider in North America NOT using TR-69 to remotely manage the routers given to customers. To properly support customers, you simply need to use something that gives you remote admin capabilities.

"e.g. with remote access via a CPE backdoor, the local ethernet port on the CPE can be put into "promiscuous mode" and all ethernet frames on the local network snagged. Allowing, for example, the snooping of traffic to a networked local printer in an office."

I've actually done this, with the permission of the customer, to diagnose a problem inside the customer's home network. It was actually a badly broken printer killing the wifi.

I know it's not always possible, but if you don't trust the ISP in your home network, don't use the ISP's gear. I don't and I work for one.

Re: BTAgent – CPE backdoor

#13

Post by ay »

chpp wrote: post #11

I'm always surprised how few network guys are on HN. Every device in infrastructure should have a management address. This int is routed differently than the data interface. In a datacenter, management will be a separate physical int but telecom can't go running 2 cables into a house so it's a logical management int in that case. Comcast remotes into my modem all the time for management purposes (service magically go…

Less chances to overlap with the RFC1918 address in a home network ? (a silent assumption here is that the CPEs are user-configurable in any way).

Or just that they had historically some 10/8 space already used elsewhere in the network ?

Note that they're not the only ones camping on DoD address space, I know a couple more folks who had to do it out of necessity at some point, under the assumption (flawed, sure) that DoD probably will never advertise them.

The best way to solve it is to go IPv6-only in management, and for those folks who are lucky enough to have had public IPv4 space for management purposes, that is one of the big drivers.

Re: BTAgent – CPE backdoor

#14

Post by chpp »

ay wrote: post #13
chpp wrote: post #11

I'm always surprised how few network guys are on HN. Every device in infrastructure should have a management address. This int is routed differently than the data interface. In a datacenter, management will be a separate physical int but telecom can't go running 2 cables into a house so it's a logical management int in that case. Comcast remotes into my modem all the time for management purposes (service magically go…

Less chances to overlap with the RFC1918 address in a home network ? (a silent assumption here is that the CPEs are user-configurable in any way). Or just that they had historically some 10/8 space already used elsewhere in the network ? Note that they're not the only ones camping on DoD address space, I know a couple more folks who had to do it out of necessity at some point, under the assumption (flawed, sure) that…

Out of the box these home routers all come with the same subnet (every linksys out of box runs 192.168.1.0/24 in the US ). Private addressing behind the box is meaningless in the telecom cloud. It's all NAT.

Could be 10/8 used elsewhere for some other network but us infrastructure guys are lazy. NAT that shit. I've never known an ISP to be a monument to best practices.

I've yet to come across any 30/8 subnets in my career. RFC1918 gives one a shit-ton of address space to work with. Bleeding into the 30/8 for necessity seems like something is wrong somewhere.

The fact ipv6 isnt more widely adopted reiterates my point above, engineers are lazy and NAT works. I've only known one company to use public ipv4 space for managment and they were a mess. I'd love to say using 30/8 is out of necessity or out of laziness but it's just oddly convenient.

Re: BTAgent – CPE backdoor

#15

Post by hahainternet »

nly wrote: post #10
lucaspiller wrote: post #7

Earlier quoted context omitted.

Is it a crime to reverse engineer routers provided by an ISP? (Honest question, I know things like MAC spoofing are illegal, which can be used in the UK to get free cable TV / Internet).

Not under EU law, but this is the UK we're talking about...

You know you tried to make that sound like you had any idea what you were talking about.

Re: BTAgent – CPE backdoor

#16

Post by Moral_ »

heromat wrote: post #9
samcrawford wrote: post #4

I was initially interested when I first saw this last year, but it turns out to be complete FUD. See http://www.revk.uk/2013/12/paraniod-ravings.html for the take on the original disclosures from the MD of one of the UK's most technical ISPs (and believe me, he's no fan of BT's). See also http://www.ispreview.co.uk/index.php/2013/12/confusion-alleg... In a nutshell, some ISPs will effectively hijack publicly routable…

No matter if he's right or not: it can't hurt to set up an additional firewall. TR-069 is scary enough.

Yeah, I packet captured what TR-069 (on my Actiontek C1000A) was sending to CenturyLink every day it included:

All the Mac address associated on the network.

The username/password to my router.

All the names of the computers associated on the network.

My WPS pin.

My SSID Name.

My WPA2 Password.

My old WEP Password.

How long each computer has been on the network.

Amongst other things.

It was pretty scary. Luckily I have root on the device, tr69 is no longer alive

Re: BTAgent – CPE backdoor

#17

Post by pyre »

samcrawford wrote: post #4

I was initially interested when I first saw this last year, but it turns out to be complete FUD. See http://www.revk.uk/2013/12/paraniod-ravings.html for the take on the original disclosures from the MD of one of the UK's most technical ISPs (and believe me, he's no fan of BT's). See also http://www.ispreview.co.uk/index.php/2013/12/confusion-alleg... In a nutshell, some ISPs will effectively hijack publicly routable…

Another example (Rogers Internet, Canada): The first hop after my router is IP 7.11.163.13 which is owned by the DoD.

Re: BTAgent – CPE backdoor

#18

Post by pyre »

chpp wrote: post #14
ay wrote: post #13

Earlier quoted context omitted.

Less chances to overlap with the RFC1918 address in a home network ? (a silent assumption here is that the CPEs are user-configurable in any way). Or just that they had historically some 10/8 space already used elsewhere in the network ? Note that they're not the only ones camping on DoD address space, I know a couple more folks who had to do it out of necessity at some point, under the assumption (flawed, sure) that…

Out of the box these home routers all come with the same subnet (every linksys out of box runs 192.168.1.0/24 in the US ). Private addressing behind the box is meaningless in the telecom cloud. It's all NAT. Could be 10/8 used elsewhere for some other network but us infrastructure guys are lazy. NAT that shit. I've never known an ISP to be a monument to best practices. I've yet to come across any 30/8 subnets in my c…

I worked for a company that was using some addresses in the 99/8 range (I don't remember what the narrower range was) internally. This occasionally caused issues when some ISPs started doling out those addresses.

Re: BTAgent – CPE backdoor

#19

Post by ay »

chpp wrote: post #14
ay wrote: post #13

Earlier quoted context omitted.

Less chances to overlap with the RFC1918 address in a home network ? (a silent assumption here is that the CPEs are user-configurable in any way). Or just that they had historically some 10/8 space already used elsewhere in the network ? Note that they're not the only ones camping on DoD address space, I know a couple more folks who had to do it out of necessity at some point, under the assumption (flawed, sure) that…

Out of the box these home routers all come with the same subnet (every linksys out of box runs 192.168.1.0/24 in the US ). Private addressing behind the box is meaningless in the telecom cloud. It's all NAT. Could be 10/8 used elsewhere for some other network but us infrastructure guys are lazy. NAT that shit. I've never known an ISP to be a monument to best practices. I've yet to come across any 30/8 subnets in my c…

"Out of the box these home routers all come with the same subnet" - if the customer has any way to change the router LAN subnet, this does not matter. Someone will put it to 10.x.x.x. My cable modem came from ISP with a default login from the LAN side which allows me to change pretty much anything I wish - if in BT setup they do not allow login, then that argument of mine would not make sense.

"NAT that" - sure, if you say so. Unless someone years ago already made that choice for you and you already have that management network.

"yet to come across any 30/8" - http://blog.erratasec.com/2013/12/dod-address-space-its-not-... - read the blogpost and comments.

Or http://networksavant.blogspot.fr/2013/05/70008.html

Or http://xerocrypt.wordpress.com/2013/12/07/the-adversaries-co...

http://www.ispreview.co.uk/index.php/2013/12/confusion-alleg...

Of course you also can use looking glasses (http://lg.he.net/, http://www.cogentco.com/en/network/looking-glass in case anyone to check me) to verify that 30/8 is not in the BGP tables, thus is not routed.

And even if it starts getting routed, e.g. someone makes a hijack, the space surely does not have to be 30/8 to be hijacked, as evidenced by e.g. http://research.dyn.com/2013/11/mitm-internet-hijacking/

And let me put a tinfoil hat on and ask: if I were to spy on the home routers and wanted to keep the whole affair in secret, would not assignment of less "hot" chunk of addressing space (like, for example, RFC1918), and then getting the access to the system that can use that range within this network keep me much lower under the radar ?

Post reply on HN