WARNING: nerd sniping. lol
Hacking millions of modems and investigating who hacked my modem
111–120 of 282 posts
Re: Hacking millions of modems and investigating who hacked my modem
#112The intermittent auth thing in /profilesearch is a sign that they're round-robinning the servers and misconfigured one.
Also, it looks like he hit a front-end API that drives the TR-069 backend. Changing the WiFi SSID is a long way from being able to "...execute commands on the device"
Re: Hacking millions of modems and investigating who hacked my modem
#113What sucks about this situation is when your ISP forces you to use their modem or router. For example, I have AT&T fiber and it does some kind of 802.1X authentication with certificates to connect to their network. If they didn't do this, I could just plug any arbitrary device into the ONT. There are/were workarounds to this but I don't want to go through all those hoops to get online. Instead, I ended up disabling e…
The CPE AT&T router potentially getting hacked doesn't make much difference if you have your own router between your network and the AT&T network. Even if we removed the AT&T CPE router, you'd still be connecting to a black box you don't control that could be hacked or doing any number of inspections on your traffic.
Re: Hacking millions of modems and investigating who hacked my modem
#114Earlier quoted context omitted.
while beg bounty people can be annoying, you have to remember that people aren't obligated to sit down and find free bugs for any company (especially not a big one) - why would i sit down and look at some code for free for some giant corp when i could go to the beach instead?
No, they aren't obligated. So, if there's no bug bounty program in place, then they should either go to the beach or be willing to find bugs for the public good. The idea that the company owes them anything for their unsolicited work is misguided. And, if they present the bugs for money under the implicit threat of selling the information to people who would harm the company, then it's extortion.
I would agree with everything you said, If we ignore the fact that the company has billions of dollars in revenue and paying a bug bounty is a drop in the ocean for them.
Do you think it's reasonable to say the the ethics of what you call "extortion" should depend with how big the company is? I'm obviously not advocating for making a small company pay more than they can manage
Re: Hacking millions of modems and investigating who hacked my modem
#115Re: Hacking millions of modems and investigating who hacked my modem
#116Earlier quoted context omitted.
I assumed they offered a bounty for bug disclosure? You mean to tell me that an internet provider with 11 billion in revenue can't pay someone that found a bug impacting all their clients? Frankly he could have just sold the vulnerability to the highest bidder
> Frankly he could have just sold the vulnerability to the highest bidder Why? Ethics aside, is everything money?
>Why?
So this security researcher can keep doing his research without worrying about paying bills. The company gets cheap security audit, the researcher gets money, everybody wins
Re: Hacking millions of modems and investigating who hacked my modem
#117The intermittent auth thing in /profilesearch is a sign that they're round-robinning the servers and misconfigured one. Also, it looks like he hit a front-end API that drives the TR-069 backend. Changing the WiFi SSID is a long way from being able to "...execute commands on the device"
Is changing the WiFi SSID not executing a command on the device? It isn't _arbitrary_ commands (yet), but it's definitely executing _a_ command.
Re: Hacking millions of modems and investigating who hacked my modem
#118The intermittent auth thing in /profilesearch is a sign that they're round-robinning the servers and misconfigured one. Also, it looks like he hit a front-end API that drives the TR-069 backend. Changing the WiFi SSID is a long way from being able to "...execute commands on the device"
Is changing the WiFi SSID not executing a command on the device? It isn't _arbitrary_ commands (yet), but it's definitely executing _a_ command.
That's not the kind of vulnerability that would have installed an exploit on their CPE.
Re: Hacking millions of modems and investigating who hacked my modem
#119Earlier quoted context omitted.
it's good but the constant use of "super" was a little off-putting, "super curious", "super interesting", "super interested", etc.
There were 4 occurrences of the word "super" in an article with more than four thousand words in it, there is no need for "etc." you quoted all the occurrences since "super curious" was used twice.
I guess that reader is super sensitive.
Re: Hacking millions of modems and investigating who hacked my modem
#120What sort of authentication system just lets calls through randomly sometimes... The incompetence!
Discovered this in a vendor’s API. They registered the current user provider as singleton rather than per-request. So periodically you could ride on the coat-tails of an authenticated user.
I once seen a bug in a Django App which caused similar issues. Basically the app often returned a HTTP no content for successful calls from AJAX requests. So someone had DRYed that by having a global NoContentResponse in the file. The problem was that at some point in the Django middleware the users session token got affixed to the response - effectively logging anyone from that point on in as another user.