Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking millions of modems and investigating who hacked my modem

samcurry.net

Post reply on HN
Print view View original

121–130 of 282 posts

Re: Hacking millions of modems and investigating who hacked my modem

#121

Post by radlad »

mannyv wrote: post #118
axoltl wrote: post #117

Earlier quoted context omitted.

Is changing the WiFi SSID not executing a command on the device? It isn't _arbitrary_ commands (yet), but it's definitely executing _a_ command.

That's not the kind of vulnerability that would have installed an exploit on their CPE.

It's impossible to say without knowing what commands were available.

> This series of vulnerabilities demonstrated a way in which a fully external attacker with no prerequisites could've executed commands and modified the settings of millions of modems, accessed any business customer's PII, and gained essentially the same permissions of an ISP support team.

But the author agrees that this wasn't the vulnerability that allowed access to their own modem:

> After reporting the vulnerability to Cox, they investigated if the specific vector had ever been maliciously exploited in the past and found no history of abuse (the service I found the vulnerabilities in had gone live in 2023, while my device had been compromised in 2021). They had also informed me that they had no affiliation with the DigitalOcean IP address, meaning that the device had definitely been hacked, just not using the method disclosed in this blog post.

Re: Hacking millions of modems and investigating who hacked my modem

#122

Post by mannyv »

An open question is still: how were the attackers able to grab his HTTP traffic?

Some CPEs have a cloud Wireshark-like capability for debugging. I'm not sure if those are even on the Cox production firmware images. Usually there's a set of firmware for production and a set for test (which obviously makes it hard to test for problems in production).

I suppose Cox could do a check to see what firmware versions are out there. ISPs can auto-upgrade firmware that doesn't match a specific firmware revision, and this was a Cox modem so they probably have firmware for it. So if it was a debug firmware how did it get there and survive?

Re: Hacking millions of modems and investigating who hacked my modem

#123

Post by JKCalhoun »

kn100 wrote: post #93

Great read, and fantastic investigation. Also nice to see a story of some big corp not going nuclear on a security researcher. I can't say for certain, and the OP if they're here I'd love for you to validate this - but I'm not convinced requests to the local admin interface on these Nokia routers is properly authenticated. I know this because I recently was provisioned with one and found there were certain settings I…

> Cox is the largest private broadband provider in the United States, the third-largest cable television provider, and the seventh largest telephone carrier in the country. They have millions of customers and are the most popular ISP in 10 states.

That suggested to me that we shouldn't have ISPs that are this big. Cox is clearly a juicy target and a single vulnerability compromises, as an example from the article, even FBI field offices.

> After reporting the vulnerability to Cox, they investigated if the specific vector had ever been maliciously exploited in the past and found no history of abuse

Feel like author should have written "...they claimed to have investigated...".

Re: Hacking millions of modems and investigating who hacked my modem

#125

Post by JKCalhoun »

daneel_w wrote: post #48

> "...and found no history of abuse..." Because they didn't have enough logging or auditing to start with, or no logs or audit data left since the hack.

Or they lied.

I mean, if you think about it from Cox's point of view — why would you disclose to someone outside the company if there had been history of abuse? Why would you disclose anything at all in fact?

Re: Hacking millions of modems and investigating who hacked my modem

#126

Post by easterncalculus »

mannyv wrote: post #112

The intermittent auth thing in /profilesearch is a sign that they're round-robinning the servers and misconfigured one. Also, it looks like he hit a front-end API that drives the TR-069 backend. Changing the WiFi SSID is a long way from being able to "...execute commands on the device"

Being able to change the SSIDs for thousands or millions of customers remotely within a few hours would definitely be written about as an “outage” for Cox though.

Re: Hacking millions of modems and investigating who hacked my modem

#127

Post by depressedpanda »

unclebucknasty wrote: post #109
notactuallyben wrote: post #99

Earlier quoted context omitted.

while beg bounty people can be annoying, you have to remember that people aren't obligated to sit down and find free bugs for any company (especially not a big one) - why would i sit down and look at some code for free for some giant corp when i could go to the beach instead?

No, they aren't obligated. So, if there's no bug bounty program in place, then they should either go to the beach or be willing to find bugs for the public good. The idea that the company owes them anything for their unsolicited work is misguided. And, if they present the bugs for money under the implicit threat of selling the information to people who would harm the company, then it's extortion.

1. Companies are amoral entities, and given the opportunity have few qualms about screwing people over if they can profit from it. Why do you expect people to behave ethically towards entities that most likely won't treat them ethically?

2. If said person doesn't present the bug to the company, but just goes straight to selling it to the highest bidder it's not extortion. If the company does not provide the right incentives (via e.g. bug bounties), isn't it their own fault if they get pwnd? They clearly don't value security.

Re: Hacking millions of modems and investigating who hacked my modem

#128

Post by ipython »

mannyv wrote: post #122

An open question is still: how were the attackers able to grab his HTTP traffic? Some CPEs have a cloud Wireshark-like capability for debugging. I'm not sure if those are even on the Cox production firmware images. Usually there's a set of firmware for production and a set for test (which obviously makes it hard to test for problems in production). I suppose Cox could do a check to see what firmware versions are out…

also, yet another reason I don't trust (and don't use) any ISP provided equipment. Remote administration from my ISP? No thank you.

Re: Hacking millions of modems and investigating who hacked my modem

#129

Post by the_duke »

Bluecobra wrote: post #88

What sucks about this situation is when your ISP forces you to use their modem or router. For example, I have AT&T fiber and it does some kind of 802.1X authentication with certificates to connect to their network. If they didn't do this, I could just plug any arbitrary device into the ONT. There are/were workarounds to this but I don't want to go through all those hoops to get online. Instead, I ended up disabling e…

Always put your own router in-between.

If you really care you can configure a VPN directly on the router, so nothing leaves the network unencrypted.

Re: Hacking millions of modems and investigating who hacked my modem

#130

Post by mh- »

Bluecobra wrote: post #88

What sucks about this situation is when your ISP forces you to use their modem or router. For example, I have AT&T fiber and it does some kind of 802.1X authentication with certificates to connect to their network. If they didn't do this, I could just plug any arbitrary device into the ONT. There are/were workarounds to this but I don't want to go through all those hoops to get online. Instead, I ended up disabling e…

Fortunately, Cox isn't one of these. Any sufficiently modern DOCSIS modem, appropriate to the speed of service you subscribe to, is accepted.

Unfortunately, my praise of Cox ends there. I've been having intermittent packet loss issues for 2 years, and there doesn't appear to be a support escalation path available to me, so I can't reach anyone that will understand the data I've captured indicating certain nodes are (probably) oversubscribed.

Post reply on HN