Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking millions of modems and investigating who hacked my modem

samcurry.net

Post reply on HN
Print view View original

191–200 of 282 posts

Re: Hacking millions of modems and investigating who hacked my modem

#191

Post by LeifCarrotson »

oasisbob wrote: post #136
phs318u wrote: post #2

What a great article. Very easy to follow. The best part was that instead of attacking the messenger and denying any problem, Cox seem to have acted like the very model of responsible security response in this kind of situation. I'd love to read a follow up on what the bug was that intermittently permitted unauthorised access to the APIs. It's the kind of error that could easily be missed by superficial testing or de…

> Cox seem to have acted like the very model of responsible security response in this kind of situation It's hard to imagine, but I wish they would have taken advantage of him walking in with the compromised device in the first place. I once stumbled upon a really bad vulnerability in a traditional telco provider, and the amount of work it took to get them to pay attention when only having the front door available wa…

> Took dedicated attempts over about a week to get in touch with the right people - their support org was completely ineffective at escalating the issue.

Sounds to me like their support org was reasonably effective at their real job, which is keeping the crazies away from the engineers.

It's even harder for me to imagine them saying "Oh, gee, thanks for discovering that! Please walk right into the office, our firmware developer Greg is hard at work on the next-gen router but you can interrupt him."

Re: Hacking millions of modems and investigating who hacked my modem

#192

Post by pixl97 »

unclebucknasty wrote: post #107
zdimension wrote: post #82

Earlier quoted context omitted.

At the same time, Cox is a commercial entity that makes money by providing services. Cyberattacks make them lose money, so it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. We're not talking about a grandma losing her wallet with 50 bucks in it and not giving money to the guy that found it and gave her back.

> it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. Yes, Cox has that choice . But, what you're describing is the definition of extortion. The fact that it's easy for people to get away with it does not make it ethical.

At the end of the day your enemy has no ethics, and we share the public internet with enemies. If paying to find security flaws means it's more likely people will find your flaws rather than sell them to someone that will use them for nefarious means then it is the better bet.

Re: Hacking millions of modems and investigating who hacked my modem

#193

Post by internetter »

Blackthorn wrote: post #186
thrwaway1985882 wrote: post #166

Earlier quoted context omitted.

Have you ever worked as a front-line support agent? I'm guessing not. I have many years ago, and for an ISP too. If I bought an Amazon share back then for every time a customer called support because they were "hacked", I'd not be posting here during a boring meeting because I'd own my own private island. The two best conversations I can recall were when we changed a customer's email address about a half dozen times…

You can tell exactly from the responses in this thread who has dealt with the general public in a support role, and who hasn't.

If the man wanted the router back, they should'a given the router back.

Re: Hacking millions of modems and investigating who hacked my modem

#194

Post by underlogic »

Did they *pay* him? He kind of saved them, tipped them off to a complete compromise of their security infrastructure which was not trivial to discover. Looks like he got nothing in return for "doing the right thing". How insulting is that? What is their perception of someone walking in to their offices with this essential information? I guarantee his self image and their perception are very different. They see an overly caffeinated attention seeking "nerd" just handed them a 300k exploit in exchange for a gold star and then they ran like smeg to cover their asses and take all the credit internally. He feels like superman, goes home to his basement apt, microwaves some noodles and writes a blogpost. This is a perfect example why you never, never report a 0day.

Re: Hacking millions of modems and investigating who hacked my modem

#195

Post by unclebucknasty »

imadr wrote: post #114
unclebucknasty wrote: post #109

Earlier quoted context omitted.

No, they aren't obligated. So, if there's no bug bounty program in place, then they should either go to the beach or be willing to find bugs for the public good. The idea that the company owes them anything for their unsolicited work is misguided. And, if they present the bugs for money under the implicit threat of selling the information to people who would harm the company, then it's extortion.

I would agree with everything you said, If we ignore the fact that the company has billions of dollars in revenue and paying a bug bounty is a drop in the ocean for them. Do you think it's reasonable to say the the ethics of what you call "extortion" should depend with how big the company is? I'm obviously not advocating for making a small company pay more than they can manage

>the company has billions of dollars in revenue and paying a bug bounty is a drop in the ocean

That framing is strange to me. If they want to offer a bug bounty, then they can. But, it's their choice. Maybe they'd instead rather engage a security firm of their own selection.

But, whatever the case, to say "they should pay the money because they can afford to" isn't right to me. I don't believe the definition of extortion changes based on how big the target is or whether it can afford to pay.

In fact, the line of thinking in some of the comments here is so far off from what seems obviously ethical to me that I've had to re-read a few times to ensure that I'm not missing something.

Re: Hacking millions of modems and investigating who hacked my modem

#196

Post by downrightmike »

underlogic wrote: post #194

Did they * pay* him? He kind of saved them, tipped them off to a complete compromise of their security infrastructure which was not trivial to discover. Looks like he got nothing in return for "doing the right thing". How insulting is that? What is their perception of someone walking in to their offices with this essential information? I guarantee his self image and their perception are very different. They see an ov…

Its Cox, probably lucky if they don't sue him for fixing their mistake

Re: Hacking millions of modems and investigating who hacked my modem

#198

Post by unclebucknasty »

pixl97 wrote: post #192
unclebucknasty wrote: post #107

Earlier quoted context omitted.

> it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. Yes, Cox has that choice . But, what you're describing is the definition of extortion. The fact that it's easy for people to get away with it does not make it ethical.

At the end of the day your enemy has no ethics, and we share the public internet with enemies. If paying to find security flaws means it's more likely people will find your flaws rather than sell them to someone that will use them for nefarious means then it is the better bet.

Making an argument for what's practical and what's ethical are two different things. My comment was about the latter. Yours appears to be about the former.

Ransomware victims have sometimes found it practical to pay the ransom. They're still victims of extortion.

Re: Hacking millions of modems and investigating who hacked my modem

#199

Post by internetter »

taspeotis wrote: post #7
mavamaarten wrote: post #5

What sort of authentication system just lets calls through randomly sometimes... The incompetence!

Discovered this in a vendor’s API. They registered the current user provider as singleton rather than per-request. So periodically you could ride on the coat-tails of an authenticated user.

This is ridiculously easy to do inside scripting languages like javascript

function foo(token: string) {}

function bar(token: string) {}

function baz(token: string) {}

// hmm, this is annoying

let token;

.get((req) => { token = req.data.headers.token }

function foo() {}

It is even possible to do it by "accident" with only subtly more complicated code! I constantly see secrets leak to the frontend because a company is bundling their backend and frontend together and using their frontend as a proxy. This lack of separation of concerns leads to a very easy exploit:

If I'm using, say, Next.js, and I want access to the request throughout the frontend, I should use context. Next even provides this context for you (though honestly even this is really really scary), but before my code was isomorphic I could just assign it to a variable and access that.

At least in regards to the scaryness of the next provided global context, at least now node has AsyncLocalStorage which properly manages scoping, but plenty of legacy...

The entire ecosystem is awful.

From my distrust in bundlers, I'm now fuzzing within CI for auth issues. Hitting the server 10k times as fast as possible from two different users and ensuring that there is no mixup. Also, scanning the client bundle for secrets. I haven't had an issue yet, but I've watched these things happen regularly and I know that this sort of test is not common

Post reply on HN