What were those fbi redacted things? Were those backdoors?
> The above response contained the physical addresses of several FBI field offices who were Cox business customers.
That's literally just FBI's customer account at Cox.
Hacking millions of modems and investigating who hacked my modem
21–30 of 282 posts
Re: Hacking millions of modems and investigating who hacked my modem
#22What were those fbi redacted things? Were those backdoors?
clients
Re: Hacking millions of modems and investigating who hacked my modem
#23Why do y’all think the attacker was replying all of his requests? Could they be probing for unintentionally exposed endpoints themselves?
Re: Hacking millions of modems and investigating who hacked my modem
#24What a great article. Very easy to follow. The best part was that instead of attacking the messenger and denying any problem, Cox seem to have acted like the very model of responsible security response in this kind of situation. I'd love to read a follow up on what the bug was that intermittently permitted unauthorised access to the APIs. It's the kind of error that could easily be missed by superficial testing or de…
agreed, lets hope they dont bloody sue him into the ground for "hacking"
Its stuff like this that company's should REWARD people for finding.
Re: Hacking millions of modems and investigating who hacked my modem
#25Earlier quoted context omitted.
In Germany one of the more popular modem/router/wifi devices among ISPs is FritzBox. You can also buy these devices yourself, which gives you both: you're using your own hardware instead of renting, and you benefit from long support thanks to aligning incentives from their big customers.
FritzBox are also very famous for getting service on lines where other vendors will just crap out. Their chipsets and tunings are top-notch. In addition, the backwards compatibility is amazing. It's 2024, and to my knowledge most of their models still support pulse dialling on the analog telephone frontend.
Although expensive, they've always had good fame (and I even had a friend working from them years ago), but something "funny" was going on with their routers some months ago...
Re: Hacking millions of modems and investigating who hacked my modem
#26Why do y’all think the attacker was replying all of his requests? Could they be probing for unintentionally exposed endpoints themselves?
If it was a request to a bank, say, it could have included all the cookies and tokens that would allow the request to go through successfully, and the attacker would gain access to their bank page (though if it was something super high security, you'd hope it would have single use tokens and stuff)
Re: Hacking millions of modems and investigating who hacked my modem
#27Why do y’all think the attacker was replying all of his requests? Could they be probing for unintentionally exposed endpoints themselves?
Outsource cost/risk of reporting the vulnerability?
Re: Hacking millions of modems and investigating who hacked my modem
#28> After reporting the vulnerability to Cox, they investigated if the specific vector had ever been maliciously exploited in the past and found no history of abuse
Would you trust a thing they say? It seems their whole network is swiss cheese.
Re: Hacking millions of modems and investigating who hacked my modem
#29page is now 404 :-/
Re: Hacking millions of modems and investigating who hacked my modem
#30Why do y’all think the attacker was replying all of his requests? Could they be probing for unintentionally exposed endpoints themselves?
If it was a request to a bank, say, it could have included all the cookies and tokens that would allow the request to go through successfully, and the attacker would gain access to their bank page (though if it was something super high security, you'd hope it would have single use tokens and stuff)
A request to a bank that doesn't use TLS would be near-criminal negligence (by the bank) in itself.
If the request does use TLS, then even a compromised router should be unable to decrypt it. TLS is end-to-end encryption.
If the request doesn't use TLS, then the compromised router can already see the request and response that it is relaying. So why does it have to replay the request from somewhere else? It can just exfiltrate the session back to the attacker silently, without replaying it first.
==
If I had to guess, the attacker isn't sure what they're looking for in the HTTP sessions, so they can't push a detection for interesting sessions down to the compromised routers, and they also don't have the bandwidth to simply receive all unencrypted traffic from their router botnet, so instead they're collecting the URLs and building up a list of detection patterns over time through scanning and using heuristics for which requests are worth investigating, something like that?