Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking millions of modems and investigating who hacked my modem

samcurry.net

Post reply on HN
Print view View original

211–220 of 282 posts

Re: Hacking millions of modems and investigating who hacked my modem

#211

Post by mandevil »

oasisbob wrote: post #150
tw04 wrote: post #146

Earlier quoted context omitted.

> Cox's support organization was presented with a compromised device being handed to them by an infosec professional, and they couldn't handle it effectively at all. He probably should have gone the responsible disclosure route with the modem too. Do you really expect a minimum wage front desk worker to be able to determine what’s a potential major security flaw, and what’s a random idiot who thinks his modem is brok…

I would expect a front-desk worker to be trained to escalate issues within the org, and supported in doing so.

Every third person who comes in has their router hacked, that's the problem. We know that Sam is good at what he does and to not be wrong about this, but Cox can't rely on everyone being that good, nor on their very poorly paid front-desk worker to have the ability to tell if they are an idiot or a expert.

Source: was a volunteer front-desk person at a museum. Spent a lot of my life dealing with people. They were sure of incorrect things all the time and could not be relied on to know.

In retrospect, Sam should definitely have hit the responsible disclosure page (if such a thing even existed in 2021) but I don't fault anyone for the choices they made here.

Re: Hacking millions of modems and investigating who hacked my modem

#213

Post by unclebucknasty »

bongodongobob wrote: post #208
unclebucknasty wrote: post #206

Earlier quoted context omitted.

> I think preventing people from having that incentive vs an actual threat are not the same, which is how I read the hypothetical. The following two sentences read the same to me: "To remove my incentive to harm you, you should pay me". "To remove my incentive to share information with others who may harm you, you should pay me". And, the threat is pretty clear IMO.

Do you not lock your doors because you feel you shouldn't have to worry about people stealing your stuff because it's morally wrong to steal or do you do it to mitigate risk? Suggesting someone should mitigate potential risk is all we are talking about.

You're making a different argument now.

https://news.ycombinator.com/item?id=40577683

Re: Hacking millions of modems and investigating who hacked my modem

#214

Post by globular-toast »

sammy2255 wrote: post #204
mannyv wrote: post #122

An open question is still: how were the attackers able to grab his HTTP traffic? Some CPEs have a cloud Wireshark-like capability for debugging. I'm not sure if those are even on the Cox production firmware images. Usually there's a set of firmware for production and a set for test (which obviously makes it hard to test for problems in production). I suppose Cox could do a check to see what firmware versions are out…

Its HTTP not HTTPS, anyone or anything on the wire could see the request

That's the part I didn't get. The author said there was no other possibility except the modem, but why? It seems like quite a leap. I would have first suspected a compromised router on the internet. Is it possible that changing the modem caused new routes to be used which appeared to fix the problem?

Re: Hacking millions of modems and investigating who hacked my modem

#215

Post by gh02t »

toast0 wrote: post #138
Bluecobra wrote: post #88

What sucks about this situation is when your ISP forces you to use their modem or router. For example, I have AT&T fiber and it does some kind of 802.1X authentication with certificates to connect to their network. If they didn't do this, I could just plug any arbitrary device into the ONT. There are/were workarounds to this but I don't want to go through all those hoops to get online. Instead, I ended up disabling e…

If you have the att fiber with the ONT separate from the modem, it's really easy to bypass 802.1X. Plug an unmanaged switch in between the modem and the ONT; let the modem auth; disconnect the modem. You'll likely need to do that again if the ONT reboots, but at least for me, ATT a UPS for the ONT, so reboot frequency should be low. Personally, I built up a rube goldberg of software and hardware with bypass nics so i…

If you have a router running PfSense Plus* and at least 3 ports, Netgate actually has pretty detailed instructions for how to do the bypass with their layer 2 routing feature. It sounds a bit complicated, but I followed along exactly as it says and it just worked for me. Has been 100% reliable for almost 2 years, and I get significantly better speed (something like 10-20% vs the built in "passthrough" mode on the gateway, iirc). Plus I managed to cut the suspicious DNS server the gateway tries to interject out of my network.

> https://docs.netgate.com/pfsense/en/latest/recipes/authbridg...

There's another method that doesn't require Plus called pfatt, but I'm not sure what the state of it is.

* Plus is the paid version, yeah I know I agree I don't like what they did with the licensing changes but that's a different story

Re: Hacking millions of modems and investigating who hacked my modem

#216

Post by matthew-wegner »

imzadi wrote: post #179
longsword wrote: post #76

i'm really glad that i can use my own modem. In germany every ISP is by law required to accept self brought modems. They can't force you to use their often shitty hardware. My current modem/router is up for 3 months without a single interruption to my connection.

FWIW, you can use your own modem and router with Cox internet, but most people don't because the provided modem is free and most people don't care to spend money on their own.

Cox can (and does) push firmware to bring-your-own modems, though.

Re: Hacking millions of modems and investigating who hacked my modem

#217

Post by mmsc »

mannyv wrote: post #122

An open question is still: how were the attackers able to grab his HTTP traffic? Some CPEs have a cloud Wireshark-like capability for debugging. I'm not sure if those are even on the Cox production firmware images. Usually there's a set of firmware for production and a set for test (which obviously makes it hard to test for problems in production). I suppose Cox could do a check to see what firmware versions are out…

If you create a socket with PF_PACKET you can intercept all the traffic on a Linux system on all interfaces. Think of a low-tech version of tcpdump.

Intercept all data on port 80, parse the http headers, do whatever you need with them, easy.

Not sure why anybody would replay the requests though.

Re: Hacking millions of modems and investigating who hacked my modem

#219

Post by TeMPOraL »

Great writeup. There's just one thing I don't get: the auth part. It seems the author managed to access protected endpoints without any auth, by just repeating the same request over and over until the endpoint randomly accepted it. The part that confuses me is, how could that possibly happen? What possible architecture could this system have to enable this specific failure mode?

I struggle to think of anything, short of auth handling being a separate service injected between a load balancer and the API servers, and someone somehow forgot to include that in autoscaling config; but surely this is not how you do things, is it?

Re: Hacking millions of modems and investigating who hacked my modem

#220

Post by nsbk »

thecodemonkey wrote: post #3

It's easy to hate on big companies. But can we just applaud Cox for having patched this within a day? That's incredible.

Seems more like a configuration error. Load balancer balancing over a few hosts, one of them missconfigured. Most likely over 2 hosts given the 50/50 success ratio of the intruder test. If that’s the case then it’s easy to fix in such timeframe
Post reply on HN