Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking millions of modems and investigating who hacked my modem

samcurry.net

Post reply on HN
Print view View original

261–270 of 282 posts

Re: Hacking millions of modems and investigating who hacked my modem

#261

Post by definitelyauser »

TeMPOraL wrote: post #219

Great writeup. There's just one thing I don't get: the auth part. It seems the author managed to access protected endpoints without any auth, by just repeating the same request over and over until the endpoint randomly accepted it. The part that confuses me is, how could that possibly happen ? What possible architecture could this system have to enable this specific failure mode? I struggle to think of anything, shor…

> how could that possibly happen?

Global singleton shared across requests, instead of request scoped.

1. [Client 1/You] Auth/write to variable (failed).

2. [Client 2/ISP] Auth/write to variable (success).

3. Verify what the result was (success)

A race condition combined with a global singleton can easily explain such behavior.

Re: Hacking millions of modems and investigating who hacked my modem

#262

Post by Namidairo »

> Somehow, someone was intercepting and replaying the web traffic from likely every single device on my home network.

Normally I'd laugh and assume device compromise but...

The largest ISP in Australia (Telstra) got caught doing exactly this over a decade ago. People got extra paranoid when they noticed the originating IP was from Rackspace as opposed to within Telstra. Turned out to be a filter vendor scraping with dubious acceptance from customers. The ToS was quietly and promptly updated.

Re: Hacking millions of modems and investigating who hacked my modem

#263

Post by kalleboo »

Blackthorn wrote: post #186
thrwaway1985882 wrote: post #166

Earlier quoted context omitted.

Have you ever worked as a front-line support agent? I'm guessing not. I have many years ago, and for an ISP too. If I bought an Amazon share back then for every time a customer called support because they were "hacked", I'd not be posting here during a boring meeting because I'd own my own private island. The two best conversations I can recall were when we changed a customer's email address about a half dozen times…

You can tell exactly from the responses in this thread who has dealt with the general public in a support role, and who hasn't.

I haven't even dealt with the general public in a support role but I have enough examples just in my, not very large, social circle.

The aunt who is convinced she has a stalker who is hacking all her devices and moving icons around and renaming files to mess with her (watching her use the computer, she has trouble with clicking/double-clicking and brushing up against the mouse/trackpad. call her out on it, she says she didn't do it)

The coworker who was a college football player, who now has TBI-induced paranoia. He was changing his passwords about 3 times a day. Last thing I heard about him before he got cut out of my social circle was he got in a car accident because he was changing his password while he was driving.

Meanwhile I know zero people who have found any real vulnerabilities.

Re: Hacking millions of modems and investigating who hacked my modem

#264

Post by sgarland »

buildbuildbuild wrote: post #251
oasisbob wrote: post #136

Earlier quoted context omitted.

> Cox seem to have acted like the very model of responsible security response in this kind of situation It's hard to imagine, but I wish they would have taken advantage of him walking in with the compromised device in the first place. I once stumbled upon a really bad vulnerability in a traditional telco provider, and the amount of work it took to get them to pay attention when only having the front door available wa…

I’ve often wished I could show an “I know what I’m doing” badge to support to guarantee escalation. “I’m a three star infosec General, if I’m contacting you it’s not to waste your time.”

I have a cloned key from a spare modem that I use with my router (Unifi) to allow it to connect directly to the ONT, minimizing devices in my rack.

I’ve found that this usually confuses first line support enough that they’ll listen to me if I need them to do some specific action.

To be clear, I’m not stealing internet access or anything of the sort. I didn’t want a useless modem / AP that I’d end up bridging anyway, so I extracted a key from another one, and my router uses it to auth with my ISP.

Re: Hacking millions of modems and investigating who hacked my modem

#265

Post by jfyi »

Blackthorn wrote: post #186
thrwaway1985882 wrote: post #166

Earlier quoted context omitted.

Have you ever worked as a front-line support agent? I'm guessing not. I have many years ago, and for an ISP too. If I bought an Amazon share back then for every time a customer called support because they were "hacked", I'd not be posting here during a boring meeting because I'd own my own private island. The two best conversations I can recall were when we changed a customer's email address about a half dozen times…

You can tell exactly from the responses in this thread who has dealt with the general public in a support role, and who hasn't.

I have escalated customer security issues while working as a support agent. I have also found and been paid what could be considered a bounty (in the form of a bet made by the lead dev to another person) while working support.

Admittedly, this is anecdotal, and it was a small company, and my skillset was being very underutilized at the time. However, I don't think it's hard to imagine a me that would have been closed minded enough to normalize my experiences and expect it of others. In fact, I'd say I still fight with it regardless of having seen it.

Re: Hacking millions of modems and investigating who hacked my modem

#266

Post by lanrat »

I observed very similar behavior a few years back when transferring files between two servers under my control on different parts of a large university network.

We also initially thought we were the subject of a breach, but after the investigation we determined that the network's IDS was monitoring all traffic, and upon certain triggers, would make identical requests from external networks.

We found a way to identify all other similar IDSs across the internet and even "weaponize" this behavior. We ended up writing a paper on it: https://ian.ucsd.edu/papers/cset2023_fireye.pdf

Re: Hacking millions of modems and investigating who hacked my modem

#267

Post by jfyi »

robertlagrant wrote: post #256
bayindirh wrote: post #187

Earlier quoted context omitted.

There's a difference between doing your job and earning money as a result vs. finding keys to someone's house and selling said keys to the highest bidder.

Yes: ethics.

Some of us can get there without the organized principles simply with empathy. It's even deeply selfish in it's own way.

Ethics is our answer for those that can't.

Re: Hacking millions of modems and investigating who hacked my modem

#268

Post by megous »

bootsmann wrote: post #16
megous wrote: post #6

One of the reasons to not be excited about ISP provided cable modems with WiFi functionality and to have good endpoint/service security on your LAN. (TLS, DNS over TLS at least accross the modem/ISP) I just put it in bridge mode, disable wifi, and all network functionality is served by my own devices. The last modem I rented from ISP, the ISP didn't bother with any firmware updates for ~10 years. It was rock stable b…

Routers are the most exploited IoT devices on the planet, often vulnerabilities in the router firmware persist for years without getting patched because most endusers don't patch their routers. The ISP having a way to play patches onto router and recall unpatchable ones (because they own them) is a net gain for cyber security.

Yes, I agree that routers are key and critical.

Otherwise I would not be managing my own high quality one, based on the latest Linux kernel, and a standard, well supported and maintained software and carefully selected wifi HW with active manufacturer provided support.

I also would not be trying to isolate and disable most of the ISP provided HW/FW mess, if I believed otherwise. I don't trust ISP that did not upgrade their modem in 10 years, one bit with security of key entry point to my home network.

Re: Hacking millions of modems and investigating who hacked my modem

#269

Post by megous »

matheusmoreira wrote: post #50
megous wrote: post #6

One of the reasons to not be excited about ISP provided cable modems with WiFi functionality and to have good endpoint/service security on your LAN. (TLS, DNS over TLS at least accross the modem/ISP) I just put it in bridge mode, disable wifi, and all network functionality is served by my own devices. The last modem I rented from ISP, the ISP didn't bother with any firmware updates for ~10 years. It was rock stable b…

> I just put it in bridge mode, disable wifi, and all network functionality is served by my own devices. Same. Somehow I got them to install a simple modem, one without all of the router and access point features. I thought those single purpose devices didn't exist anymore. Bought a relatively good router, installed OpenWRT on it then bridged it to the ISP's network via their equipment. It's working well. I even have…

One interesting thing I found was that the newer Vodafone cable modem with 4 ethernet ports, after switching to bridge mode, assigns public IPv4 address to at most 1 network node connected to each wired port. So it's possible to get 4 stable public IPv4 addresses assigned to my home network and use them for whatever.

It's not a great idea to host services (especially if they can be used to identify you) on a home IP address you browse the internet with, and this is one way to get 1 IP address for browsing the net, and different 1 for serving services from home, pretty much for free.

Re: Hacking millions of modems and investigating who hacked my modem

#270

Post by sgerenser »

randomcarbloke wrote: post #51
phs318u wrote: post #2

What a great article. Very easy to follow. The best part was that instead of attacking the messenger and denying any problem, Cox seem to have acted like the very model of responsible security response in this kind of situation. I'd love to read a follow up on what the bug was that intermittently permitted unauthorised access to the APIs. It's the kind of error that could easily be missed by superficial testing or de…

it's good but the constant use of "super" was a little off-putting, "super curious", "super interesting", "super interested", etc.

IMHO, your comment is super nitpicky.
Post reply on HN