Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking millions of modems and investigating who hacked my modem

samcurry.net

Post reply on HN
Print view View original

41–50 of 282 posts

Re: Hacking millions of modems and investigating who hacked my modem

#41

Post by fragmede »

rwmj wrote: post #28

> After reporting the vulnerability to Cox, they investigated if the specific vector had ever been maliciously exploited in the past and found no history of abuse Would you trust a thing they say? It seems their whole network is swiss cheese.

this is why everything gets logged to an S3 bucket under an AWS account that has only write permissions and three people are required to break into the account that can do anything else with that bucket. I don't know if that's what Cox has, but that's how it's architect it to be able to claim there's no history of abuse.

Re: Hacking millions of modems and investigating who hacked my modem

#42

Post by gediz »

phs318u wrote: post #2

What a great article. Very easy to follow. The best part was that instead of attacking the messenger and denying any problem, Cox seem to have acted like the very model of responsible security response in this kind of situation. I'd love to read a follow up on what the bug was that intermittently permitted unauthorised access to the APIs. It's the kind of error that could easily be missed by superficial testing or de…

[dead]

Re: Hacking millions of modems and investigating who hacked my modem

#43

Post by hifromwork »

biosboiii wrote: post #36
cjbprime wrote: post #34

Earlier quoted context omitted.

For the researcher? Because the vendor has a responsible disclosure program. Because they'd rather know about the bugs. (As for the vendor, I'm sympathetic to the argument that there should be vendor liability under some circumstances.)

In Germany it is common for vendors to acknowledge the security flaw you send to them, but if you want to publish it (and damage their reputation by doing so) they are going to try you in court, and win. Sometimes they even try you in court if you don't publish it (yet)

To be fair, Germany is unusually harsh on security researchers. As far as I know (but German law is not my forte) there's no exclusion for "ethical hacking". I remember reading about many German cases that went like:

* A security researcher discovers that the main database of some service is available publicly with default password * They notify the company * They get sued for unauthorized access to the company's data

This wouldn't happen in my (also European) jurisdiction, because as long as your intention is to fix the vulnerability you found, and you notify the company about the problem, you're in the clear.

Re: Hacking millions of modems and investigating who hacked my modem

#44

Post by cqqxo4zV46cp »

imadr wrote: post #31
senectus1 wrote: post #24

Earlier quoted context omitted.

agreed, lets hope they dont bloody sue him into the ground for "hacking" Its stuff like this that company's should REWARD people for finding.

I assumed they offered a bounty for bug disclosure? You mean to tell me that an internet provider with 11 billion in revenue can't pay someone that found a bug impacting all their clients? Frankly he could have just sold the vulnerability to the highest bidder

Don’t frame a company not parting ways with money that they could hypothetically part ways with as being unusually egregious. That’s never how it works. Not every conversation needs overstated outrage.

Re: Hacking millions of modems and investigating who hacked my modem

#45

Post by hifromwork »

uyzstvqs wrote: post #35
wouldbecouldbe wrote: post #20

This is seems like a huge vulnerability, are there any legal repercussion that happens in those situations?

I hope not. Companies would close their responsible disclosure programs as a liability issue. Everything would be less secure because of such legal protections.

Agreed. On the other hand, there should be legal repercussions if the vulnerability was found exploited in the wild (in Europe this is partially handled by GDPR, but AFAIK only if it can be shown that personal data is affected - not a lawyer obviously).

This aligns incentives nicely:

* Company creates a responsible disclosure program, users/researchers report problems for money/blog post fame, users are secure. Also security team becomes more important, because vulnerabilities cost (more) actual money. * Or company doesn't create a responsible disclosure program, someone exploits the bug in the wild, users are angry and the company is fined.

Re: Hacking millions of modems and investigating who hacked my modem

#46

Post by [deleted] »

cjbprime wrote: post #30
voidUpdate wrote: post #26

Earlier quoted context omitted.

If it was a request to a bank, say, it could have included all the cookies and tokens that would allow the request to go through successfully, and the attacker would gain access to their bank page (though if it was something super high security, you'd hope it would have single use tokens and stuff)

A request to a bank that doesn't use TLS would be near-criminal negligence (by the bank) in itself. If the request does use TLS, then even a compromised router should be unable to decrypt it. TLS is end-to-end encryption. If the request doesn't use TLS, then the compromised router can already see the request and response that it is relaying. So why does it have to replay the request from somewhere else? It can just e…

[deleted]

Re: Hacking millions of modems and investigating who hacked my modem

#47

Post by rnbrady »

zaptrem wrote: post #23

Why do y’all think the attacker was replying all of his requests? Could they be probing for unintentionally exposed endpoints themselves?

If they didn't have RCE but could push config to the router, they might have pushed a syslog destination and then mined the logs. URLs for uncrypted HTTP requests could end up in the logs due to ALG, parental filtering or any other numbers of features. If you replayed such URLs from a large enough set of victims over a long enough period of time, you'd find something valuable in a response sooner or later.

Re: Hacking millions of modems and investigating who hacked my modem

#49

Post by porbelm »

hifromwork wrote: post #40
biosboiii wrote: post #32

Holy hell, but how are your laws in the US aligned so doing something like this is okay? In Germany you would get minimum 3 years in jail for this, people got in front of court for way way way way less.

Cox has a responsible disclosure program: https://www.cox.com/aboutus/policies/cox-security-responsibl... . In my opinion (as a security engineer) the biggest benefit of such programs is not amoral "hackers will always sell exploits to the highest bidder so companies must provide a high bounty for bugs in their software"[1] but "having a responsible disclosure process makes it totally clear that it's ok to report vul…

Yeah when a company says one of their responsible disclosure rules amounts to "just don't ruin our prod system, or reveal or steal data pls" they basically invite you to try and break in - responsibly.

Re: Hacking millions of modems and investigating who hacked my modem

#50

Post by matheusmoreira »

megous wrote: post #6

One of the reasons to not be excited about ISP provided cable modems with WiFi functionality and to have good endpoint/service security on your LAN. (TLS, DNS over TLS at least accross the modem/ISP) I just put it in bridge mode, disable wifi, and all network functionality is served by my own devices. The last modem I rented from ISP, the ISP didn't bother with any firmware updates for ~10 years. It was rock stable b…

> I just put it in bridge mode, disable wifi, and all network functionality is served by my own devices.

Same. Somehow I got them to install a simple modem, one without all of the router and access point features. I thought those single purpose devices didn't exist anymore.

Bought a relatively good router, installed OpenWRT on it then bridged it to the ISP's network via their equipment. It's working well. I even have HTTPS in my LAN now.

Post reply on HN