Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking millions of modems and investigating who hacked my modem

samcurry.net

Post reply on HN
Print view View original

61–70 of 282 posts

Re: Hacking millions of modems and investigating who hacked my modem

#61

Post by ThePowerOfFuet »

biosboiii wrote: post #32

Holy hell, but how are your laws in the US aligned so doing something like this is okay? In Germany you would get minimum 3 years in jail for this, people got in front of court for way way way way less.

>In Germany you would get minimum 3 years in jail for this, people got in front of court for way way way way less.

Great way to make sure researchers don't notify the victim of vulnerabilities, but rather stay quiet or sell it.

You'll note they never tried to change anything but their own equipment; doing otherwise would have been immoral and, yes, likely illegal. Without testing you have no idea whether or not you're actually looking at something that needs to be reported.

Re: Hacking millions of modems and investigating who hacked my modem

#62

Post by acdha »

senectus1 wrote: post #24
phs318u wrote: post #2

What a great article. Very easy to follow. The best part was that instead of attacking the messenger and denying any problem, Cox seem to have acted like the very model of responsible security response in this kind of situation. I'd love to read a follow up on what the bug was that intermittently permitted unauthorised access to the APIs. It's the kind of error that could easily be missed by superficial testing or de…

agreed, lets hope they dont bloody sue him into the ground for "hacking" Its stuff like this that company's should REWARD people for finding.

They have a pretty good looking responsible disclosure program which I’m assuming he checked first - it’d be surprising for someone who works in the field not to have that same concern:

https://www.cox.com/aboutus/policies/cox-security-responsibl...

Re: Hacking millions of modems and investigating who hacked my modem

#63

Post by pera »

thecodemonkey wrote: post #3

It's easy to hate on big companies. But can we just applaud Cox for having patched this within a day? That's incredible.

To be honest I would be very surprised if this was Cox as an organization and not just one or two very passionate workers who understood the severity of the issue and stayed after hours fixing it for free.

Re: Hacking millions of modems and investigating who hacked my modem

#64

Post by ale42 »

mschuster91 wrote: post #14
distances wrote: post #11

Earlier quoted context omitted.

In Germany one of the more popular modem/router/wifi devices among ISPs is FritzBox. You can also buy these devices yourself, which gives you both: you're using your own hardware instead of renting, and you benefit from long support thanks to aligning incentives from their big customers.

FritzBox are also very famous for getting service on lines where other vendors will just crap out. Their chipsets and tunings are top-notch. In addition, the backwards compatibility is amazing. It's 2024, and to my knowledge most of their models still support pulse dialling on the analog telephone frontend.

Are they still? I did try on a 5490 a few years ago and it totally ignored the pulses... an older one accepted the pulse dialling but it was not working all the time. Just tried with a single phone so maybe it was the phone ;-)

Re: Hacking millions of modems and investigating who hacked my modem

#65

Post by ale42 »

mschuster91 wrote: post #38
tecleandor wrote: post #25

Earlier quoted context omitted.

Although expensive, they've always had good fame (and I even had a friend working from them years ago), but something "funny" was going on with their routers some months ago... https://news.ycombinator.com/item?id=40106336

Yeah that's because they used .box as a custom TLD for decades and either didn't get the introduction of .box as a legitimate TLD or failed to secure fritz.box in time. Not the first time this has happened, and likely won't be the last either.

Currently the fritz.box domain seems to be owned by AVM (the makers of the FritzBox). Maybe it was just not existing and the local resolver on the box got confused? The domain was created in January and updated only a few days ago so things might actually have changed in the meantime...

Re: Hacking millions of modems and investigating who hacked my modem

#66

Post by rwmj »

fragmede wrote: post #41
rwmj wrote: post #28

> After reporting the vulnerability to Cox, they investigated if the specific vector had ever been maliciously exploited in the past and found no history of abuse Would you trust a thing they say? It seems their whole network is swiss cheese.

this is why everything gets logged to an S3 bucket under an AWS account that has only write permissions and three people are required to break into the account that can do anything else with that bucket. I don't know if that's what Cox has, but that's how it's architect it to be able to claim there's no history of abuse.

That's how it should be architected, but the article shows that Cox's network gives no thought to security so it's unlikely how it is architected. Even if the Cox answer is correct to the best of their knowledge, we can't rule out that attackers are inside the network wiping out their logs.

Re: Hacking millions of modems and investigating who hacked my modem

#67

Post by acdha »

rbut wrote: post #39
mavamaarten wrote: post #5

What sort of authentication system just lets calls through randomly sometimes... The incompetence!

The API was reverse proxied. Possibly a caching issue?

That was my thought, as well - it’s easy to imagine this calling some internal APIs which aren’t great, leading someone to toss a cache in front of a few calls but botching the logic so the cache is always populated even on errors. I’ve seen a few cases where people tried to bolt something like that onto Java/Python APIs designed to raise exceptions when validation failed so it was especially easy to overlook the error path because the code was written to focus on the successful flow.

Re: Hacking millions of modems and investigating who hacked my modem

#68

Post by mschuster91 »

ale42 wrote: post #65
mschuster91 wrote: post #38

Earlier quoted context omitted.

Yeah that's because they used .box as a custom TLD for decades and either didn't get the introduction of .box as a legitimate TLD or failed to secure fritz.box in time. Not the first time this has happened, and likely won't be the last either.

Currently the fritz.box domain seems to be owned by AVM (the makers of the FritzBox). Maybe it was just not existing and the local resolver on the box got confused? The domain was created in January and updated only a few days ago so things might actually have changed in the meantime...

Some scammers front-ran the registration to run NFT bullshit, AVM eventually managed to pull the domain with ICANN URS [1].

[1] https://www.heise.de/news/Fritz-box-Domain-aus-dem-Verkehr-g...

Re: Hacking millions of modems and investigating who hacked my modem

#69

Post by tuetuopay »

daneel_w wrote: post #48

> "...and found no history of abuse..." Because they didn't have enough logging or auditing to start with, or no logs or audit data left since the hack.

from what I can gather from the post, the specific attack vector using "retry unauthorized requests until they are" is very easy to spot in logs. so even the most basic log policy that logs the path, ip, and status code is enough (i.e. default in most web servers and frameworks)

Re: Hacking millions of modems and investigating who hacked my modem

#70

Post by yonatan8070 »

megous wrote: post #6

One of the reasons to not be excited about ISP provided cable modems with WiFi functionality and to have good endpoint/service security on your LAN. (TLS, DNS over TLS at least accross the modem/ISP) I just put it in bridge mode, disable wifi, and all network functionality is served by my own devices. The last modem I rented from ISP, the ISP didn't bother with any firmware updates for ~10 years. It was rock stable b…

I just told my ISP, either I use my own router, or I switch to a different ISP.
Post reply on HN