Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN users unmasked by zero-day vulnerability in Virgin Media routers

portswigger.net

Post reply on HN
Print view View original

71–80 of 97 posts

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#71

Post by ArchOversight »

joecool1029 wrote: post #56
lebrad wrote: post #55

Earlier quoted context omitted.

Comcast makes you downgrade to a business account if you want to get a reverse DNS entry from them. Reverse DNS is a requirement if you want to host your own e-mail and not have your mail categorized as spam. Comcast business accounts don't allow you to use your own DOCSIS modem.

>Comcast business accounts don't allow you to use your own DOCSIS modem. Not true. I have multiple business locations using customer owned surfboards. Might be a requirement for static addresses but it's not for business service in general.

You only need their Comcast Business modem if you have static IP's because they route them using RIP with a password that is set inside the cable modem with their custom software.

If you don't have a static IP with Comcast Business it makes it awfully hard to run a mail server, but then you can indeed use your own cable modem.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#72

Post by dangerface »

LilBytes wrote: post #48
Semaphor wrote: post #40

Earlier quoted context omitted.

That makes sense. After all, I weirdly had to use their webinterface to even put it into modem mode. Thanks. Though now that I’m thinking of it, are you sure it uses IP? It’s not as if they can’t use other layers.

Can't speak for all Telco's but in Australia, DOCSIS modems are registered by their MAC address on the modem it's self. Not by IP address. I can't imagine this is different else where so it's likely the replying comment above yours is incorrect. Source: I was previously a network engineer for a national Telco. Other sources: DOCSIS 3.0 registration info: https://volpefirm.com/docsis-3-0-cable-modem-registration/

Virgin used to just use the mac address with their old modems, you could flash the firmware and change the mac so you could buy their cheapest package and flash the mac of a modem with unlimited gbit internet. They craked down on that a few years ago tho so I don't think this is possible anymore.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#73

Post by lxgr »

LilBytes wrote: post #48
Semaphor wrote: post #40

Earlier quoted context omitted.

That makes sense. After all, I weirdly had to use their webinterface to even put it into modem mode. Thanks. Though now that I’m thinking of it, are you sure it uses IP? It’s not as if they can’t use other layers.

Can't speak for all Telco's but in Australia, DOCSIS modems are registered by their MAC address on the modem it's self. Not by IP address. I can't imagine this is different else where so it's likely the replying comment above yours is incorrect. Source: I was previously a network engineer for a national Telco. Other sources: DOCSIS 3.0 registration info: https://volpefirm.com/docsis-3-0-cable-modem-registration/

Registration/network access and management are two different things, no?

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#74

Post by lxgr »

dangerface wrote: post #72
LilBytes wrote: post #48

Earlier quoted context omitted.

Can't speak for all Telco's but in Australia, DOCSIS modems are registered by their MAC address on the modem it's self. Not by IP address. I can't imagine this is different else where so it's likely the replying comment above yours is incorrect. Source: I was previously a network engineer for a national Telco. Other sources: DOCSIS 3.0 registration info: https://volpefirm.com/docsis-3-0-cable-modem-registration/

Virgin used to just use the mac address with their old modems, you could flash the firmware and change the mac so you could buy their cheapest package and flash the mac of a modem with unlimited gbit internet. They craked down on that a few years ago tho so I don't think this is possible anymore.

Modern DOCSIS also uses certificate-based authentication.

Only the owner of a given MAC OUI is able to create a certificate covering MACs under it that will be accepted by the CMTS.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#75

Post by SkyPuncher »

RicoElectrico wrote: post #20
johnklos wrote: post #2

Nobody should use ISP provided equipment for anything security sensitive, ever. ISPs don't care about security at all, aside from "security" as a sales term, and aside from when they're getting a bad name because of egregious failures. ARRIS shouldn't be given a year embargo, either. They're the same company who've known since 2016 about hardware issues which cannot be corrected in software in the Intel PUMA chipsets…

Yeah, avoid ARRIS whenever you can. Their modems make cable internet a dreadful experience, which it shouldn't have been. Here's the list with modems affected by the hardware bug you mentioned: https://www.badmodems.com/

Holy shit. I've been dealing with this for the past 2 years and it's infuriating. I've tried everything and eventually diagnosed it as a bug in my modem. Random latency spikes, unbelievably jittery internet calls, hard to diagnose.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#76

Post by stordoff »

madjam002 wrote: post #22

These endpoints are available in modem only mode, but everyone I’ve asked who has a SH3 says that they’re not affected by this and the endpoint doesn’t return the IP address. If you’re in modem only mode, block HTTP traffic to 192.168.100.1 outbound from your firewall just to be sure. Seems relatively low impact, but still pretty bad. Not surprising from VM given the quality of their firmware.

> everyone I’ve asked who has a SH3 says that they’re not affected by this and the endpoint doesn’t return the IP address

What does it return in modem only mode? I've verified that /snmpGet?oid=1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1 on my Hub 3 returns:

> { > "1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1":"$xxxxxxxx" [public IP address encoded in hexadecimal] > }

but I can't currently test it in modem only mode.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#77

Post by lxgr »

mindslight wrote: post #32
lxgr wrote: post #30

Earlier quoted context omitted.

Arguably, a setup using a VPN for anonymity purposes is badly flawed if it allows traffic to anything but the VPN gateway. This includes the local network. Mediocre home appliances or (as in this case) ISP CPEs can easily deanonymize you.

Yes, but you do want deliberate access to specific services on the local network. Mainly NFS exports and the like.

Yes, but that's a deliberate security–convenience trade off then.

One solution is to use proxy servers or per-app VPNs (without local network access) instead of a system-wide VPN, and effectively partition applications into trusted and untrusted ones.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#79

Post by silisili »

treesknees wrote: post #33
thejetset wrote: post #3

Earlier quoted context omitted.

I think generally you don't get a choice when it comes to DOCSIS equipment. You can't just connect up your own (or at least no to Virgin Media's network)

This is one of the few positives I'll give to Comcast/Xfinity. I'm able to purchase my own DOCSIS modem (as long as it's on their compatibility list) instead of renting one from them. AT&T U-verse I couldn't bring my own modem, and I understand that they're not a DOCSIS network either.

ATT is really weird about it. They apparently decided a few years back that they'd not allow third party devices on their network, and keep doubling down on it.

Some folks smarter than myself figured out how to mimic the ONT handshakes or some such that they could use their own devices. IIRC, they were pulling the certs from the ATT box. ATT then came in and installed new stuff at the station to not allow that anymore. I don't remember all the technical details, but that's what I found when I spent an hour or so researching how to get rid of their awful box. In short, you can't...and even if you manage to, it won't be for long.

Re: VPN users unmasked by zero-day vulnerability in Virgin Media routers

#80

Post by stronglikedan »

johnklos wrote: post #2

Nobody should use ISP provided equipment for anything security sensitive, ever. ISPs don't care about security at all, aside from "security" as a sales term, and aside from when they're getting a bad name because of egregious failures. ARRIS shouldn't be given a year embargo, either. They're the same company who've known since 2016 about hardware issues which cannot be corrected in software in the Intel PUMA chipsets…

Heck, AT&T won't even let you change the wifi password if you use their router. Well, you can change it, but it will revert to whatever's on the sticker when the router updates itself. And they will tell you this with a straight face. Incredible.
Post reply on HN