Hacking millions of modems and investigating who hacked my modem
1–10 of 282 posts
Re: Hacking millions of modems and investigating who hacked my modem
#2What a great article. Very easy to follow. The best part was that instead of attacking the messenger and denying any problem, Cox seem to have acted like the very model of responsible security response in this kind of situation. I'd love to read a follow up on what the bug was that intermittently permitted unauthorised access to the APIs. It's the kind of error that could easily be missed by superficial testing or depending on the reason behind the bug, perhaps not even experienced in the test environment.
Re: Hacking millions of modems and investigating who hacked my modem
#3It's easy to hate on big companies. But can we just applaud Cox for having patched this within a day? That's incredible.
Re: Hacking millions of modems and investigating who hacked my modem
#4Great read, I loved following your thought process as you kept digging.
At what point did you inform Cox about your findings? It doesn't sound like you were ever given the green light to poke at their management platform. Isn't work like this legally dubious, even if it is done purely in white-hat fashion?
Re: Hacking millions of modems and investigating who hacked my modem
#5What sort of authentication system just lets calls through randomly sometimes... The incompetence!
Re: Hacking millions of modems and investigating who hacked my modem
#6One of the reasons to not be excited about ISP provided cable modems with WiFi functionality and to have good endpoint/service security on your LAN. (TLS, DNS over TLS at least accross the modem/ISP)
I just put it in bridge mode, disable wifi, and all network functionality is served by my own devices.
The last modem I rented from ISP, the ISP didn't bother with any firmware updates for ~10 years. It was rock stable because of that, though. :)
Re: Hacking millions of modems and investigating who hacked my modem
#7What sort of authentication system just lets calls through randomly sometimes... The incompetence!
Discovered this in a vendor’s API. They registered the current user provider as singleton rather than per-request. So periodically you could ride on the coat-tails of an authenticated user.
Re: Hacking millions of modems and investigating who hacked my modem
#8It's easy to hate on big companies. But can we just applaud Cox for having patched this within a day? That's incredible.
That was the most shocking part of the entire article! Unfortunate this vuln existed but clearly engineers there have enough teeth to get stuff done.
Re: Hacking millions of modems and investigating who hacked my modem
#9It's easy to hate on big companies. But can we just applaud Cox for having patched this within a day? That's incredible.
Agreed. Bugs happen, bug fixes don’t always happen (especially quickly)
That being said, we could all do with a bit more input sanitization, and I hope Cox learned their lesson here.
Re: Hacking millions of modems and investigating who hacked my modem
#10One of the reasons to not be excited about ISP provided cable modems with WiFi functionality and to have good endpoint/service security on your LAN. (TLS, DNS over TLS at least accross the modem/ISP) I just put it in bridge mode, disable wifi, and all network functionality is served by my own devices. The last modem I rented from ISP, the ISP didn't bother with any firmware updates for ~10 years. It was rock stable b…
Counterpoint: ISP with over 1M customers have the incentives of upgrading their HGW "forever" to reduce Capex. My employer (Free, French ISP also shipping HGW to Italia as Iliad) still upgrade their HGW released in 2011 (though if you have yours dating back from 2011, have it replaced (your oled screen is probably dead ;) to get more recent wifi cards).
It runs a modern Linux 6.4. You get modern nifties like airtime QoS, got upgraded mobile apps if you wish, and uh lots of software features.