44 ms·

SharknAT&To: Vulnerabilities in AT&T U-verse modems

344 points by dankohn1 9y ago

kogepathic 9y ago
I think at a certain point someone needs to be held criminally liable for situations such as this one. A VW engineer is likely going to jail over dieselgate. We have already seen that such insecure internet connected devices can be easily and quickly assembled into a botnet. The operators of such a network can direct the attacks at healthcare institutions, national infrastructure, and other safety critical systems. At some point, there has to be stricter consequences for companies than simply a fine. C-levels won't start paying attention to security until there's the real possibility that their ass will end up in jail for this kind of insecurity.
- QUFB 9y ago
  What laws would you propose to eliminate insecure software?
  - marcoperaza 9y ago
    Bruce Schneier has speculated about creating mandatory legal liability for software vendors and service providers. Liability regimes are a major reason why physical products are so safe. https://www.schneier.com/essays/archives/2003/11/liability_changes_ev.html https://www.schneier.com/essays/archives/2003/11/liability_c...
    - ryandrake 9y ago
      Say goodbye to open source, then, unless he proposes a special carve-out for it.
      - marcoperaza 9y ago
        He has some commentary on this well: https://www.schneier.com/blog/archives/2008/07/software_liabil.html https://www.schneier.com/blog/archives/2008/07/software_liab... In summary, there wouldn't be liability for open source developers because there is no business contract. But if you run a website with open source software, you of course would still be liable for anything that happens to your customers' data. So you would probably want to buy that same open source software from someone (e.g. Red Hat), who would also be liable.
        smsm42 9y ago
        Which means, hosting/supporting open source would quickly become not worth it for any major company representing a large target for opportunistic lawyers. When you make millions from a product, you can afford a team of lawyers setting up contacts just right and fighting liability trolls. When you make zero profit, you cut the losses. Such law would spell very quick end to any corporate support of free and open source software, for liability reasons. There's a reason why all such software is accompanied with "NO WARRANTY" texts, and enforcing liability will make the corporate world to run from it. Nobody wants to be sued because they use OpenSSL and there was a vulnerability there, and that's exactly what would happen with any commercial vendor using OpenSSL if liability laws would be introduced. It doesn't matter the company didn't write OpenSSL - as soon as they use it, they are on the hook. IBM was sued not because they made Linux, but because they used it and had tons of money. And I do not see any business model that could allow companies to charge enough to cover such liabilities. Maybe for established powerhouses like Linux or for corporate foundational projects like Chrome and Darwin, but not for any lesser projects and surely not for any starting up open source with unclear revenue potential. It won't kill all open source, but it would severely hurt the ecosystem and turn it into two worlds - pure hobbyist geekery which nobody with money would touch, and formally open-source projects with strict corporate governance that has no ecosystem beyond the founding corporation. One of the worst ideas I've heard lately, and I am genuinely baffled how a person as smart and experienced as Schneier could support it.
        marcoperaza 9y ago
        I'm not sure you're envisioning the same thing I am. You would only be liable for something that you sell or otherwise make money from. You would be free to publish software, open source or not, without incurring liability as long as you don't make money from it. Whoever then uses that software for a commercial product would be incurring the full liability, and would not be able to turn around and sue up the chain. The currently widespread practice of trusting sensitive user data to open source code without an audit (either internally or via a third-party, e.g. Red Hat) is horrifying and incredibly negligent.
        9y ago
      - JoshTriplett 9y ago
        I've actually had discussions with several people, separately and at a legal summit that specifically discussed the topic of software liability, that proposed a good solution to this: Make the liability proportional to the degree to which you've given them the degree to find and fix any issues that might arise. If you give someone FOSS software to solve some particular problem, even a potentially-high-liability problem, you've given them everything they need to both analyze the software for potential issues, and fix them themselves. (Auto manufacturers like FOSS because it means they can always support it themselves if the vendor won't, and they have far longer support lifetimes than many other products.) So disclaiming all liability there seems reasonable, for anything short of intentional malice (e.g. backdoors). On the other hand, if you give someone a piece of opaque proprietary software, then you're selling them a solution to a problem, and it'd better work because they can't do anything but go to you if it doesn't. They also can't introspect it, and black-box testing only goes so far. So this should increase liability. Even more so if you supply it in an obfuscated form that's difficult to reverse-engineer or test, or if you lock it down to make it irreplaceable. The same thing would go for changing software yourself, on a high-liability device. If you don't change it, it's not your fault; if you change it, it might be your fault.
        sitharus 9y ago
        New Zealand consumer law has a requirement that goods must be 'fit for purpose'. This means that if a company sells you a clothes washer for example it must clean clothes, but if you try to wash your shoes and it breaks it's not the manufacturer's fault (unless they said it could of course). I think something like this could apply very well to software. If someone uploads source code to github they haven't sold it to you with any purpose in mind, but commercial sales have functionality promises so they could be held to them.
        DannyBee 9y ago
        warranty of merchantability and fitness for a particular purpose exist in the US. Whether it can be disclaimed is per-state though. (Some states allow disclaiming implied warranties, some do not).
    - trapperkeeper74 9y ago
      Another, less chilling effects way would be to have an Underwriters' Laboratories (UL) or CE for software. Any government, company or customer could then have that as a requirement.
      - marcoperaza 9y ago
        That's what would effectively emerge from the liability system. Companies would buy insurance from liability, and the insurance companies would demand some kind of certification process.
      - kabdib 9y ago
        Certification programs, when they exist, tend to become political creatures and tools of destruction. You wind up with byzantine and arbitrary rules, often put in place for horse-trading reasons, often to exclude competition and drive up prices. Want a seat at the standards table? Pony up tons of time, plenty of money for travel to cities where meetings are held, and be prepared for the big software consulting firms to crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. Want to contribute to Python? Sure hope you have that degree, plus an engineering certificate from your local/state/national government. Your dues are paid up and you've passed the most recent set of exams, right? Oh, and let's talk about your toolchain. You can license a certified compiler for $15,000 a seat. Per year. I can't imagine anything more chilling, other than an outright ban on people writing software.
        colejohnson66 9y ago
        > ...crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. And good luck knowing what the actual requirements of that standard are; PDFs of ISO standards cost hundreds of dollars.
        kabdib 9y ago
        Yup, that's part of the racket.
    - travmatt 9y ago
      I believe Dan Geer also gave a keynote a year or so ago at Blackhat (or Defcon) arguing for a similar framework.
  - kogepathic 9y ago
    CTO is criminally liable for technical breaches involving their company. They're supposed to be responsible for this anyway, but given that at worst they receive a slap on the wrist and their company gets fined, clearly more needs to be done. You might counter: well no one will be willing to be CTO if it involves such personal risk. I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough, or they can show sufficient due diligence that they won't end up in jail. I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure and not a minimum viable product full of holes like this.
    - jacquesm 9y ago
      > well no one will be willing to be CTO if it involves such personal risk. Of course they would. Compensation would go up and the good ones would be readily employed. The hard part would be to make such liability stick.
    - smsm42 9y ago
      > CTO is criminally liable for technical breaches involving their company Which means CTOs would have huge incentive to conceal such breaches and persecute anybody who would report them. Also, CTOs would require huge money to cover the risks, and probably wide insurance coverage like medical malpractice insurance. Which is five-figure number at least. I wonder which startup could afford that. > I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough They surely can spend money on lawyers writing tricky contracts and acquiring various expensive certifications. As for whether it'd make their software any more secure - this is much more doubtful. > I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure That implicitly assumes right now the problem in software being insecure is because not enough money is spent on it, and if software would be more expensive, it would be more secure. This assumption does not seem to be true.
  - Nursie 9y ago
    Depends, but there's insecurity by bad design, or bad implementation, and then there's stuff like this. I would say that some sort of negligence laws would be appropriate here, with a defence being that good practice was followed. Accidents will happen even with the best of intent; but there's a line somewhere.
  - jacquesm 9y ago
    Step 1 is mandatory reporting of breaches. Step 2 would be the creation of an actual software engineering profession complete with the equivalent of the 'iron ring' and a pledge to go with it. Maybe the ring could be made of ferrite ;) Step 3 is attaching a figure to compensating victims of breaches over and beyond some credit score bs. Step 4 would be actual legal liability for service providers and shrink wrap software manufacturers which they could not get you to waive. Step 5 would be criminal liability for producers of faulty software and especially the management layers above them. Applied sequentially until it starts to hurt would improve software quality in a hurry and would most likely result in massive retraining of a large number of people now employed as programmers as well as their management.
    - protomyth 9y ago
      In your scenario, does all software now requires a certified software engineer?
      - jacquesm 9y ago
        No, you're fine to do whatever you want. But companies will likely want to hire people that reduce their exposure to lawsuits that will stick. So if your software is going to affect lives and you feel that you can handle the fall-out in case it does not and you are not certified then you're more than welcome to make that combination work.
        protomyth 9y ago
        So, basically no non-certified programmers because Apple, etc. will just not give you a developer certificate because of a possible lawsuit.
        jacquesm 9y ago
        Apple isn't in the business of providing critical software where such liability would make much sense beyond when: (1) their phones given enough charge refuse to call 9/11 as mandated by law at the present anyway (2) their authentication details are leaked (3) their operating systems suffer security bugs At most other levels the damage could easily be contained. Note that even at present they could be sued for any and all of the above, whether such a lawsuit is winnable is beyond my expertise to evaluate but it would certainly be interesting to see the arguments both sides put forth. So plenty of opportunity to be employed for 'non certified programmers'. Note that almost every big software provider already has a certification program of sorts but at the moment these are just used as either a revenue stream or a way to get people to invest in the eco system.
  - deleted 9y ago
    [deleted]
  - _rpd 9y ago
    A few professional negligence lawsuits wouldn't hurt.
  - tejtm 9y ago
    Laws that stripped resources from share holders. Blaming a programmer for a culture they are not responsible for creating or maintaining is far too late in the process. If a venture has no reason to exist if cannot produce secure products a culture of building secure products will emerge. It may be that every MBA with a NDA will not be able to afford the competent programmers required, but as they are weeded out we will have fewer less than useless things.
- exabrial 9y ago
  Ironic how the VW engineer is going to jail... yet the middle management is escaping scot free
  - jacquesm 9y ago
    The 'VW engineer going to jail' is actually an exec.
    - kogepathic 9y ago
      That's only in America. Thus far it seems that no one from VW Europe will face criminal prosecution for the scandal. Germany is too scared of hurting their economy in an election year to consider further actions against VW.
      - jacquesm 9y ago
        It goes a lot further than that, the VW saga in Germany is intricately intertwined with the political situation and since 20% of the shares are held by Lower Saxony they'd essentially invite scrutiny of their own position in the whole ordeal.
  - criddell 9y ago
    I'm okay with that. Middle management can ask an engineer to do something and that engineer has a responsibility to say "no".
    - exabrial 9y ago
      That lead to my firing at a previous job :/ I think people should be held accountable for ordering engineers to do questionably ethical things like this situation
      - criddell 9y ago
        Sure. I'll never argue against holding people accountable. But even when that doesn't happen, engineers don't get to say "I was just following orders".
- jl6 9y ago
  Or follow the automotive model: put greater liability on the end user. End user is then obliged to pay for insurance, incentivized to pick safer suppliers, and feels the consequences of their own bad behaviour (it's not the ISP's fault that you keep opening .exe email attachments).
  - wahern 9y ago
    The automotive model is split. The end user pays insurance because he's the least cost avoider for the most obvious types of accidents. And you want him to internalize the cost of such easily avoidable errors. But the producer is also regulated and required to include certain safety features because individual consumers are poorly equipped to select cars based on complex safety features. And in any event most consumers are very price sensitive; many people (perhaps most, actually) don't have the luxury of choosing a car based on safety features. seat belts, air bags, crumple zones, ABS, and rear-view cameras have all become mandatory thanks to regulation. (In some cases voluntarily with the understanding that they'd be involuntary if industry didn't cooperate). Collision avoidance systems are already scheduled to be mandatory, again by voluntary agreement. When it comes to tech, consumers just aren't sophisticated enough to know how to choose products. And the insurance industry doesn't know how to solve that problem, either. It's really only the _commercial_ insurance industry where the insurers work with the policy purchasers to help them select the safest products and procedures. Anyone who has worked in tech support knows that it's a lost cause trying to educate individual consumers.
  - mysterydip 9y ago
    What about in this case? Some areas only have one internet provider. Are the users liable because they chose "have internet" over not?
  - mjevans 9y ago
    How's the customer going to pick when their market, if they're lucky, has only two fixed link ISPs? When most have only one (really crappy cable one) that if they're lucky provides more than 25Mbit down and who knows what up. (Yeah it's nearly 2018 and those speeds would have been 'OK' 15 years ago.) A lot of the reason Americans are in this mess is the complete lack of competition in 99+% of the country. /That/ lack of competition comes from a broken investment model. Like roads, water/sewer, and other systems regulated as utilities the physical plant is a natural monopoly; it isn't effective for society or companies to build parallel infrastructures. If the base platform (last mile 'wires') were owned by the community and competition occurred on top of it (like with package delivery) then the context of your comment would make more sense.
- mrpippy 9y ago
  Agreed. I think that point was also reached with the tens of thousands of Dodge/Chrysler/Jeep car radios/head units that were wide open to the Internet over cellular. The staggering incompetence responsible up and down the chain for that should have been investigated fully and publicly, and certainly would have been if anyone had been injured/killed.
  - posguy 9y ago
    Its the internet of vulnerable things! Most of which will never see an update to resolve the security vulns that crop up with time, let alone receive proper software stack maintenance for more than a brief period of time.
- cmurf 9y ago
  We don't yet have cybersecurity expertise in government that approaches the environmental science expertise in the EPA (or California's equivalent). And thus far we have a Congress that doesn't recognize the importance, or see a role for the government to regulate these aspects, so they just let the industry write their own rules. And so we've got exactly the system everybody who isn't a consumer wants us to have. Update: 4 of 535 members of Congress have computer science degrees.
  - ktRolster 9y ago
    Update: 4 of 535 members of Congress have computer science degrees. That's higher than I expected.
    - justinjlynn 9y ago
      But is it lower than a representative sample of the population?
      - ktRolster 9y ago
        I have no idea
  - colejohnson66 9y ago
    > Update: 4 of 535 members of Congress have computer science degrees. But how many of the remaining 531 know how computers work?
- floatingatoll 9y ago
  I agree with all of your points except one, the severity of your listed "corollary" situation: Dieselgate is tentatively assessed to have resulted in thousands of human deaths due to air pollution. AT&T modem vulnerabilities have not been assessed similarly. While I concur with everything else you've said, I encourage selecting a different example with a more evenly-matched fatality rate.
  - stanleydrew 9y ago
    Why is fatality rate the only legitimate metric on which to judge prison sentences? People are put in prison for all sorts of lesser offences all the time.
    - floatingatoll 9y ago
      [Original question altered to break apart "why?" and "it shouldn't be".] Q: Is fatality rate the only legitimate metric on which to judge prison sentences? No. Fatality rate is not the sole legitimate metric. Q: Then why is fatality rate relevant? People are put in prison for all sorts of lesser offences all the time. It's a "hot-button" metric. Its use inflames emotion and skews human behavior away from rational. When drawing an analogy between two things, introducing "fatality rate" when not already present muddies the waters of conversation. If done accidentally, this can lead to serious "foot in mouth" scenarios. If done intentionally, it's typically used to encourage fearful decisions instead of careful decisions.
- deleted 9y ago
  [deleted]
- feelin_googley 9y ago
  "... someone needs to be held criminally liable for situations such as this one." What is the crime that "someone" should be charged with? In the VW case the media reports it was fraud against the government and violation of the Clean Air Act. To do what you suggest, one first needs an applicable criminal statute. What is it? (Not implying this is impossible. Only trying to focus the discussion beyond the usual rants.)
  - Nomentatus 9y ago
    Great question, I agree. Criminal negligence might be one possibility; fraud in selling something not suitable for purpose might be another. Obviously it's going to be very difficult to draw such lines in the (continuous) sand; but we might as well start now. How many corners can you cut before the courts need to be involved (beyond civil lawsuits?) How much of the net do you need to imperil to trigger criminal consequences? Maybe something like certification for electronics is needed and is possible here? Where manufacturers pay for a fairly decent inspection of their work in return for a mark of inspection? (I don't mean to take a side re this particular crap-storm.)
    - ryan-c 9y ago
      AT&T doesn't sell these modems, they require customers to rent them.
      - kurthr 9y ago
        And they restrict all updates to them... those must be downloaded from AT&T. I have one.
        ryan-c 9y ago
        They even require the damn things on their gigabit fiber service (there is a separate media converter, so it's not about the physical interface), and enforce using it by doing wired 802.1x.
  - 9y ago
sp00ls 9y ago
Not nearly as large as ATT U-Verse but I found a similar vulnerability in the modem I was provided from a rural DSL provider a few years ago. It all started when I called to get the admin credentials so that I could open a port. They refused, stating that they use the same PW on all of them so they couldn't provide it to me. After a day or 2 I found a vulnerability in the WebUI that dumped the password to my browser. Did a shodan scan and found hundreds of these modems connected to the internet. What they said was true, that password worked on the 2-3 I tried just out of curiosity. I tried reporting my findings to them but they didn't seem to care. So I just changed the password on the one provided to me and let it be. Now I live elsewhere and use my own purchased modem/firewall/wap. Can't trust ISPs to care about your security.
- samstave 9y ago
  >Can't trust ISPs to care about your security. This is the kicker here: You SHOULDN'T trust an ISP to care about your security - just like you shouldn't trust a the water company to select which Faucet/Shower head you install in your bathrooms. Raw pipes to info == raw pipes to water (interesting aside, the Mayans always equated thought as being symbolized by water) I am paying the water company for pipes to my house, I choose which faucets/shower-heads and use the water is consumed for. Imagine if the water company charged me a different rate for Kohler Faucets used in the kitchen for washing my dishes, vs a Home Depot Hose used in the garden to water my plants? I pay the water company for the volume of water consumed. I pay the ISP for the bandwidth (volume of data) consumed. Further, if the ISP is ostensibly providing my security to literally anything, then, by contract, they are assuming some of the risk? If "what we do is for your protection" -- then they assume full/some liability. The water company provides zero such assurances. A broken pipe/leak/flooding/damage has no affect on the water company, my agreement/bill with them. Further, the water company isn't injecting "paid supplements" (aside from fluoride, which we can equate to NSA backdoors in this example) into my water supply without my will (ads) -- they don't feed me a % of Gatorade in my water supply because Gatorade has a deal with the main faucet - or fertilizers into the garden hose because of a deal with Monsanto. Source: My family owns an actual water company.
  - 9y ago
userbinator 9y ago
It's always annoyed me that ISPs seem to like giving customers these horribly overcomplex modems as well as other "value-added features" like "inject advertisements into the user’s unencrypted web traffic" --- especially since customers are already paying them for the service. My vision for an ideal modem is more like a dumb Ethernet to coax/fiber/etc. adapter, and is otherwise as unobtrusive as possible. Ditto for an ideal ISP: just sell access to the raw, unfiltered Internet, and nothing else.
- chinathrow 9y ago
  Thats what I have via my FTTH provider: plain DHCP enabled ethernet - a media converter is all what is needed. After that: the customer gets to decide what equipment to use/own.
- josteink 9y ago
  > My vision for an ideal modem is more like a dumb Ethernet to coax/fiber/etc. adapter You'd like Europe then. You know where we have competing ISPs and this is the standard.
  - deleted 9y ago
    [deleted]
  - hedora 9y ago
    In fairness, comcast (big US ISP) allows you to buy your own cable modem. However, they are terrible for multiple other reasons that would not fly in Europe (data caps, lobbying to resell browsing history, opaque pricing schemes, etc)
    - simonh 9y ago
      But at least they have the freedom to do so, unlike Europe where their right to screw over their customers is unfairly infringed.
      - skummetmaelk 9y ago
fluxsauce 9y ago
This is a shocking and overly broad title. I have Sonic Fusion, which includes a Pace 5268AC modem which is provided by AT&T U-verse and I cannot replicate the issue. The title should be "Some AT&T U-verse modems..."
- jlgaddis 9y ago
  I also have a 5268AC (on Uverse) and have been unable to replicate these issues (but, TBH, I haven't tried very hard at all), although I have mine in "almost-bridged-mode" ("real" bridged mode can't be done, but I have it as close to bridged mode as I can get it).
- jsoo1 9y ago
  i have the 5268AC modem and i just did a quick nmap -PU . open ports from that are 80, 8443, and 49152
  - relaxitup 9y ago
    80,8443 not open on the external IP are they? Hopefully only internal unless you're OK with that.
- sctb 9y ago
  Thanks, we've updated the title from “SharknAT&To: AT&T U-verse modems all have Internet-facing hardcoded ssh password” which is editorialized.
CodeWriter23 9y ago
I applaud Hutchins' choice to use Full disclosure instead. Let that be a lesson to all Big Corps, there are White Hats out there who won't be bullied by your "Responsbile disclosure" propaganda. The writing is on the walls, Big Corps, take responsibility and secure your gear by design or be pilloried.
- ocdtrekkie 9y ago
  At the end of the day, it's pretty unlikely AT&T will suffer any significant losses for this, but there's a decent chance some consumers will.
  - CodeWriter23 9y ago
    Every codependent has some excuse for enabling their abuser.
JL2010 9y ago
I can't seem to find any information on how or if this was disclosed to AT&T. Does anyone know how the blogger proceeded here?
- rwbhn 9y ago
  Comments at the bottom indicate it was not pre-disclosed.
mlosapio 9y ago
This is terrifying
matt_wulfeck 9y ago
Here[1] is a 802.1x proxy you can use to hide your incredibly vulnerable residential gateway behind a firewall of your choosing. It allows the eap packets to pass through. I honestly knew this was going to be a problem when I first port-scanned my residential gateway and saw exposed who-knows-what ports, but for symmetrical 1Gb internet for $79.99 a month what can you do? [1] https://github.com/ShadwDrgn/eap_proxy/blob/master/eap_proxy.py https://github.com/ShadwDrgn/eap_proxy/blob/master/eap_proxy...
- nmjohn 9y ago
  I had the exact same thought after port scanning my own uverse gigapower connection - so seeing real exploits actually be found on it is not surprising in the slightest to me. Though instead of going with the 802.1x proxy approach, it's also possible to spoof the mac address of the RG with your router and swap it in place after 802.1x authentication has occurred. (You have to swap without the link to the ONT going down however, the easiest way to do so being a switch with VLAN support. You put the RG and ONT on one vlan, and then once the connection is up, you swap your router in place of the RG.) Then you can unplug the RG and put it in your closet (until you have a power outage and have to do it again, which is the main drawback to this approach. However since AT&T provides a UPS for the ONT, if you have a UPS for your router you should be good there too.)
hedora 9y ago
What really ticks me off about this is that for FTTN access around here, you have to use their crappy routers. This is true even if you go through a third party like sonic.net. Worse, their routers seem to do something to defeat attempts at two-level NAT setups. I thought one of the network neutrality principles said you couldn't discriminate against compatible network hardware. Too bad Pai is in now.
- mikeash 9y ago
  This is one reason why I really like FiOS. I get ethernet straight into the house. Sometimes you get coax instead, but you can use a MoCA adapter to convert it to ethernet. And their provided modem is actually pretty decent! I had planned to bypass it when I signed up for the service, but after using it for a bit I decided to just keep it in place.
matt_wulfeck 9y ago
Can someone please use this to lift the EAP certificate so that any individual can authenticate themselves with AT&T instead of having to put the gateway in the very entrance to the home network?
feelin_googley 9y ago
In a world where users should have control over their own computers, it is the customer who should have SSH access, not AT&T. But as you all know, most times the customer does not own the modem. One well-known workaround is for the customer to use their own modem or to use their own router as a gateway to the modem. But does this really give the user more contorl over the modem/router? These user-owned modems/routers usually do not encourage SSH access by the user, if they even provide it. Instead they promote a "web interface". Indirect control of the settings. Better than SSH? That is for you to decide. The "market" seems to love the "web interface". But this often the easiest vector for successful attacks. Less control, and less safety. Is the tradeoff still worth it? That is for you to decide. https://threatpost.com/vulnerability-disclosed-in-ubquiti-networks-admin-interface/124392/ https://threatpost.com/vulnerability-disclosed-in-ubquiti-ne... https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170316-0_Ubiquiti_Networks_authenticated_command_injection_v10.txt https://www.sec-consult.com/fxdata/seccons/prod/temedia/advi... http://www.securityweek.com/worm-infects-many-ubiquiti-devices-old-vulnerability http://www.securityweek.com/worm-infects-many-ubiquiti-devic... Relying on "Keep up to date with patches" or "Enable updates" as a strategy to improve the safety of a product that was unsafe to begin with is a bit of cognitive dissonance given that its safety was deemed "good enough" for the renter/purchaser at the time of rental/purchase. To achieve a safer product requires not only manufacturers to set new priorities but also consumers as well. How important is that "web interface"? More important than safety? And why not configure using SSH instead? Whatever the reasons, tradeoffs have consequencesre: safety.
FiveSquared 9y ago
Well I have AT&T and the hack it worked for me! Words could not express the feelings of terror that I have right now.
- wu_tang_chris 9y ago
  > Words could not express the feelings of terror that I have right now. have you tried the word "hyperbolic" ?
  - yjftsjthsd-h 9y ago
    I disagree; it is totally reasonable to be terrified when the device at the heart of your network has a internet-facing root exploit that you can't patch.
chx 9y ago
This is why, if I can, get bridge mode on the ISP provided device and put in an OpenWRT router. I am still on 802.11n but who cares, most of my devices are not 802.11ac either. I want to know what runs on my router, damnit! It's my biggest vulnerability if done wrong and one of the more important security features of the home network if done right.
dqv 9y ago
I am not joking when I ask this question: will this open me up to potential CFAA charges if I run the commands to check if I'm vulnerable and run the self-mitigation commands?
ronnier 9y ago
1. SSH exposed to The Internet; superuser account with hardcoded username/password. 2. Default credentials “caserver” https server NVG599 3. Command Injection “caserver” https server NVG599 4. Information disclosure/hardcoded credentials 5. Firewall bypass no authentication
saagarjha 9y ago
> a kernel module whose sole purpose seems to be to inject advertisements into the user’s unencrypted web traffic Ugh…why is this even a thing? Like who thought it would be okay to add this "feature" to a modem, let alone at the kernel level where it would be difficult to disable and easier to be compromised?
chrissnell 9y ago
I have AT&T U-verse (Gigabit fiber product) at home and I believe that I an not vulnerable to public Internet attacks because I've configured my modem in pass-through mode. The AT&T pass-through is pretty weak and is really only a 1:1 NAT, not a bridge, but as far as I can tell, the modem does not answer to the Internet when configured in this mode.
caryhartline 9y ago
Another way around this is to just request a modern modem. I recognize that modem as an older model and, especially if it is having hardware problems, you can just call up AT&T and ask for their newer model (not sure if it is still the newest) 5268ACFXN.
- monochromatic 9y ago
  You sure the new model isn't similarly vulnerable?
ryanmarsh 9y ago
I just installed a Ubiquity Unifi Security Gateway and AP behind my Uverse modem and turned everything off including the radios. Thank God. I'm sure I could still be MITM so running all traffic to a VPN now.
deleted 9y ago
[deleted]
doctorshady 9y ago
This wouldn't be the first time I've heard of some AT&T-specific vulnerabilities on a router: https://www.soldierx.com/bbs/201704/voip-router-hacking https://www.soldierx.com/bbs/201704/voip-router-hacking
js2 9y ago
I have AT&T Gigapower with a Pace 5268AC, so not one of the modems discussed here. I don't use its wifi and I have it configured for pass-thru mode. When I got service early this year, I briefly investigated bypassing it entirely. It turns out you need the modem to periodically respond to authentication packets from the AT&T network. But with some ingenuity, you can hang the router off an extra port on your own router and use it only for authentication purposes: http://www.dslreports.com/forum/r29903721-AT-T-Residential-Gateway-Bypass-True-bridge-mode~start=480 http://www.dslreports.com/forum/r29903721-AT-T-Residential-G... I eventually decided not to do this because it's somewhat brittle and I didn't otherwise have any issues with the Pace. It's performance is fine. But, given this disclosure, I'm going to revisit my decison. First, it seems like it's just a matter of time before the Pace has a similar security issue. Second, that kernel module for injecting HTTP advertisements. Just the idea of it bothers me.
- js2 9y ago
  Update: I've moved the 5268AC behind my EdgeRouter Lite. I wasn't happy with any of the 802.1x proxies other folks wrote and/or they weren't working for me and/or I just wanted to write it in Python, so I wrote my own: https://github.com/jaysoffian/eap_proxy https://github.com/jaysoffian/eap_proxy
fishywang 9y ago
So since Sonic was highly reviewed and hyped here (San Jose), I checked them out/tried to switch to them. For my address the only option from them was the one on AT&T's IP network. For that service, I must use the modem they (AT&T) give me. There's modem renting fee, and there's router feature that I cannot turn off. That's the dealbreaker for me so I stopped trying. I'm glad that I didn't go that route, and I hope Sonic could do better here.
- brianpan 9y ago
  Sonic uses AT&T's networks but provides their own service on those networks. The modem is not an AT&T modem and it's not the one in the article.
  - fishywang 9y ago
    But still, there's router feature on that modem that I cannot turn off, so I cannot bring my own router (unless I want to do double-NAT), and there are still highly likely some hardcoded remote access password.
relaxitup 9y ago
Has anyone with this modem in the wild actually confirmed this update was pushed to them and if so is ssh listening on their public IP? So far in the article comments (haven't looked thru HN comments yet), those having this modem have verified that ssh is not listening.

344 points by dankohn1 9y ago

I think at a certain point someone needs to be held criminally liable for situations such as this one. A VW engineer is likely going to jail over dieselgate. We have already seen that such insecure internet connected devices can be easily and quickly assembled into a botnet. The operators of such a network can direct the attacks at healthcare institutions, national infrastructure, and other safety critical systems. At some point, there has to be stricter consequences for companies than simply a fine. C-levels won't start paying attention to security until there's the real possibility that their ass will end up in jail for this kind of insecurity.

QUFB 9y ago
What laws would you propose to eliminate insecure software?
- marcoperaza 9y ago
  Bruce Schneier has speculated about creating mandatory legal liability for software vendors and service providers. Liability regimes are a major reason why physical products are so safe. https://www.schneier.com/essays/archives/2003/11/liability_changes_ev.html https://www.schneier.com/essays/archives/2003/11/liability_c...
  - ryandrake 9y ago
    Say goodbye to open source, then, unless he proposes a special carve-out for it.
    - marcoperaza 9y ago
      He has some commentary on this well: https://www.schneier.com/blog/archives/2008/07/software_liabil.html https://www.schneier.com/blog/archives/2008/07/software_liab... In summary, there wouldn't be liability for open source developers because there is no business contract. But if you run a website with open source software, you of course would still be liable for anything that happens to your customers' data. So you would probably want to buy that same open source software from someone (e.g. Red Hat), who would also be liable.
      - smsm42 9y ago
        Which means, hosting/supporting open source would quickly become not worth it for any major company representing a large target for opportunistic lawyers. When you make millions from a product, you can afford a team of lawyers setting up contacts just right and fighting liability trolls. When you make zero profit, you cut the losses. Such law would spell very quick end to any corporate support of free and open source software, for liability reasons. There's a reason why all such software is accompanied with "NO WARRANTY" texts, and enforcing liability will make the corporate world to run from it. Nobody wants to be sued because they use OpenSSL and there was a vulnerability there, and that's exactly what would happen with any commercial vendor using OpenSSL if liability laws would be introduced. It doesn't matter the company didn't write OpenSSL - as soon as they use it, they are on the hook. IBM was sued not because they made Linux, but because they used it and had tons of money. And I do not see any business model that could allow companies to charge enough to cover such liabilities. Maybe for established powerhouses like Linux or for corporate foundational projects like Chrome and Darwin, but not for any lesser projects and surely not for any starting up open source with unclear revenue potential. It won't kill all open source, but it would severely hurt the ecosystem and turn it into two worlds - pure hobbyist geekery which nobody with money would touch, and formally open-source projects with strict corporate governance that has no ecosystem beyond the founding corporation. One of the worst ideas I've heard lately, and I am genuinely baffled how a person as smart and experienced as Schneier could support it.
        marcoperaza 9y ago
        I'm not sure you're envisioning the same thing I am. You would only be liable for something that you sell or otherwise make money from. You would be free to publish software, open source or not, without incurring liability as long as you don't make money from it. Whoever then uses that software for a commercial product would be incurring the full liability, and would not be able to turn around and sue up the chain. The currently widespread practice of trusting sensitive user data to open source code without an audit (either internally or via a third-party, e.g. Red Hat) is horrifying and incredibly negligent.
        9y ago
    - JoshTriplett 9y ago
      I've actually had discussions with several people, separately and at a legal summit that specifically discussed the topic of software liability, that proposed a good solution to this: Make the liability proportional to the degree to which you've given them the degree to find and fix any issues that might arise. If you give someone FOSS software to solve some particular problem, even a potentially-high-liability problem, you've given them everything they need to both analyze the software for potential issues, and fix them themselves. (Auto manufacturers like FOSS because it means they can always support it themselves if the vendor won't, and they have far longer support lifetimes than many other products.) So disclaiming all liability there seems reasonable, for anything short of intentional malice (e.g. backdoors). On the other hand, if you give someone a piece of opaque proprietary software, then you're selling them a solution to a problem, and it'd better work because they can't do anything but go to you if it doesn't. They also can't introspect it, and black-box testing only goes so far. So this should increase liability. Even more so if you supply it in an obfuscated form that's difficult to reverse-engineer or test, or if you lock it down to make it irreplaceable. The same thing would go for changing software yourself, on a high-liability device. If you don't change it, it's not your fault; if you change it, it might be your fault.
      - sitharus 9y ago
        New Zealand consumer law has a requirement that goods must be 'fit for purpose'. This means that if a company sells you a clothes washer for example it must clean clothes, but if you try to wash your shoes and it breaks it's not the manufacturer's fault (unless they said it could of course). I think something like this could apply very well to software. If someone uploads source code to github they haven't sold it to you with any purpose in mind, but commercial sales have functionality promises so they could be held to them.
        DannyBee 9y ago
        warranty of merchantability and fitness for a particular purpose exist in the US. Whether it can be disclaimed is per-state though. (Some states allow disclaiming implied warranties, some do not).
  - trapperkeeper74 9y ago
    Another, less chilling effects way would be to have an Underwriters' Laboratories (UL) or CE for software. Any government, company or customer could then have that as a requirement.
    - marcoperaza 9y ago
      That's what would effectively emerge from the liability system. Companies would buy insurance from liability, and the insurance companies would demand some kind of certification process.
    - kabdib 9y ago
      Certification programs, when they exist, tend to become political creatures and tools of destruction. You wind up with byzantine and arbitrary rules, often put in place for horse-trading reasons, often to exclude competition and drive up prices. Want a seat at the standards table? Pony up tons of time, plenty of money for travel to cities where meetings are held, and be prepared for the big software consulting firms to crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. Want to contribute to Python? Sure hope you have that degree, plus an engineering certificate from your local/state/national government. Your dues are paid up and you've passed the most recent set of exams, right? Oh, and let's talk about your toolchain. You can license a certified compiler for $15,000 a seat. Per year. I can't imagine anything more chilling, other than an outright ban on people writing software.
      - colejohnson66 9y ago
        > ...crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. And good luck knowing what the actual requirements of that standard are; PDFs of ISO standards cost hundreds of dollars.
        kabdib 9y ago
        Yup, that's part of the racket.
  - travmatt 9y ago
    I believe Dan Geer also gave a keynote a year or so ago at Blackhat (or Defcon) arguing for a similar framework.
- kogepathic 9y ago
  CTO is criminally liable for technical breaches involving their company. They're supposed to be responsible for this anyway, but given that at worst they receive a slap on the wrist and their company gets fined, clearly more needs to be done. You might counter: well no one will be willing to be CTO if it involves such personal risk. I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough, or they can show sufficient due diligence that they won't end up in jail. I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure and not a minimum viable product full of holes like this.
  - jacquesm 9y ago
    > well no one will be willing to be CTO if it involves such personal risk. Of course they would. Compensation would go up and the good ones would be readily employed. The hard part would be to make such liability stick.
  - smsm42 9y ago
    > CTO is criminally liable for technical breaches involving their company Which means CTOs would have huge incentive to conceal such breaches and persecute anybody who would report them. Also, CTOs would require huge money to cover the risks, and probably wide insurance coverage like medical malpractice insurance. Which is five-figure number at least. I wonder which startup could afford that. > I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough They surely can spend money on lawyers writing tricky contracts and acquiring various expensive certifications. As for whether it'd make their software any more secure - this is much more doubtful. > I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure That implicitly assumes right now the problem in software being insecure is because not enough money is spent on it, and if software would be more expensive, it would be more secure. This assumption does not seem to be true.
- Nursie 9y ago
  Depends, but there's insecurity by bad design, or bad implementation, and then there's stuff like this. I would say that some sort of negligence laws would be appropriate here, with a defence being that good practice was followed. Accidents will happen even with the best of intent; but there's a line somewhere.
- jacquesm 9y ago
  Step 1 is mandatory reporting of breaches. Step 2 would be the creation of an actual software engineering profession complete with the equivalent of the 'iron ring' and a pledge to go with it. Maybe the ring could be made of ferrite ;) Step 3 is attaching a figure to compensating victims of breaches over and beyond some credit score bs. Step 4 would be actual legal liability for service providers and shrink wrap software manufacturers which they could not get you to waive. Step 5 would be criminal liability for producers of faulty software and especially the management layers above them. Applied sequentially until it starts to hurt would improve software quality in a hurry and would most likely result in massive retraining of a large number of people now employed as programmers as well as their management.
  - protomyth 9y ago
    In your scenario, does all software now requires a certified software engineer?
    - jacquesm 9y ago
      No, you're fine to do whatever you want. But companies will likely want to hire people that reduce their exposure to lawsuits that will stick. So if your software is going to affect lives and you feel that you can handle the fall-out in case it does not and you are not certified then you're more than welcome to make that combination work.
      - protomyth 9y ago
        So, basically no non-certified programmers because Apple, etc. will just not give you a developer certificate because of a possible lawsuit.
        jacquesm 9y ago
        Apple isn't in the business of providing critical software where such liability would make much sense beyond when: (1) their phones given enough charge refuse to call 9/11 as mandated by law at the present anyway (2) their authentication details are leaked (3) their operating systems suffer security bugs At most other levels the damage could easily be contained. Note that even at present they could be sued for any and all of the above, whether such a lawsuit is winnable is beyond my expertise to evaluate but it would certainly be interesting to see the arguments both sides put forth. So plenty of opportunity to be employed for 'non certified programmers'. Note that almost every big software provider already has a certification program of sorts but at the moment these are just used as either a revenue stream or a way to get people to invest in the eco system.
- deleted 9y ago
  [deleted]
- _rpd 9y ago
  A few professional negligence lawsuits wouldn't hurt.
- tejtm 9y ago
  Laws that stripped resources from share holders. Blaming a programmer for a culture they are not responsible for creating or maintaining is far too late in the process. If a venture has no reason to exist if cannot produce secure products a culture of building secure products will emerge. It may be that every MBA with a NDA will not be able to afford the competent programmers required, but as they are weeded out we will have fewer less than useless things.
exabrial 9y ago
Ironic how the VW engineer is going to jail... yet the middle management is escaping scot free
- jacquesm 9y ago
  The 'VW engineer going to jail' is actually an exec.
  - kogepathic 9y ago
    That's only in America. Thus far it seems that no one from VW Europe will face criminal prosecution for the scandal. Germany is too scared of hurting their economy in an election year to consider further actions against VW.
    - jacquesm 9y ago
      It goes a lot further than that, the VW saga in Germany is intricately intertwined with the political situation and since 20% of the shares are held by Lower Saxony they'd essentially invite scrutiny of their own position in the whole ordeal.
- criddell 9y ago
  I'm okay with that. Middle management can ask an engineer to do something and that engineer has a responsibility to say "no".
  - exabrial 9y ago
    That lead to my firing at a previous job :/ I think people should be held accountable for ordering engineers to do questionably ethical things like this situation
    - criddell 9y ago
      Sure. I'll never argue against holding people accountable. But even when that doesn't happen, engineers don't get to say "I was just following orders".
jl6 9y ago
Or follow the automotive model: put greater liability on the end user. End user is then obliged to pay for insurance, incentivized to pick safer suppliers, and feels the consequences of their own bad behaviour (it's not the ISP's fault that you keep opening .exe email attachments).
- wahern 9y ago
  The automotive model is split. The end user pays insurance because he's the least cost avoider for the most obvious types of accidents. And you want him to internalize the cost of such easily avoidable errors. But the producer is also regulated and required to include certain safety features because individual consumers are poorly equipped to select cars based on complex safety features. And in any event most consumers are very price sensitive; many people (perhaps most, actually) don't have the luxury of choosing a car based on safety features. seat belts, air bags, crumple zones, ABS, and rear-view cameras have all become mandatory thanks to regulation. (In some cases voluntarily with the understanding that they'd be involuntary if industry didn't cooperate). Collision avoidance systems are already scheduled to be mandatory, again by voluntary agreement. When it comes to tech, consumers just aren't sophisticated enough to know how to choose products. And the insurance industry doesn't know how to solve that problem, either. It's really only the _commercial_ insurance industry where the insurers work with the policy purchasers to help them select the safest products and procedures. Anyone who has worked in tech support knows that it's a lost cause trying to educate individual consumers.
- mysterydip 9y ago
  What about in this case? Some areas only have one internet provider. Are the users liable because they chose "have internet" over not?
- mjevans 9y ago
  How's the customer going to pick when their market, if they're lucky, has only two fixed link ISPs? When most have only one (really crappy cable one) that if they're lucky provides more than 25Mbit down and who knows what up. (Yeah it's nearly 2018 and those speeds would have been 'OK' 15 years ago.) A lot of the reason Americans are in this mess is the complete lack of competition in 99+% of the country. /That/ lack of competition comes from a broken investment model. Like roads, water/sewer, and other systems regulated as utilities the physical plant is a natural monopoly; it isn't effective for society or companies to build parallel infrastructures. If the base platform (last mile 'wires') were owned by the community and competition occurred on top of it (like with package delivery) then the context of your comment would make more sense.
mrpippy 9y ago
Agreed. I think that point was also reached with the tens of thousands of Dodge/Chrysler/Jeep car radios/head units that were wide open to the Internet over cellular. The staggering incompetence responsible up and down the chain for that should have been investigated fully and publicly, and certainly would have been if anyone had been injured/killed.
- posguy 9y ago
  Its the internet of vulnerable things! Most of which will never see an update to resolve the security vulns that crop up with time, let alone receive proper software stack maintenance for more than a brief period of time.
cmurf 9y ago
We don't yet have cybersecurity expertise in government that approaches the environmental science expertise in the EPA (or California's equivalent). And thus far we have a Congress that doesn't recognize the importance, or see a role for the government to regulate these aspects, so they just let the industry write their own rules. And so we've got exactly the system everybody who isn't a consumer wants us to have. Update: 4 of 535 members of Congress have computer science degrees.
- ktRolster 9y ago
  Update: 4 of 535 members of Congress have computer science degrees. That's higher than I expected.
  - justinjlynn 9y ago
    But is it lower than a representative sample of the population?
    - ktRolster 9y ago
      I have no idea
- colejohnson66 9y ago
  > Update: 4 of 535 members of Congress have computer science degrees. But how many of the remaining 531 know how computers work?
floatingatoll 9y ago
I agree with all of your points except one, the severity of your listed "corollary" situation: Dieselgate is tentatively assessed to have resulted in thousands of human deaths due to air pollution. AT&T modem vulnerabilities have not been assessed similarly. While I concur with everything else you've said, I encourage selecting a different example with a more evenly-matched fatality rate.
- stanleydrew 9y ago
  Why is fatality rate the only legitimate metric on which to judge prison sentences? People are put in prison for all sorts of lesser offences all the time.
  - floatingatoll 9y ago
    [Original question altered to break apart "why?" and "it shouldn't be".] Q: Is fatality rate the only legitimate metric on which to judge prison sentences? No. Fatality rate is not the sole legitimate metric. Q: Then why is fatality rate relevant? People are put in prison for all sorts of lesser offences all the time. It's a "hot-button" metric. Its use inflames emotion and skews human behavior away from rational. When drawing an analogy between two things, introducing "fatality rate" when not already present muddies the waters of conversation. If done accidentally, this can lead to serious "foot in mouth" scenarios. If done intentionally, it's typically used to encourage fearful decisions instead of careful decisions.
deleted 9y ago
[deleted]
feelin_googley 9y ago
"... someone needs to be held criminally liable for situations such as this one." What is the crime that "someone" should be charged with? In the VW case the media reports it was fraud against the government and violation of the Clean Air Act. To do what you suggest, one first needs an applicable criminal statute. What is it? (Not implying this is impossible. Only trying to focus the discussion beyond the usual rants.)
- Nomentatus 9y ago
  Great question, I agree. Criminal negligence might be one possibility; fraud in selling something not suitable for purpose might be another. Obviously it's going to be very difficult to draw such lines in the (continuous) sand; but we might as well start now. How many corners can you cut before the courts need to be involved (beyond civil lawsuits?) How much of the net do you need to imperil to trigger criminal consequences? Maybe something like certification for electronics is needed and is possible here? Where manufacturers pay for a fairly decent inspection of their work in return for a mark of inspection? (I don't mean to take a side re this particular crap-storm.)
  - ryan-c 9y ago
    AT&T doesn't sell these modems, they require customers to rent them.
    - kurthr 9y ago
      And they restrict all updates to them... those must be downloaded from AT&T. I have one.
      - ryan-c 9y ago
        They even require the damn things on their gigabit fiber service (there is a separate media converter, so it's not about the physical interface), and enforce using it by doing wired 802.1x.
- 9y ago

sp00ls 9y ago

Not nearly as large as ATT U-Verse but I found a similar vulnerability in the modem I was provided from a rural DSL provider a few years ago. It all started when I called to get the admin credentials so that I could open a port. They refused, stating that they use the same PW on all of them so they couldn't provide it to me. After a day or 2 I found a vulnerability in the WebUI that dumped the password to my browser. Did a shodan scan and found hundreds of these modems connected to the internet. What they said was true, that password worked on the 2-3 I tried just out of curiosity. I tried reporting my findings to them but they didn't seem to care. So I just changed the password on the one provided to me and let it be. Now I live elsewhere and use my own purchased modem/firewall/wap. Can't trust ISPs to care about your security.

samstave 9y ago
>Can't trust ISPs to care about your security. This is the kicker here: You SHOULDN'T trust an ISP to care about your security - just like you shouldn't trust a the water company to select which Faucet/Shower head you install in your bathrooms. Raw pipes to info == raw pipes to water (interesting aside, the Mayans always equated thought as being symbolized by water) I am paying the water company for pipes to my house, I choose which faucets/shower-heads and use the water is consumed for. Imagine if the water company charged me a different rate for Kohler Faucets used in the kitchen for washing my dishes, vs a Home Depot Hose used in the garden to water my plants? I pay the water company for the volume of water consumed. I pay the ISP for the bandwidth (volume of data) consumed. Further, if the ISP is ostensibly providing my security to literally anything, then, by contract, they are assuming some of the risk? If "what we do is for your protection" -- then they assume full/some liability. The water company provides zero such assurances. A broken pipe/leak/flooding/damage has no affect on the water company, my agreement/bill with them. Further, the water company isn't injecting "paid supplements" (aside from fluoride, which we can equate to NSA backdoors in this example) into my water supply without my will (ads) -- they don't feed me a % of Gatorade in my water supply because Gatorade has a deal with the main faucet - or fertilizers into the garden hose because of a deal with Monsanto. Source: My family owns an actual water company.
- 9y ago

userbinator 9y ago

It's always annoyed me that ISPs seem to like giving customers these horribly overcomplex modems as well as other "value-added features" like "inject advertisements into the user’s unencrypted web traffic" --- especially since customers are already paying them for the service. My vision for an ideal modem is more like a dumb Ethernet to coax/fiber/etc. adapter, and is otherwise as unobtrusive as possible. Ditto for an ideal ISP: just sell access to the raw, unfiltered Internet, and nothing else.

chinathrow 9y ago
Thats what I have via my FTTH provider: plain DHCP enabled ethernet - a media converter is all what is needed. After that: the customer gets to decide what equipment to use/own.
josteink 9y ago
> My vision for an ideal modem is more like a dumb Ethernet to coax/fiber/etc. adapter You'd like Europe then. You know where we have competing ISPs and this is the standard.
- deleted 9y ago
  [deleted]
- hedora 9y ago
  In fairness, comcast (big US ISP) allows you to buy your own cable modem. However, they are terrible for multiple other reasons that would not fly in Europe (data caps, lobbying to resell browsing history, opaque pricing schemes, etc)
  - simonh 9y ago
    But at least they have the freedom to do so, unlike Europe where their right to screw over their customers is unfairly infringed.
    - skummetmaelk 9y ago

fluxsauce 9y ago

This is a shocking and overly broad title. I have Sonic Fusion, which includes a Pace 5268AC modem which is provided by AT&T U-verse and I cannot replicate the issue. The title should be "Some AT&T U-verse modems..."

jlgaddis 9y ago
I also have a 5268AC (on Uverse) and have been unable to replicate these issues (but, TBH, I haven't tried very hard at all), although I have mine in "almost-bridged-mode" ("real" bridged mode can't be done, but I have it as close to bridged mode as I can get it).
jsoo1 9y ago
i have the 5268AC modem and i just did a quick nmap -PU . open ports from that are 80, 8443, and 49152
- relaxitup 9y ago
  80,8443 not open on the external IP are they? Hopefully only internal unless you're OK with that.
sctb 9y ago
Thanks, we've updated the title from “SharknAT&To: AT&T U-verse modems all have Internet-facing hardcoded ssh password” which is editorialized.

CodeWriter23 9y ago

I applaud Hutchins' choice to use Full disclosure instead. Let that be a lesson to all Big Corps, there are White Hats out there who won't be bullied by your "Responsbile disclosure" propaganda. The writing is on the walls, Big Corps, take responsibility and secure your gear by design or be pilloried.

ocdtrekkie 9y ago
At the end of the day, it's pretty unlikely AT&T will suffer any significant losses for this, but there's a decent chance some consumers will.
- CodeWriter23 9y ago
  Every codependent has some excuse for enabling their abuser.

JL2010 9y ago

I can't seem to find any information on how or if this was disclosed to AT&T. Does anyone know how the blogger proceeded here?

rwbhn 9y ago
Comments at the bottom indicate it was not pre-disclosed.

mlosapio 9y ago

This is terrifying

matt_wulfeck 9y ago

Here[1] is a 802.1x proxy you can use to hide your incredibly vulnerable residential gateway behind a firewall of your choosing. It allows the eap packets to pass through. I honestly knew this was going to be a problem when I first port-scanned my residential gateway and saw exposed who-knows-what ports, but for symmetrical 1Gb internet for $79.99 a month what can you do? [1] https://github.com/ShadwDrgn/eap_proxy/blob/master/eap_proxy.py https://github.com/ShadwDrgn/eap_proxy/blob/master/eap_proxy...

nmjohn 9y ago
I had the exact same thought after port scanning my own uverse gigapower connection - so seeing real exploits actually be found on it is not surprising in the slightest to me. Though instead of going with the 802.1x proxy approach, it's also possible to spoof the mac address of the RG with your router and swap it in place after 802.1x authentication has occurred. (You have to swap without the link to the ONT going down however, the easiest way to do so being a switch with VLAN support. You put the RG and ONT on one vlan, and then once the connection is up, you swap your router in place of the RG.) Then you can unplug the RG and put it in your closet (until you have a power outage and have to do it again, which is the main drawback to this approach. However since AT&T provides a UPS for the ONT, if you have a UPS for your router you should be good there too.)

hedora 9y ago

What really ticks me off about this is that for FTTN access around here, you have to use their crappy routers. This is true even if you go through a third party like sonic.net. Worse, their routers seem to do something to defeat attempts at two-level NAT setups. I thought one of the network neutrality principles said you couldn't discriminate against compatible network hardware. Too bad Pai is in now.

mikeash 9y ago
This is one reason why I really like FiOS. I get ethernet straight into the house. Sometimes you get coax instead, but you can use a MoCA adapter to convert it to ethernet. And their provided modem is actually pretty decent! I had planned to bypass it when I signed up for the service, but after using it for a bit I decided to just keep it in place.

matt_wulfeck 9y ago

Can someone please use this to lift the EAP certificate so that any individual can authenticate themselves with AT&T instead of having to put the gateway in the very entrance to the home network?

feelin_googley 9y ago

In a world where users should have control over their own computers, it is the customer who should have SSH access, not AT&T. But as you all know, most times the customer does not own the modem. One well-known workaround is for the customer to use their own modem or to use their own router as a gateway to the modem. But does this really give the user more contorl over the modem/router? These user-owned modems/routers usually do not encourage SSH access by the user, if they even provide it. Instead they promote a "web interface". Indirect control of the settings. Better than SSH? That is for you to decide. The "market" seems to love the "web interface". But this often the easiest vector for successful attacks. Less control, and less safety. Is the tradeoff still worth it? That is for you to decide. https://threatpost.com/vulnerability-disclosed-in-ubquiti-networks-admin-interface/124392/ https://threatpost.com/vulnerability-disclosed-in-ubquiti-ne... https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170316-0_Ubiquiti_Networks_authenticated_command_injection_v10.txt https://www.sec-consult.com/fxdata/seccons/prod/temedia/advi... http://www.securityweek.com/worm-infects-many-ubiquiti-devices-old-vulnerability http://www.securityweek.com/worm-infects-many-ubiquiti-devic... Relying on "Keep up to date with patches" or "Enable updates" as a strategy to improve the safety of a product that was unsafe to begin with is a bit of cognitive dissonance given that its safety was deemed "good enough" for the renter/purchaser at the time of rental/purchase. To achieve a safer product requires not only manufacturers to set new priorities but also consumers as well. How important is that "web interface"? More important than safety? And why not configure using SSH instead? Whatever the reasons, tradeoffs have consequencesre: safety.

FiveSquared 9y ago

Well I have AT&T and the hack it worked for me! Words could not express the feelings of terror that I have right now.

wu_tang_chris 9y ago
> Words could not express the feelings of terror that I have right now. have you tried the word "hyperbolic" ?
- yjftsjthsd-h 9y ago
  I disagree; it is totally reasonable to be terrified when the device at the heart of your network has a internet-facing root exploit that you can't patch.

chx 9y ago

This is why, if I can, get bridge mode on the ISP provided device and put in an OpenWRT router. I am still on 802.11n but who cares, most of my devices are not 802.11ac either. I want to know what runs on my router, damnit! It's my biggest vulnerability if done wrong and one of the more important security features of the home network if done right.

dqv 9y ago

I am not joking when I ask this question: will this open me up to potential CFAA charges if I run the commands to check if I'm vulnerable and run the self-mitigation commands?

ronnier 9y ago

1. SSH exposed to The Internet; superuser account with hardcoded username/password. 2. Default credentials “caserver” https server NVG599 3. Command Injection “caserver” https server NVG599 4. Information disclosure/hardcoded credentials 5. Firewall bypass no authentication

saagarjha 9y ago

> a kernel module whose sole purpose seems to be to inject advertisements into the user’s unencrypted web traffic Ugh…why is this even a thing? Like who thought it would be okay to add this "feature" to a modem, let alone at the kernel level where it would be difficult to disable and easier to be compromised?

chrissnell 9y ago

I have AT&T U-verse (Gigabit fiber product) at home and I believe that I an not vulnerable to public Internet attacks because I've configured my modem in pass-through mode. The AT&T pass-through is pretty weak and is really only a 1:1 NAT, not a bridge, but as far as I can tell, the modem does not answer to the Internet when configured in this mode.

caryhartline 9y ago

Another way around this is to just request a modern modem. I recognize that modem as an older model and, especially if it is having hardware problems, you can just call up AT&T and ask for their newer model (not sure if it is still the newest) 5268ACFXN.

monochromatic 9y ago
You sure the new model isn't similarly vulnerable?

ryanmarsh 9y ago

I just installed a Ubiquity Unifi Security Gateway and AP behind my Uverse modem and turned everything off including the radios. Thank God. I'm sure I could still be MITM so running all traffic to a VPN now.

deleted 9y ago

[deleted]

doctorshady 9y ago

This wouldn't be the first time I've heard of some AT&T-specific vulnerabilities on a router: https://www.soldierx.com/bbs/201704/voip-router-hacking https://www.soldierx.com/bbs/201704/voip-router-hacking

js2 9y ago

I have AT&T Gigapower with a Pace 5268AC, so not one of the modems discussed here. I don't use its wifi and I have it configured for pass-thru mode. When I got service early this year, I briefly investigated bypassing it entirely. It turns out you need the modem to periodically respond to authentication packets from the AT&T network. But with some ingenuity, you can hang the router off an extra port on your own router and use it only for authentication purposes: http://www.dslreports.com/forum/r29903721-AT-T-Residential-Gateway-Bypass-True-bridge-mode~start=480 http://www.dslreports.com/forum/r29903721-AT-T-Residential-G... I eventually decided not to do this because it's somewhat brittle and I didn't otherwise have any issues with the Pace. It's performance is fine. But, given this disclosure, I'm going to revisit my decison. First, it seems like it's just a matter of time before the Pace has a similar security issue. Second, that kernel module for injecting HTTP advertisements. Just the idea of it bothers me.

js2 9y ago
Update: I've moved the 5268AC behind my EdgeRouter Lite. I wasn't happy with any of the 802.1x proxies other folks wrote and/or they weren't working for me and/or I just wanted to write it in Python, so I wrote my own: https://github.com/jaysoffian/eap_proxy https://github.com/jaysoffian/eap_proxy

fishywang 9y ago

So since Sonic was highly reviewed and hyped here (San Jose), I checked them out/tried to switch to them. For my address the only option from them was the one on AT&T's IP network. For that service, I must use the modem they (AT&T) give me. There's modem renting fee, and there's router feature that I cannot turn off. That's the dealbreaker for me so I stopped trying. I'm glad that I didn't go that route, and I hope Sonic could do better here.

brianpan 9y ago
Sonic uses AT&T's networks but provides their own service on those networks. The modem is not an AT&T modem and it's not the one in the article.
- fishywang 9y ago
  But still, there's router feature on that modem that I cannot turn off, so I cannot bring my own router (unless I want to do double-NAT), and there are still highly likely some hardcoded remote access password.

relaxitup 9y ago

Has anyone with this modem in the wild actually confirmed this update was pushed to them and if so is ssh listening on their public IP? So far in the article comments (haven't looked thru HN comments yet), those having this modem have verified that ssh is not listening.