4 ms·

It doesn't seem to be feasible using this vulnerability: > Cable Haunt is exploited in two steps. First, access to the vulnerable endpoint is gained through a

by nanis 7y ago

It doesn't seem to be feasible using this vulnerability: > Cable Haunt is exploited in two steps. First, access to the vulnerable endpoint is gained through a client on the local network, such as a browser. (emphasis mine)

jalk 7y ago
That means loading a webpage from the internet, which then runs the exploit in javascript on your local machine. Tricking users to load the page through phishing or through ads served from shady ad networks is ‘all’ it takes
- nanis 7y ago
  Thank you for the correction.
big_chungus 7y ago
This is almost certainly exploitable remotely with a DNS rebinding attack.
- thu2111 7y ago
  You don't need any fancy rebinding attacks. That's a bit 2001 era web hacking :) This issue is based on WebSockets where the software on the modem: a) Doesn't verify any of the origin headers sent, so any origin works (rebinding is designed to beat origin checks) b) Copies an uploaded message straight onto the stack without doing any size checks
- onesmallcoin 7y ago
  @thu2111 He's giving you an attack chain. If you rebind the dns server of the modem with a snmp/tr069 exploit you could redirect/inject into the http traffic a page that contained the javascript payload to exploit the Cable Haunt vulnerabiliy against the Spectrum Analyser endpoint. Because websockets doesn't use CORS to restrict the requesting hosts domain to the modem, you could execute code on the gateway modem from the internet with the combination of a client on the remote network running a http request from a browser combined with an alternative dns rebinding attack against the gateway and a server hosting the malicious websockets payload on a http server. Edit: or you could get them to click on a link
tyingq 7y ago
Sibling comments mention hacked web pages and DNS rebinding. I imagine there are also many of these routers that still have unpatched issues with SNMP, like "stringbleed". https://www.bleepingcomputer.com/news/security/several-cable-modem-models-affected-by-snmp-god-mode-flaw/ https://www.bleepingcomputer.com/news/security/several-cable...
shawnz 7y ago
It also seems to require that the attacker knows the credentials for the modem.
- kjs3 7y ago
  They are virtually always either the manufacturers default credentials or the carriers default credentials. Anyone can find the former, and all one has to do is find a pliable tech to get the latter.

by nanis 7y ago

jalk 7y ago

That means loading a webpage from the internet, which then runs the exploit in javascript on your local machine. Tricking users to load the page through phishing or through ads served from shady ad networks is ‘all’ it takes

nanis 7y ago
Thank you for the correction.

big_chungus 7y ago

This is almost certainly exploitable remotely with a DNS rebinding attack.

thu2111 7y ago
You don't need any fancy rebinding attacks. That's a bit 2001 era web hacking :) This issue is based on WebSockets where the software on the modem: a) Doesn't verify any of the origin headers sent, so any origin works (rebinding is designed to beat origin checks) b) Copies an uploaded message straight onto the stack without doing any size checks
onesmallcoin 7y ago
@thu2111 He's giving you an attack chain. If you rebind the dns server of the modem with a snmp/tr069 exploit you could redirect/inject into the http traffic a page that contained the javascript payload to exploit the Cable Haunt vulnerabiliy against the Spectrum Analyser endpoint. Because websockets doesn't use CORS to restrict the requesting hosts domain to the modem, you could execute code on the gateway modem from the internet with the combination of a client on the remote network running a http request from a browser combined with an alternative dns rebinding attack against the gateway and a server hosting the malicious websockets payload on a http server. Edit: or you could get them to click on a link

tyingq 7y ago

Sibling comments mention hacked web pages and DNS rebinding. I imagine there are also many of these routers that still have unpatched issues with SNMP, like "stringbleed". https://www.bleepingcomputer.com/news/security/several-cable-modem-models-affected-by-snmp-god-mode-flaw/ https://www.bleepingcomputer.com/news/security/several-cable...

shawnz 7y ago

It also seems to require that the attacker knows the credentials for the modem.

kjs3 7y ago
They are virtually always either the manufacturers default credentials or the carriers default credentials. Anyone can find the former, and all one has to do is find a pliable tech to get the latter.