4 ms·

I haven't read the full report, but, the PoC[1] and the explanations I have seen before seem to indicate one has to be on the "local" side of the cable modem to

by nanis 7y ago

I haven't read the full report, but, the PoC[1] and the explanations I have seen before seem to indicate one has to be on the "local" side of the cable modem to run the exploit. That is, it doesn't seem like this is exploitable remotely. That is, the attacker either needs to have been allowed to connect to your WiFi (either through another vulnerability or voluntarily) or attached a cable to your WiFi router or your cable modem. This is not impossible (not even requiring reliance on the fact that Google, Apple, and Microsoft among them have pretty much everyone's WiFi passwords[2]), but a wave of attacks based on this is much less feasible than if they could be carried en masse on the internet. [1]: https://github.com/Lyrebirds/sagemcom-fast-3890-exploit/blob/deb542553a90d84c6c5ffba59eaeab8bc126aadd/exploit.py#L32 https://github.com/Lyrebirds/sagemcom-fast-3890-exploit/blob... [2]: https://tourkick.com/advice-tips-howto/myth-busting-windows-10-wi-fi-sense-google-wireless-mapping/ https://tourkick.com/advice-tips-howto/myth-busting-windows-...

ffffasd33 7y ago
> That is, the attacker either needs to have been allowed to connect to your WiFi (either through another vulnerability or voluntarily) or attached a cable to your WiFi router or your cable modem. no you just have to visit a malicious link, through dns rebinding any local attack against a router can be done remotely.
stedaniels 7y ago
This is incorrect. It's accessed with websockets, that can be run from any webpage, so all you'd have to do is follow a malicious link. From the article: > Accessing the Endpoint > The endpoint, which serves a tool called spectrum analyzer, uses a websocket for communication with the graphical frontend displayed in a browser. Whereas CORS would restrict access to such an endpoint for HTTP requests, websocket is not protected by this protocol. Therefore, it is up to the server to verify the relevant request parameters added by the browser. Because these parameters are never inspected by the cable modem, the websocket will accept requests made by javascript running in the browser regardless of origin, thereby allowing attackers to reach the endpoint. It should be noted that the exploit is not limited to run in a browser. Any place where running code can reach an IP on the local network, can be used to exploit Cable Haunt.
- nanis 7y ago
  Thank you for correction. Voted your comment up.

by nanis 7y ago

ffffasd33 7y ago

> That is, the attacker either needs to have been allowed to connect to your WiFi (either through another vulnerability or voluntarily) or attached a cable to your WiFi router or your cable modem. no you just have to visit a malicious link, through dns rebinding any local attack against a router can be done remotely.

stedaniels 7y ago

This is incorrect. It's accessed with websockets, that can be run from any webpage, so all you'd have to do is follow a malicious link. From the article: > Accessing the Endpoint > The endpoint, which serves a tool called spectrum analyzer, uses a websocket for communication with the graphical frontend displayed in a browser. Whereas CORS would restrict access to such an endpoint for HTTP requests, websocket is not protected by this protocol. Therefore, it is up to the server to verify the relevant request parameters added by the browser. Because these parameters are never inspected by the cable modem, the websocket will accept requests made by javascript running in the browser regardless of origin, thereby allowing attackers to reach the endpoint. It should be noted that the exploit is not limited to run in a browser. Any place where running code can reach an IP on the local network, can be used to exploit Cable Haunt.

nanis 7y ago
Thank you for correction. Voted your comment up.