10 ms·

Fiber router critical vulnerability exposure

101 points by rmdoss 4y ago

albertpurnama 4y ago
Test Typedream comment
- exikyut 4y ago
  Pardon me for ignoring the implied "please ignore", but I'm very curious what "typedream" refers to? The only references I can find online are to a website builder platform, but the name sounds like it could represent a client app or maybe even a keyboard?
  - albertpurnama 4y ago
    Hey there, Yes please ignore the comment! Also, yes, it's a website builder! this comment was to test a notification tool that I'm using right now to notify whenever a new mention of "Typedream" shows up on HackerNews!
former 4y ago
Monolithic network appliances, computers, endpoints, etc are fundamentally designed without a security-first posture. There's nothing conceptually wrong with a modem that also contains a NAT firewall/router/switch/(WAP). But in practice, even examining the hardware architecture of a consumer-grade router reveals fundamental design flaws in terms of the monolithic nature of the hardware architecture. Thus, using separate appliances for modem, router, switch, etc., that are physically separated, is still a good idea. Of course, once you pick apart the shortcomings of a global TCP/IP network itself, it's clear that a single pipe connected directly to the internet is also a horrible idea, security-wise. I have been asking myself of late: "Self, if we were to design the internet from scratch and from security-first principles, how would it look?" Doing so requires detaching entirely from the existing mess we've created. Actually building a new security-first internet with backwards-compatibility would be an enormous increase in complexity, and would put into question the viability of the security of trillions in investment into entrenched global-scale infrastructure. Thus, any attmepts to solve this problen -- essentially boiling the ocean(s) -- is likely to remain (literally) a (multi-)pipe dream. However, I am hopeful that new initiatives to build out 'hyperscale' and 'edge' clouds will present a genuine opportunity to realize the dream of a secure internet, secure networking, secure devices.
- trasz 4y ago
  >from scratch You do realize that this is already a red flag, right? In 99% cases the decision to start from scratch when you already have something well established is a mistake.
  - E2EEd 4y ago
    SOP: Build "from scratch" as a superset on the existing legacy.
xoa 4y ago
>It is possible to recover the WiFi access code and SSID, remote administration password, SIP credentials (if VoIP is supported), ISP CWMP/TR-069 endpoint URLs and their username and password as well as other sensitive information, although some parts may require more complicated techniques or computing resources that may not be available to all attackers. Network-based unauthenticated exploitation is most severe if the router’s web services (such as the administration portal) are exposed to the Internet, though it can also be exploited on the LAN. I just a few weeks ago got another Arris S33 modem for a client using cable, it's fairly well regarded. While this vulnerability doesn't list those, to me this further highlights how it can be valuable to separate out networking components vs all-in-one. The modem is purely a modem and talks only to the ISP. The router is a SuperMicro system running OPNsense, which then goes out to TP-Link Omada (or UniFi at another older site) gear for switching and WiFi. There is a network control VLAN as well as admin VLAN accessible only via WireGuard, which is the only way to get to the modem's admin page from the LAN. Controllers are self-hosted with network control VLANs at multiple sites again routed via WG to the controller. While there are other advantages as well in terms of being able to replace parts piecemeal for less, better coverage etc, it's also nice in terms of vulns in one thing doesn't necessarily mean everything else instantly collapses, and it's easier to have multiple layers. The router is still a chokepoint, but full opensource and standard hardware at least mean a lot of extra eyes and tools can be applied to it and one is never at some vendor's mercy for firmware updates. Modem compromise wouldn't affect the LAN beyond potentially messing with WAN access which would be noticeable fairly quickly. Default LAN users can't easily touch any of the infrastructure either. All while being transparently usable with internet of shit stuff that people want to utilize. Full zero-trust or a virtual overlay network might be better yet but starts to run into the same legacy issues that hound so much of the industry particularly for non-tech SoHo/SMB. While it's unfortunate how riddled with issues a lot of ISP devices have tended to be, it's pretty nice what reasonably priced powerful options exist for anyone with networking now across a huge range of skill levels. It could be much better still but it's not nothing.
- oasisbob 4y ago
  Arris DOCSIS modems probably still have a lot of Motorola DNA in them since Arris's 2012 acquisition of Motorola Home. I have a box somewhere with near-identical Motorola/Arris surfboards other than the logo and color.
jeffbee 4y ago
Routers should not contain http servers, nor any other connection-oriented server that can accept. Just stop doing this.
- nykolasz 4y ago
  how are the users going to manage the router without it? they just need to do it securely and better ways to auto update.
  - jeffbee 4y ago
    By inverting the direction of control, such that the network device initiates connections to canonical addresses to receive their initial configurations.
    - water8 4y ago
      By canonical addresses are you referring to dns that can be spoofed or IP addresses that can be rerouted?
    - jeroenhd 4y ago
      A nice idea in theory, I'd love to manage networks devices using some open standard. However, I can already see what would happen if this were to become reality: "You wish to configure your router? For your safety, you can only configure our VaporWare™ SecuRouter with our dedicated Windows 11 or phone app. Do note that any ad or tracking blockers might interfere with our super privacy preserving app (trust us, really!). only Android, iOS, and Windows 11 are supported. App does not work without Internet connectivity. Android devices require Google Play services. Jailbreak and root access will trigger our SecuRouter Secure Data Protection mechanism and disable access from your IP address. Privacy agreements and terms and conditions apply. Product may not be sold in areas covered by the GDPR." In fact, I've had to deal with routers that required me to log in through the ISP website rather than locally because of "security".
      - jeffbee 4y ago
Arnavion 4y ago
For Frontier / Ziply users using an NVG448 - it's also affected.
- simfree 4y ago
  This modem is the last released DSL modem that Ziply seems to be supporting :c I wish Ziply would officially support more modern DSL modems like the hardware that is in the C4000BG, that modem is able to make marginal DSL circuits perform so much better.
RulerOf 4y ago
I read this and _instantly_ wonder if it's viable for certificate extraction to bypass the god-awful NAT system in AT&T's equipment, a-la pfatt: https://github.com/MonkWho/pfatt https://github.com/MonkWho/pfatt Edit: Ah yes, this is covered in the section "Obtaining the certificate via reboot & exploitation" Sadly my hardware appears to be patched.
- physhster 4y ago
  You can downgrade the firmware and extract the certs: https://www.dupuis.xyz/bgw210-700-root-and-certs/ https://www.dupuis.xyz/bgw210-700-root-and-certs/ However, AT&T added another layer of authentication in mid-2021 that precludes the use of third-party hardware. I don't think that part has been cracked yet.
  - simfree 4y ago
    You don't need the 802.1x certificate, it's never actually been needed: https://www.dslreports.com/forum/r33442912-AT-T-Fiber-Bye-bye-802-1x-you-will-not-be-missed https://www.dslreports.com/forum/r33442912-AT-T-Fiber-Bye-by...
    - RulerOf 4y ago
      That's a very interesting thread. Looks like things haven't been figured out to the point of prescriptive directions, but thank you very much for bringing it to my attention. Will keep my eyes on it.
deleted 4y ago
[deleted]
edent 4y ago
How do companies like Arris keep getting work? I have an ISP supplied Arris Cable Modem (luckily not vulnerable) and it is dreadful. The UI is shonky, looking at the HTML & CSS underlying it is enough to make you weep, outdated JS libraries, and - seemingly - no software updates. I could just about understand if it was stable and gave good WiFi - but the ISP's forums are full of people complaining about it. All I can assume is that Arris is £1 cheaper than the next model, and the ISP have decided that dealing with customer complaints is cheaper than a higher CapEx.

101 points by rmdoss 4y ago

albertpurnama 4y ago

Test Typedream comment

exikyut 4y ago
Pardon me for ignoring the implied "please ignore", but I'm very curious what "typedream" refers to? The only references I can find online are to a website builder platform, but the name sounds like it could represent a client app or maybe even a keyboard?
- albertpurnama 4y ago
  Hey there, Yes please ignore the comment! Also, yes, it's a website builder! this comment was to test a notification tool that I'm using right now to notify whenever a new mention of "Typedream" shows up on HackerNews!

former 4y ago

Monolithic network appliances, computers, endpoints, etc are fundamentally designed without a security-first posture. There's nothing conceptually wrong with a modem that also contains a NAT firewall/router/switch/(WAP). But in practice, even examining the hardware architecture of a consumer-grade router reveals fundamental design flaws in terms of the monolithic nature of the hardware architecture. Thus, using separate appliances for modem, router, switch, etc., that are physically separated, is still a good idea. Of course, once you pick apart the shortcomings of a global TCP/IP network itself, it's clear that a single pipe connected directly to the internet is also a horrible idea, security-wise. I have been asking myself of late: "Self, if we were to design the internet from scratch and from security-first principles, how would it look?" Doing so requires detaching entirely from the existing mess we've created. Actually building a new security-first internet with backwards-compatibility would be an enormous increase in complexity, and would put into question the viability of the security of trillions in investment into entrenched global-scale infrastructure. Thus, any attmepts to solve this problen -- essentially boiling the ocean(s) -- is likely to remain (literally) a (multi-)pipe dream. However, I am hopeful that new initiatives to build out 'hyperscale' and 'edge' clouds will present a genuine opportunity to realize the dream of a secure internet, secure networking, secure devices.

trasz 4y ago
>from scratch You do realize that this is already a red flag, right? In 99% cases the decision to start from scratch when you already have something well established is a mistake.
- E2EEd 4y ago
  SOP: Build "from scratch" as a superset on the existing legacy.

xoa 4y ago

>It is possible to recover the WiFi access code and SSID, remote administration password, SIP credentials (if VoIP is supported), ISP CWMP/TR-069 endpoint URLs and their username and password as well as other sensitive information, although some parts may require more complicated techniques or computing resources that may not be available to all attackers. Network-based unauthenticated exploitation is most severe if the router’s web services (such as the administration portal) are exposed to the Internet, though it can also be exploited on the LAN. I just a few weeks ago got another Arris S33 modem for a client using cable, it's fairly well regarded. While this vulnerability doesn't list those, to me this further highlights how it can be valuable to separate out networking components vs all-in-one. The modem is purely a modem and talks only to the ISP. The router is a SuperMicro system running OPNsense, which then goes out to TP-Link Omada (or UniFi at another older site) gear for switching and WiFi. There is a network control VLAN as well as admin VLAN accessible only via WireGuard, which is the only way to get to the modem's admin page from the LAN. Controllers are self-hosted with network control VLANs at multiple sites again routed via WG to the controller. While there are other advantages as well in terms of being able to replace parts piecemeal for less, better coverage etc, it's also nice in terms of vulns in one thing doesn't necessarily mean everything else instantly collapses, and it's easier to have multiple layers. The router is still a chokepoint, but full opensource and standard hardware at least mean a lot of extra eyes and tools can be applied to it and one is never at some vendor's mercy for firmware updates. Modem compromise wouldn't affect the LAN beyond potentially messing with WAN access which would be noticeable fairly quickly. Default LAN users can't easily touch any of the infrastructure either. All while being transparently usable with internet of shit stuff that people want to utilize. Full zero-trust or a virtual overlay network might be better yet but starts to run into the same legacy issues that hound so much of the industry particularly for non-tech SoHo/SMB. While it's unfortunate how riddled with issues a lot of ISP devices have tended to be, it's pretty nice what reasonably priced powerful options exist for anyone with networking now across a huge range of skill levels. It could be much better still but it's not nothing.

oasisbob 4y ago
Arris DOCSIS modems probably still have a lot of Motorola DNA in them since Arris's 2012 acquisition of Motorola Home. I have a box somewhere with near-identical Motorola/Arris surfboards other than the logo and color.

jeffbee 4y ago

Routers should not contain http servers, nor any other connection-oriented server that can accept. Just stop doing this.

nykolasz 4y ago
how are the users going to manage the router without it? they just need to do it securely and better ways to auto update.
- jeffbee 4y ago
  By inverting the direction of control, such that the network device initiates connections to canonical addresses to receive their initial configurations.
  - water8 4y ago
    By canonical addresses are you referring to dns that can be spoofed or IP addresses that can be rerouted?
  - jeroenhd 4y ago
    A nice idea in theory, I'd love to manage networks devices using some open standard. However, I can already see what would happen if this were to become reality: "You wish to configure your router? For your safety, you can only configure our VaporWare™ SecuRouter with our dedicated Windows 11 or phone app. Do note that any ad or tracking blockers might interfere with our super privacy preserving app (trust us, really!). only Android, iOS, and Windows 11 are supported. App does not work without Internet connectivity. Android devices require Google Play services. Jailbreak and root access will trigger our SecuRouter Secure Data Protection mechanism and disable access from your IP address. Privacy agreements and terms and conditions apply. Product may not be sold in areas covered by the GDPR." In fact, I've had to deal with routers that required me to log in through the ISP website rather than locally because of "security".
    - jeffbee 4y ago

Arnavion 4y ago

For Frontier / Ziply users using an NVG448 - it's also affected.

simfree 4y ago
This modem is the last released DSL modem that Ziply seems to be supporting :c I wish Ziply would officially support more modern DSL modems like the hardware that is in the C4000BG, that modem is able to make marginal DSL circuits perform so much better.

RulerOf 4y ago

I read this and _instantly_ wonder if it's viable for certificate extraction to bypass the god-awful NAT system in AT&T's equipment, a-la pfatt: https://github.com/MonkWho/pfatt https://github.com/MonkWho/pfatt Edit: Ah yes, this is covered in the section "Obtaining the certificate via reboot & exploitation" Sadly my hardware appears to be patched.

physhster 4y ago
You can downgrade the firmware and extract the certs: https://www.dupuis.xyz/bgw210-700-root-and-certs/ https://www.dupuis.xyz/bgw210-700-root-and-certs/ However, AT&T added another layer of authentication in mid-2021 that precludes the use of third-party hardware. I don't think that part has been cracked yet.
- simfree 4y ago
  You don't need the 802.1x certificate, it's never actually been needed: https://www.dslreports.com/forum/r33442912-AT-T-Fiber-Bye-bye-802-1x-you-will-not-be-missed https://www.dslreports.com/forum/r33442912-AT-T-Fiber-Bye-by...
  - RulerOf 4y ago
    That's a very interesting thread. Looks like things haven't been figured out to the point of prescriptive directions, but thank you very much for bringing it to my attention. Will keep my eyes on it.

deleted 4y ago

[deleted]

edent 4y ago

How do companies like Arris keep getting work? I have an ISP supplied Arris Cable Modem (luckily not vulnerable) and it is dreadful. The UI is shonky, looking at the HTML & CSS underlying it is enough to make you weep, outdated JS libraries, and - seemingly - no software updates. I could just about understand if it was stable and gave good WiFi - but the ISP's forums are full of people complaining about it. All I can assume is that Arris is £1 cheaper than the next model, and the ISP have decided that dealing with customer complaints is cheaper than a higher CapEx.