11 ms·
Unauthenticated RCE on a RIGOL oscilloscope
- Towaway69 3y agoNice writeup and explanation how to get firmware outside of the hardware. Bypassing strncmp was particularly insightful.
- 13of40 3y agoWas I reading it wrong, or does the system actually store a clear text copy of the password instead of a hash?
- Towaway69 3y agoIt would appear to be clear text with the assumption that no one can login onto the device. I assume the manufacturer makes this assumption.
- galangalalgol 3y agoStoring a salted hash would be nice, but scopes without ntp or internal wall clocks are the norm, so not sure what to salt with. And a plain hash is pretty easy to beat right? As far as getting the hash, these are people who are using oscopes, it doesn't seem unlikely they could jtag it out without some decent safeguards in place. Worrying about physical security on an oscope seems like a bad risk management trade.
- mlyle 3y ago> so not sure what to salt with Scopes have massive amounts of true random data at their disposal. :P This isn't a nonce where you might need some kind of special timing properties. We hash so that people can't grab your password and use it elsewhere. We add some salt to make the hash more robust to memory and precomputation attacks.
- meithecatte 3y agoI don't think it's strncmp itself that's the problem. They fucked up and are only checking that the provided password matches a prefix of the stored password. And obviously an empty string is a matching prefix.
- colonwqbang 3y agoThe (decompiled) code looks very amateurish in general. Like, who writes something like system("echo >... or system("sync"). Looks like something written by a very green engineer/intern and not reviewed by anyone else.
- randomhacker123 3y agoSadly this looks like "industry standard" to me. I have seen many embedded Linux devices using mostly C applications and a lot of usage of the system() function with no or very poor input validation before. When you want to exploit embedded Linux devices always look for calls to system() first. The "strncmp(saved_pwd,pass0,strlen(pass0))" looks equally bad. Probably someone did not understood the advice "always check the length first" and just did it everywhere. Intel AMT checked the password in a similar way some time ago: https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability https://www.tenable.com/blog/rediscovering-the-intel-amt-vul...
- jacquesm 3y agoMany of these faults are simply the consequence of never reading the manpage of a function but making assumptions about implementation details of an imaginary version of a function with the same name.
- fest 3y agoThough, in this case, manpage doesn't exactly spell out that two strings of which one is 0 chars long results in a match. I often remember my PHP days in horror, but mysqli_query manpage does warn you about SQL-injections now.
- dmvdoug 3y agoI’m sorry, but your comment came right after the comment thread about a guy printing gay porn and I thought you were making a joke and I was giggling about the firmware and hardware thing and then I realized you were making a serious point.
- veave 3y agoI wonder who goes around thinking "I'm going to expose an oscilloscope to the WAN!". Something you have to do on purpose, taking lots of extra steps, because of CG-NAT. Kinda asking for it.
- mschuster91 3y agoMany universities give everyone on their network a fully routed IP address, at least this was the case ten-ish years ago for me in Germany. Was ideal if you were developing something and showing it off to someone at the other end of the campus while being on the phone or Teamspeak - just give the other person your IP address and spin up a server at 8080, that's it. Besides, if I were on a red team, I'd enumerate all devices on the LAN as well. Simply to look for all that old cruft someone set up years ago and never updated... that's where you get persistence. No one goes and checks 'scopes, network gear or printers for indicators of compromise in their firmware, because no one thinks of them if the admin isn't looking for outgoing Internet traffic.
- Aurornis 3y ago> Many universities give everyone on their network a fully routed IP address, at least this was the case ten-ish years ago for me in Germany Times have changed a lot in the past decade. No reasonable network admin would be giving public IPs to everything that connects to the network any more. IPv4 addresses are also scarce relative to a decade ago.
- don-code 3y agoSadly, to my current understanding, my alma mater still does this. At the time it was extremely convenient - we had labs full of Solaris and Linux boxes, which could be remotely accessed from home without any issue. And I also seem to remember that basically nothing on IT's part had to be done during the Xbox 360 / Xbox Live craze, unlike my peers at other schools. Even then, though, the downsides of consumer network security (mostly) relying on NAT were obvious. Common ports (80, 25, etc) were blocked inbound; the school's printers basically had to be on their own network, or get spammed all day.
- remram 3y agoI'm a bit confused about the timeline at the bottom, was the vulnerability patched?
- Mathnerd314 3y agoIt looks like they never replied to him for months so he just published it. This would also fit with the HN title (conclusion in the post). I think if it was patched it would be "I found a bug".
- SV_BubbleTime 3y agoThis sounds like Rigol and Siglent. Very impressive hardware for the price, questionable support and software.
- nimish 3y agoSiglent seems to be moving upmarket at least. Rigol has wildly good on paper hardware but their software is suspect. Rigol made their own ADC chip that beats most off the shelf stuff yet they have some of the jankiest software and English translation known to man.
- pmontra 3y agoFrom the timeline > RIGOL says they would reply in 2-3 days, 1/28/23 > Full disclosure, 2/8/23 Those should be January 28 2023 and February 8 2023, which is the date of the post. It's only 13 days after the last communication from RIGOL, not months. By the way, could at least us developers use ISO dates instead of whatever our local conventions are?
- mlyle 3y ago> It's only 13 days after the last communication from RIGOL, not months. 3 months of total stalling without a real reply to him. The last communication was only that they'd provide more details in a few days. The fact that he asked again before the disclosure timeframe and they were like "uh, just give us a minute" doesn't change anything.
- StayTrue 3y agoAs a separate issue, it’s strange the firmware pkg is not encrypted.
- mardifoufs 3y agoWhy is it an issue? Is it to make sure that the right firmware is loaded? I always thought encrypted firmwares were mostly a form of lock in.
- m4rtink 3y agoYeah - if anything, you could sign it and/or checksums it. Encryption indeed sounds like lock-in.
- luma 3y agoRigol is pretty famous for not really caring a single bit about security. It's helpful in one particular area, in that they sell the device in the OP for anywhere between $900 and $2900 depending on which features are enabled, except all of those features are software locked with the same attention to security as they do everything else. The result is that you can get a hell of a lot of scope for very little money, but don't expect it to offer things like "robust security".
- deleted 3y ago[deleted]
- amelius 3y agoAlso don't expose your Xerox printers to the internet (they will auto install user-hostile "upgrades")
- samstave 3y ago[flagged]
- blueflow 3y ago... which sick kind of person is printing porn to paper instead of watching it on a screen like any normal person?
- psychphysic 3y ago> He was an EVP there, who was married with kids. Maybe he's bi.
- samstave 3y agoSure, no judgement, but not openly so, except after this - and his was literally printing out the home pages of sites so it just showed thumbnails of the vids.. obv. So I assume he was closeted (he was like 60 or so) and I assume he used the pages for fap material without an accidental phone copy - this was also the Treo and flip phone era - 2006 so IPhone hadn’t come out yet
- chx 3y agoHere, I have a better, simpler , all encompassing rule: do not expose anything closed source to the Internet. No, this is not Linux zealotry, I also advocate against using Linux as a daily driver on a modern laptop. The right tool for the right job: OpenWRT on routers, Windows + WSL on laptops. But, you are asking, how do you use your Windows laptop like this when away from home? Easy: GL.iNet has tiny travel routers with OpenWRT supported out of the box.
- KeplerBoy 3y agoWhy would you advocate against Linux on Laptops? If it works just as well and floats my boat, why change to windows?
- chx 3y agohttps://news.ycombinator.com/item?id=36678027 https://news.ycombinator.com/item?id=36678027
- KeplerBoy 3y agoI agree. Life's too short for fiddling with the OS and i would have wiped PopOs from my Laptop a long time ago if it wouldn't work flawless, but it does (cheap Thinkpad L580).
- pschastain 3y agoWindows has it's own fun set of problems with drivers: https://www.esecurityplanet.com/threats/malicious-microsoft-drivers/ https://www.esecurityplanet.com/threats/malicious-microsoft-...
- metalforever 3y agoI don't know bro, I've been installing Linux on random computers (not-preselected) for years and I don't have these problems.
- jacquesm 3y agoFWIW I haven't had any hard tech issues with Linux across many different kinds of computers (laptops, desktops, servers, as well as some stuff never intended to run Linux at all such as Macs) and haven't had a serious hardware issue in more than 15 years. The biggest stumbling block was to get Linux installed on an early issue Macbook air just after it came out, other than that not a single glitch. Meanwhile, my family members have issues with their windows boxes every other week or so. I'm sure there are plenty of people that never have a problem with Windows and that can't get Linux to work on their hardware but I'd be careful to generalize from personal experience.
- _trampeltier 3y agoI think such devices anyway have anything lost in a companys LAN. Before such devices had a serial link to a PC. Now every device is in the office LAN. They can never be secure for the many years they are in service.
- throwaway9870 3y agoIt has been like that since the 90s. At Stanford we had a sysadmin track down a warez site to our HP logic analyzer. Everything at Stanford in the 90s had a public IP address (at least in EE).
- kjs3 3y agoProbably an HP 16600/16700[1]. The control processor is basically a repackaged HP-PA workstation running a full version of HP/UX. Used X11 for remote access. The earlier 16500 had an optional, separate equivalent processor. I have a 16702A, which includes a front panel LCD and keyboard console. It's a beast. [1] https://www.keysight.com/us/en/product/16700A/logic-analysis-system.html https://www.keysight.com/us/en/product/16700A/logic-analysis...
- montzark 3y agoMaybe easy fix would be some certification requirement for routers that by default ports to device are closed even from same network? Some time ago there was issue with default passwords and it got solved with default passwords unique to device.
- _trampeltier 3y agoSuch devices can also be attacked in a second stage from a compromised PC or so. Such devices have nothing lost in a production LAN at all.
- ChrisMarshallNY 3y agoAwesome detective work! That's the kind of thing that makes this site special.
- hadrien01 3y agoI was very confused by the date format, so here's the timeline with ISO dates: Vulnerability found, 2022-11-08 Sent detailed PoC, 2022-11-09 RIGOL says they would have contacted me with updates from R&D, 2022-11-09 Follow-up on the vulnerability, 2023-01-25 RIGOL says they would reply in 2-3 days, 2023-01-28 Full disclosure, 2023-02-08
- stavros 3y agoDoes this mean they never patched this, then?
- psychphysic 3y agoSo odd to list a timeline but not enough detail to work out what happened.
- ericpauley 3y agoSuch is life with CVEs, unfortunately. While there are some great central repositories of information there is often very little in the way of consistent information on the disclosure process itself.
- Eduard 3y agoIt's pretty clear to work out what happened from the timeline listed: RIGOL didn’t do shit. The style the author chose to list the timeline is IMHO the most faithful, honest, and polite way of communicating it without adding wrong or legally problematic reasoning to the situation, from their perspective.
- psychphysic 3y agoNah, "no response received from RIGOL" if that's the case is faithful, honest and polite.
- jjoonathan 3y agoThis is RIGOL we are talking about. In a year, they will release a firmware that solves the RCE but opens two more and also breaks cursors (or some other very basic thing). A year after that, they will release a second firmware that fixes the cursors but breaks the calibration and still has the two new RCEs.
- DominoTree 3y agohttps://pbs.twimg.com/media/EkUjA7rVoAA6FF6?format=jpg&name=large https://pbs.twimg.com/media/EkUjA7rVoAA6FF6?format=jpg&name=...
- cesaref 3y agoInstruments like this normally boot from a read only image, so even if you have root access to the box you can't do anything bad to it, well, nothing that won't disappear on reboot. On my Siglent scope (an SDS2104X plus) you can easily hack it to enable telnet access. This requires physical access to the device to add a USB stick with a file on it to achieve this, but it's then very open (described here https://www.eevblog.com/forum/testgear/siglent-sds2000x-plus-coming/825/ https://www.eevblog.com/forum/testgear/siglent-sds2000x-plus...) It was actually one of the things that attracted me to this scope, that it was to some extent hackable. Compared to other scopes like the old Tektronix ones running VxWorks it's nice to have something familiar behind the scenes.
- LeifCarrotson 3y agoExactly! A curl 1-liner to get root access to the Linux shell running on my Rigol scope (an older 1074Z-S...do I even have a webserver?) Think of all the awesome things I could do! This security vulnerability does not make me worried, it makes me happy. Rigols have always been somewhat hackable, this is an even easier way to do it.
- c7DJTLrn 3y agoHow are developers still screwing this up? Is it negligence or stupidity? They shouldn't be allowed to work in industry writing bad code like this. Security vulns happen, but come on, this is the basics.
- epcoa 3y agoYou know how much embedded dev pays? It’s shit. People that are good are usually good enough to go write some Java crud apps and make 3x as much. Unlike the games industry there isn’t nearly as many people drawn to writing the shitware on a consumer router or cut rate oscilloscope.
- c7DJTLrn 3y agoI have no qualms with "acting your wage." This goes below the minimum bar in my opinion. Real engineers don't get away with fuckups with real consequences because of their salary.
- epcoa 3y ago> This goes below the minimum bar in my opinion. I'm not giving you a justification, I'm telling you how it is. > Real engineers don't get away with fuckups with real consequences because of their salary. I mean they absolutely do. What is a "real" engineer anyway? I am a licensed engineer (electrical) because I used to work independently as an engineering firm. I understand the various definitions. The overwhelming majority of those with a title of electrical or computer engineer do not have any kind of professional licensure or certification - at best they may have an accredited 4 year degree. None of these people are going to be personally liable for fuckups of any kind in their careers.
- sidewndr46 3y agoAs others have mentioned, the pay and the incentives for producing quality embedded software is non existent. Just last year I casually inspected and found an RCE in a decade old consumer product just sitting there in plain sight: http://www.hydrogen18.com/blog/hacking-zyxel-ip-cameras-pt-1.html http://www.hydrogen18.com/blog/hacking-zyxel-ip-cameras-pt-1...
- userbinator 3y agosprintf(&CMD_BUF,"echo admin:%s > %s",pass1,path); system(&CMD_BUF); You've probably heard of useless use of cat, but this is a useless use of echo. Given that the code even opens the file in question several lines above, I'm surprised that the author didn't know about fprintf.
- Const-me 3y agoIt seems the device embeds a conventional ARM Linux. If I were developing embedded software for a device like that, I would have used asp.net core runtime. It’s much easier to create secure web apps using C#, compared to cgi-bin written in C for lighthttpd web server.
- qwezxcrty 3y agoMost test equipments, ancient or recent, are not expecting their programming interfaces, let it be an analog voltage, GPIB, RS232, USB or LAN, exposed to the public internet and it would be a extremely stupid thing to do so. The maker of them assume that if one is able to operate them, one should know where they should plug the cables in. These equipments are simply assuming that anyone can access the interface is not hostile. This is a pretty good assumption in most lab settings that I know, unless the operator is so ignorant. This assumption certainly have made my life much easier in the lab, of course, where every LXI test equipments are connected to a isolated LAN. I would say a lot more f*k in the lab if I have to authenticate myself before sending a SCPI command. I'm happy that most test equipment makers do agree with me. For example, modern Rohde&Schwartz gears running Windows or Linux (FSV, FSW, FSVA, FSUP, SMA, SMC, ZNL, etc.) have VNC or Windows RDP enabled by default, and have a weak default password shared among the series. Keysight ones too (E5071C, DSOX3000T, maybe not on by default but with a supported way). A hostile user can even screw up a LAN connected, damn simple VxWorks based multimeter like Agilent 34410A badly by sending the calibration commands at the wrong time or some backdoor commands (DIAG:xxxx, haven't tried but looks possible). Slightly off topic, some Chinese test equipment makers are making hackability as a feature, look at Siglent or Rigol scopes. They can (and they are competent enough to) lock down the system with secure boot like some Tektronix ones. However they don't, so that people with less budget can buy a cheaper model and hack for the bandwidth.
- TheRealPomax 3y agoThen maybe RIGOL should not make assumptions and not release a device with near-trivially insecure firmware.
- jfim 3y agoPeople don't buy Rigol because they want a secure device, they just want a low cost oscilloscope.
- TheRealPomax 3y agoPeople don't buy a fridge because they want a secure device either, that doesn't mean the manufacturer doesn't have a legal duty of care when releasing software with security vulnerabilities.
- nimish 3y agoLots of these tools have truly awful software engineering. Even companies that are top, premium brands have some really questionable decisions like embedding backdoor passwords in the firmware. Never connect these things to the internet or any untrusted network. Last thing you need is a 10k instrument bricking itself.
- oliv3r 3y agoAs most have already written here, this is no suprise. These devices are made to do one job. The whole IoT thing is just cause it something that was hyped. They did try to lock down the scope _a little_. E.g. they removed the incoming RX resistor so you couldn't use the console. They disabled SSH etc. But the scope is very hackable, both in terms of the mentioned unlock ability, but also in terms of accessling Linux. The fact that this is about a RCE, is 'troublesome' but also 'meh'. I'm mostly disappointment that the author didn't do any research. While I get the cool-factor of trying to hack the firmware from scratch, a simple search would have found the author the EEVblog [0] for starters. But i admit, it is 104 pages atm. And the biggest dissapointment, an obviously shameless plug, is that this 'reversing' of the firmware, was done more then 5 years ago [1] where I wrote scripts to extract the whole firmware automatically. There's even rumor that the entire source code has leaked onto the internet already. I would expect some research would have made this 'discovery' less of an 'omg there's an RCE!' [0]: https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/ https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso... [1]: https://gitlab.com/riglol/rigolee/firmware/ https://gitlab.com/riglol/rigolee/firmware/
- kriive 3y agoHey! Congrats on the reverse engineering work and all the time you put in your research. As you and many other people have already said, RIGOL scopes are not exactly a security fortress, so this exploit I've found isn't impressive at all. After finding the vuln, I checked online if someone else had already found the vuln, and I admit I have come across the EEVblog, but I didn't find the exact vuln I found (I also must admit I didn't read all the posts there). I am sorry if I have in some way disrespected your work, but it wasn't my intention at all!