4 ms·

A Tale of CenturyLink Backdoors, PCI Compliance, and Pain

29 points by dlgeek 13y ago

lunixbochs 13y ago
From initial inspection of the GPL firmware download, it looks like port 4567 is controlled by the /bin/tr69c daemon. I also found references from tr69c to a "data_center" program. Neither the data_center or tr69c binaries were in my reference firmware source. Research suggests tr69c is hosting the TR-069 protocol: https://en.wikipedia.org/wiki/TR-069 https://en.wikipedia.org/wiki/TR-069 Also: OpenSSL 0.9.7f 22 March 2005
deckar01 13y ago
I'm not convinced it would have to be secret updates. As the service that scanned your ports learned new exploits, it reported them. Scanners sometimes use heuristics to guess.
- lunixbochs 13y ago
  As far as I know, it's common practice for DSL and Cable providers to provide over-the-air firmware and configuration updates to your modem. Whether or not they own it.
  - noir_lord 13y ago
    One of the reasons I always use a third-party modem not supplied by them (I like Drayteks for the money they are powerful). You have to trust that thing with the keys to the kingdom.
nullc 13y ago
This is even better than my supermicro 1u systems which turned out to be running a non-disableable-in-bios unpasworded remote management interface which provided console access exposed to the network that I only found by scanning the subnet. "Intel inside" indeed.
- anemic 13y ago
  In Fujitsu servers there is a remote console but that requires a licence to function. Of course a hacker can acquire (even pay?) for that license and get console access. This leads to leaving the management network unplugged and losing remote reboots and other management features.
jacquesm 13y ago
Interesting. Centurlink could have easily blocked acccess from outside their own internal network to that IP and port but instead chose to allow the whole internet to have the possibility to play 20 questions with the web admin interface. Maybe someone even got lucky. What about all the other customers of that ISP with that particular modem, are those still open?
Mister_Snuggles 13y ago
Another way to achieve PCI compliance is to simply outsource all activities having to do with credit cards to a PCI compliant vendor and let them deal with that pain. I've seen sites that let you pay this way and it works pretty well - as well as a payment workflow that involves sending your customer to a 3rd party site and hoping they make it back can work anyway. The whole thing with the modem is scary though.

29 points by dlgeek 13y ago

From initial inspection of the GPL firmware download, it looks like port 4567 is controlled by the /bin/tr69c daemon. I also found references from tr69c to a "data_center" program. Neither the data_center or tr69c binaries were in my reference firmware source. Research suggests tr69c is hosting the TR-069 protocol: https://en.wikipedia.org/wiki/TR-069 https://en.wikipedia.org/wiki/TR-069 Also: OpenSSL 0.9.7f 22 March 2005

deckar01 13y ago

I'm not convinced it would have to be secret updates. As the service that scanned your ports learned new exploits, it reported them. Scanners sometimes use heuristics to guess.

lunixbochs 13y ago
As far as I know, it's common practice for DSL and Cable providers to provide over-the-air firmware and configuration updates to your modem. Whether or not they own it.
- noir_lord 13y ago
  One of the reasons I always use a third-party modem not supplied by them (I like Drayteks for the money they are powerful). You have to trust that thing with the keys to the kingdom.

nullc 13y ago

This is even better than my supermicro 1u systems which turned out to be running a non-disableable-in-bios unpasworded remote management interface which provided console access exposed to the network that I only found by scanning the subnet. "Intel inside" indeed.

anemic 13y ago
In Fujitsu servers there is a remote console but that requires a licence to function. Of course a hacker can acquire (even pay?) for that license and get console access. This leads to leaving the management network unplugged and losing remote reboots and other management features.

jacquesm 13y ago

Interesting. Centurlink could have easily blocked acccess from outside their own internal network to that IP and port but instead chose to allow the whole internet to have the possibility to play 20 questions with the web admin interface. Maybe someone even got lucky. What about all the other customers of that ISP with that particular modem, are those still open?

Mister_Snuggles 13y ago

Another way to achieve PCI compliance is to simply outsource all activities having to do with credit cards to a PCI compliant vendor and let them deal with that pain. I've seen sites that let you pay this way and it works pretty well - as well as a payment workflow that involves sending your customer to a 3rd party site and hoping they make it back can work anyway. The whole thing with the modem is scary though.