full-disclosure - TiVo Network Security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: merlyn at stonehenge.com (Randal L. Schwartz)
Subject: TiVo Network Security

>>>>> "Crist" == Crist J Clark <cristjc@...cast.net> writes:

Crist> I have not found much information about the network security of
Crist> factory installations of TiVo (this one is not "customized" in any
Crist> way, yet). What sort of risks am I running if this thing is on the
Crist> WLAN? Are there any listening services someone could break into? (I'd
Crist> just nmap it, but I'd like to know some of these answers before I
Crist> bother getting a USB WiFi unit.) What protocols are used for upload
Crist> and download? If they are not well known (FTP, HTTP, HTTPS, etc.) or
Crist> are proprietary, anyone know how easy passive eavesdropping or active
Crist> insertion or modification attacks may be?

The connections are outbound for fetching program guide and remote
programming requests (it polls every 15 minutes for remote
programming), using HTTP to a non-standard port.  The program guide is
an encrypted payload, but otherwise HTTPS is not used.

Home Media Option uses peer to peer HTTP, again with an encrypted
payload on a non-standard port.

The box doesn't have any ports open except when HMO is enabled.

If you're using this only for program guide fetching or remote
programming (no peer-to-peer HMO), you can probably get away with
simply punching a hole to talk to the tivo central on a specific port
from your box.  You can enable WEP to prevent casual sniffing: the
TiVo understands WEP with a single fixed 40 or 128 bit key.

Let me know if you have a more specific question.  I've been using
mine in wireless mode for longer that most people around. :)

-- 
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn@...nehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!