full-disclosure - Re: Polycom hacking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 26 Jun 2007 13:06:26 -0500
From: Paul Schmehl <pauls@...allas.edu>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Polycom hacking

--On Tuesday, June 26, 2007 17:51:58 +0000 b.hines@...cast.net wrote:

>
> Nice, that and an unchanged default password...
>
What I've discovered is that some devices run telnet, and it requires no 
login at all.  Haven't tried doing anything with it yet, but a DoS was 
possible in earlier versions of the software.  I suspect that's still the 
case.

It also runs ftp, with a login of "admin" or "administrator" and a null 
password.  So you can remove, alter and upload files at will.  I suspect 
that could be used for plenty of nefarious purposes.

Then there's the web interface; no login, admin access remotely to setup, 
placing a call, etc., etc., and if they use a password, just load 
http://target/a_security.htm and it will happily present you with the 
passwords in plain text.

I suspect the ftp interface would be the most fruitful, because you could 
upload new web pages with embedded scripts that load malware, redirect to a 
fake site, exploit weaknesses in the browser, etc., etc.

All in all, a pretty poorly designed (from a security perspective) device.

-- 
Paul Schmehl (pauls@...allas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

Content of type "application/pkcs7-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/