full-disclosure - yet another DSL modem backdoor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <420A5D4C.2070707@thebunker.net>
From: adam.laurie at thebunker.net (Adam Laurie)
Subject: yet another DSL modem backdoor - Mentor (Conexant)

Amazingly, despite numerous reports of backdoors in these Conexant DSL 
routers, they are *still* being shipped with the port 254 backdoor menu 
enabled...

I've just switched ADSL provider, and the new modem they sent me was a 
"Mentor MR4C/UK". It appears to be another conexant clone, and if you 
telnet to port 254 you get the familiar:

01/01/99                   CONEXANT SYSTEMS, INC. 
00:00:38
              ATU-R ACCESS RUNNER ADSL TERMINAL (Annex A) 3.27

and options to set password, reset router to default values, etc. etc. 
As before, you cannot change the login password on this interface, which 
is, in this case, "conexant".

Although this fault and the fix have been posted before, I report this 
as a reminder, and a nag to those feeble manufacturers that haven't got 
their act together...

To work around, set up virtual servers that send the port to a black hole.

If your ISP has shipped you one of these, *TELL* them! Maybe they have 
enough purchasing power to get it sorted...

cheers,
Adam
-- 
Adam Laurie                         Tel: +44 (20) 7605 7000
The Bunker Secure Hosting Ltd.      Fax: +44 (20) 7605 7099
Shepherds Building                  http://www.thebunker.net
Rockley Road
London W14 0DA                      mailto:adam@...bunker.net
UNITED KINGDOM                      PGP key on keyservers