full-disclosure - Re: My ISP is routing traffic to private addresses...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 17 May 2013 16:04:41 -0400
From: sec <sec@...tsploit.me>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: My ISP is routing traffic to private
	addresses...

[At least] TWC has a vast mishmash of vendors and models and device
types, depending on what they were bidding for and when, and how much
outdated CPE they've been able to or even attempted to reclaim /
replace. I would hesitate to endorse a blanket statement that they
don't do this any more.

This is extremely common practice (malpractice?): add Cox to the list
of current RFC1918 leakers.

On 2013-05-17 15:20:12 (-0400), Joshua Zukerman wrote:

Time Warner Cable (roadrunner) used to have this problem. They used the
10.x.x.x in various subnet masks for backend management IP addresses on
all of their customer cable modems, plus whatever other network
equipment they had. 2600 mag had an article a few years ago discussing
this very issue. I assume RCN is also a cable internet provider, so my
guess is your issue is one in the same. I can safely report that TWC is
now filtering out those from the ethernet side of the cable modem (has
been for about a year or so), so I cannot see any other 10.x.x.x
networks outside of my own. Probably done via the cable modem config &
ACLs.

On Fri, May 17, 2013 at 3:08 PM, kyle kemmerer
<[1]krkemmerer@...il.com> wrote:

So today when trying to access a device on my network (172.30.x.x
range) I was taken to the web interface of a completely different
device.  This baffled me at first, but after a bit of poking around, I
determined that my ISP was actually routing traffic to these addresses.
 See the trace below

Tracing route to 172.30.4.18 over a maximum of 30 hops

  1    11 ms    18 ms    19 ms  XXXXXXXXX
  2    30 ms   178 ms   212 ms  [2]vl4.aggr1.phdl.pa.rcn.net
[208.59.252.1]
  3    13 ms    18 ms    13 ms  [3]tge0-1-0-0.core1.phdl.pa.rcn.net
[207.172.15.50]

  4    37 ms    39 ms    57 ms  [4]tge0-0-0-2.core1.lnh.md.rcn.net
[207.172.19.227]

  5    35 ms    34 ms    32 ms  [5]tge0-1-0-1.core1.chgo.il.rcn.net
[207.172.19.235
]
  6    42 ms    38 ms    39 ms  [6]port-chan13.aggr2.chgo.il.rcn.net
[207.172.15.20
1]
  7    37 ms    39 ms    39 ms
[7]port-chan1.mart-ubr1.chi-mart.il.cable.rcn.net [
207.229.191.132]
  8    57 ms    61 ms    53 ms  172.30.4.18

Trace complete.

So I break out nmap and do a quick scan, and find that there are
thousands of these devices across this IP range.  Has anybody ever seen
anything like this?  Surely this must be a mistake, right? If anybody
else is using RCN as an ISP, can you access these addresses as well?

References

1. mailto:krkemmerer@...il.com
2. http://vl4.aggr1.phdl.pa.rcn.net/
3. http://tge0-1-0-0.core1.phdl.pa.rcn.net/
4. http://tge0-0-0-2.core1.lnh.md.rcn.net/
5. http://tge0-1-0-1.core1.chgo.il.rcn.net/
6. http://port-chan13.aggr2.chgo.il.rcn.net/
7. http://port-chan1.mart-ubr1.chi-mart.il.cable.rcn.net/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/