full-disclosure - Re: EE BrightBox router hacked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 16 Jan 2014 13:26:24 -0500
From: Jeffrey Walton <noloader@...il.com>
To: Scott Helme <scotthelme@...mail.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: EE BrightBox router hacked - bares all if you
 ask nicely

On Wed, Jan 15, 2014 at 3:28 PM, Scott Helme <scotthelme@...mail.com> wrote:
> The BrightBox router is the standard equipment issued by UK ISP Everything
> Everywhere (EE) to its subscribers.
>
> The device not only leaks sensitive data but is remotely exploitable too. An
> attacker even has the ability to take control of your account as the router
> leaks your ISP account credentials.
>
> You can read the full article here:
> https://scotthelme.co.uk/ee-brightbox-router-hacked/
To add insult to injury, they are probably using a hard code public
key pair, and its probably in the littleblackbox
(http://code.google.com/p/littleblackbox/).

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/