full-disclosure - [FD] [SEARCH-LAB advisory] UPC Hungary network problems

Open Source and information security mailing list archives

Message-ID: <d190e23b-e887-733e-c327-7616de360a6d@search-lab.hu>
Date: Thu, 21 Jul 2016 13:08:33 +0200
From: Gergely Eberhardt <gergely.eberhardt@...rch-lab.hu>
To: fulldisclosure@...lists.org
Subject: [FD] [SEARCH-LAB advisory] UPC Hungary network problems

UPC network problems
--------------------

Platforms / Firmware confirmed affected:
- UPC Hungary network

Problems
--------
Network and device configuration problems
Administration password is sent to the device in plain in the
configuration file
Administration password, which is used also for the telnet service, is
sent in plain in the configuration file downloaded by the device via
TFTP from the location specified by the DHCP response. The TFTP server
is accessible only from the internal UPC’s network.

Administration password is the same for ALL devices
Every kind of device uses the same administration password, which
provides administrative and telnet access in most of the cases form the
internal UPC’s network. The actual access method and possibilities are
depends on the device type.

Telnet service is enabled on Ubee devices by default
Telnet service is enabled on Ubee devices at interfaces accessible from
LAN. Since, the password is the same and sent in plaintext, any user
from the LAN can connect to the router with root privileges. Users can
not disable telnet service and it is accessible even if the device is in
bridge mode.

Other CPE devices can be accessed in the internal UPC’s network
From within the router, the 10.x.x.x range is accessible and the router
can access other UPC costumers’ devices. Using the administration
password, which is the same in every device, the attacker can take over
control of masses of devices.

Timeline
--------
- 2015.06.24: Presenting the Ubee router problems to the CTO of UPC
Magyarorszag
- 2015.07.16: UPC contacted Ubee and required some more proof about some
specific problems
- 2015.07.16: Proofs, that the default passphrase calculation of the
Ubee router was broken, were sent to UPC
- 2015.07.20: UPC requested the POC code
- 2015.07.21: POC code was sent to UPC
- 2015.07.30: We sent some new issues affecting the Ubee router and
other findings in Technicolor TC7200 and Cisco EPC3925 devices to UPC
- Between 2015.07.31 and 08.12 there were several e-mail and phone
communications between technical persons from Liberty Global to clarify
the findings
- 2015.08.19: UPC sent out advisory emails to its end users to change
the default WiFi passphrase
- 2016.01.27: UPC Magyarorszag send out a repeated warning to its end
users about the importance of the change of the default passphrases.
- 2016.02.16: Face to face meeting with Liberty Global security
personnel in Amsterdam headquarters
- 2016.02.18: A proposal was sent to Liberty Global suggesting a
wardriving experiment in Budapest, Hungary to measure the rate of end
users who are still using the default passphrases.

Credits
-------
This vulnerability was discovered and researched by Gergely Eberhardt
from SEARCH-LAB Ltd. (www.search-lab.hu)

References
----------
[1] http://www.search-lab.hu/advisories/secadv-20160720

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives