Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Oleg Kupreev - Telecommunication Hardware Vulnerabilities

0c988f4618b436b14ce6ddcecd52d11d?s=47 DC7499
July 03, 2015
Research
0
32

Oleg Kupreev - Telecommunication Hardware Vulnerabilities

DEFCON Moscow 9

0c988f4618b436b14ce6ddcecd52d11d?s=128

DC7499

July 03, 2015
Tweet

More Decks by DC7499

See All by DC7499
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
170
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
140
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
210
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
1
180
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
1
150
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
170
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
250
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
300
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
300

Other Decks in Research

See All in Research
F9e322fde88ad09ee174ad35415028e2?s=48 jnishimu
1
620
0fb331719a2826e2e191b0845c03ac34?s=48 izunaga
3
2.6k
608638a6cfefbf0c2294a30e55634f6d?s=48 mihozono
2
700
D8b77b4b3b0373eaee6c6077c4d7330a?s=48 karakurist
18
1.9k
D0167b760673d702a06427fb3f878696?s=48 umepon
0
180
227b4a9c7123b3b5b5373e24e0eb6180?s=48 ikuyamada
6
450
C612ab39597a17ba5948cae54d13f99f?s=48 mkimura
5
2.8k
A658ec7f1badf73819dfa501165016c1?s=48 yuukit
4
1.7k
Af063a6baa6f4b5543c76c2fad554a06?s=48 patanamon
1
160
588cbb64aaebe393fcdb3e05c1e34d6c?s=48 yuawn
0
440
5ecdb396047959b02fbf88204af108ce?s=48 waptech
1
170
20ddbe9b7cfdde5e2dfeb8d8714d5de8?s=48 tarugoconf
0
1.9k

Featured

See All Featured
1177e050db6bafe62885362edf6e3537?s=48 lauravandoore
12
1.7k
32de0bd2ba869609d26fd052a4622778?s=48 cromwellryan
104
6.3k
1519587b1a0febb658c36c94f6272b0d?s=48 roundedbygravity
242
21k
Eb8975af8e49e19e3dd6b6b84a542e26?s=48 qrush
285
19k
B3d6434763caa0ef5dc4b792662c49f7?s=48 smashingmag
232
18k
5f83ef806155b403c3393160ce51f955?s=48 jlugia
217
16k
E4f5d494ebdc9e7cce1aecf3ce3e8bc1?s=48 shpigford
370
42k
A415db3ac9e9668acbc1fb36eead84ac?s=48 mthomps
38
2.4k
15f2b8221f247985a27a627d2ece72f0?s=48 pauljervisheath
195
15k
88bc30284c6a424b63a92aad27d0ba36?s=48 jnunemaker
PRO
40
4.7k
78b475797a14c84799063c7cd073962f?s=48 holman
448
140k
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
28
2.1k

Transcript

  1. None

  2. Telecommunication Hardware Vulnerabilities

  3. WHOAMI • HACKER REASEARCHER @ DSEC.RU • @090h, root@0x90.ru •

    ADMIN @ ISP IN THE PAST • HACKING TELECOMMUNICATIONS SINCE 2001 • HACKING HARDWARE SINCE 2012 • DREAM TO LEARN, LEARN TO DREAM

  4. TELECOM HARDWARE • MODEM • ROUTER • SWiTCH • ATS

    • HYBRiD

  5. VULNERABiLiTiES • DEFAULT CREDENTiALS (admin:admin, admin:1234, cisco:cisco) • PLAiNTEXT PASSWORDS

    (/var/passwd) • BACKDOORS/ISP ACCOUNTS • AUTH BYPASS • USER iNPUT MiSVALiDATiON (COMMAND/SQL/HTML/XML injection) • iNFORMATiON DiSCLOSURE • CSRF • XXE • BOF (stack, heap, of-by-one) • WPS*

  6. VENDORS & VULNS @ EXPLOiT DB • Cisco 144 •

    D-link 81 • Linksys 49 • Netgear 36 • TP-Link 18 • Zyxel 15 • Huawei 13

  7. MODEMZ

  8. 3G/4G modems. Made in China by Huawei.

  9. Zero CD

  10. Zero CD-RW

  11. EViL C0NF

  12. OUC.EXE = OUCH LPE

  13. 3G/4G MODEM -> CYBERWEAPON

  14. CR0SSPLATF0RM 3G/4G M0D3M R00TKiT

  15. ROUTERZ

  16. SDLC BUBEN DANCiNG

  17. None

  18. BACKUP=FCUKUP

  19. GET HTTP REQUEST

  20. 20 AUTH BYPASS + CSRF = CONFiG UPLOAD 8) •

    Firewall/AV bypass • Botnet via Habrahabr <IMG SRC =“PWN”…

  21. 21 habrahabr.ru CSRF Evil FTP server Config CSRF

  22. • Network configuration • PPPOE account • SIP account CONFiGURATiON

  23. OLD DAYS…

  24. 24 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 XXI century

  25. AUTH BYPASS + CSRF + COMMAND INJECTION = w00t w00t

    rem0t3 reb00t… Back to 90’s….. Do you remember +++ATH.jpg trick? WARNINNG!!! WARNINNG!!! WARNINNG!!!

  26. Huawei HG8245 Jtagulator Huawei 8245 hacking

  27. PLACE 4 FUTURE ViRUSES

  28. PASSWORDS….

  29. How to rob the train in XXI century? Easy!

  30. WARNINNG!!! WARNINNG!!! WARNINNG!!! • WITH GREAT POWER COMES GREAT RESPONSIBILITY

    • ВАС ПРИСТРЕЛЯТ ПО УТРУ – НЕ РАБОТАЙТЕ ПО РУ • 272, 273, 274

  31. STAGE 0x00 • Search for train with WiFi • Buy

    train ticket • Don’t miss the train

  32. STAGE 0x01 admin

  33. STAGE 0x02

  34. STAGE 0x03

  35. STAGE 0x04

  36. SIP hacking? • Port 5060 + SHODAN • Auth needed?

    • Web interface?

  37. CALL TO UID 0

  38. but check! Trust,

  39. Any questions? INFO: @090h root@0x90.ru Links https://github.com/0x90/routerz https://github.com/0x90/modemz