Save 37% off PRO during our Black Friday Sale! »

Oleg Kupreev - Telecommunication Hardware Vulnerabilities

0c988f4618b436b14ce6ddcecd52d11d?s=47 DC7499
July 03, 2015
Research
0
33

Oleg Kupreev - Telecommunication Hardware Vulnerabilities

DEFCON Moscow 9

0c988f4618b436b14ce6ddcecd52d11d?s=128

DC7499

July 03, 2015
Tweet

More Decks by DC7499

See All by DC7499
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
240
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
170
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
220
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
1
190
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
1
160
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
190
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
280
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
340
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
310

Other Decks in Research

See All in Research
7a0892afffbcbd35fd84d46508b3a914?s=48 dropout009
0
640
92c88c6409efa2efefadcdeedfb94cd3?s=48 100_tools
0
150
8462b18bc6d57cac5579ef4b2f64a6de?s=48 kei18
0
270
1f05bb79049dfcf3931294e4e11465b3?s=48 joolsa
1
110
8a7e83d2e447783ab6d824f553429a09?s=48 stakaya
1
1.1k
9782dd351a8f1737d4ef02d839e821f9?s=48 kitachan_black
0
4k
Ab1dcccd9c62e24c8219dcd41eb149d5?s=48 meshidenn
0
110
389a807d8d82327766f546ef1b9c8cef?s=48 roger_s
0
290
Ac4c801a08615fa15b2644c9de15b911?s=48 allenyummy
0
150
38e2af7f8bdad4f2087ab3d42b627e33?s=48 shuntaros
1
610
191b51e394766638990831da6691d089?s=48 tkym1220
0
160
8ae1cf7bc77810bc3f3270a6b7c1837e?s=48 shutakahama
2
450

Featured

See All Featured
Ba530e786553390f3fb271848485681c?s=48 3n
169
23k
1177e050db6bafe62885362edf6e3537?s=48 lauravandoore
19
2.5k
9fa239b3154a0169d99ab7bf1422dd12?s=48 marcelosomers
225
15k
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
172
7.8k
170b760e0147792d0140e59ec78e9893?s=48 eitanlees
120
11k
9128d500301ae51524e887bb680f471d?s=48 caitiem20
314
18k
78b475797a14c84799063c7cd073962f?s=48 holman
464
280k
Ecdea9b9714877b86cee08458f085481?s=48 trallard
27
1.3k
864a009ac73600c7c02e1f26629dd989?s=48 paigeccino
7
430
32de0bd2ba869609d26fd052a4622778?s=48 cromwellryan
108
6.6k
78b475797a14c84799063c7cd073962f?s=48 holman
295
140k
0bce06bd06ee7a2c4f5500f25dcf7f18?s=48 paulrobertlloyd
73
3.9k

Transcript

  1. None

  2. Telecommunication Hardware Vulnerabilities

  3. WHOAMI • HACKER REASEARCHER @ DSEC.RU • @090h, root@0x90.ru •

    ADMIN @ ISP IN THE PAST • HACKING TELECOMMUNICATIONS SINCE 2001 • HACKING HARDWARE SINCE 2012 • DREAM TO LEARN, LEARN TO DREAM

  4. TELECOM HARDWARE • MODEM • ROUTER • SWiTCH • ATS

    • HYBRiD

  5. VULNERABiLiTiES • DEFAULT CREDENTiALS (admin:admin, admin:1234, cisco:cisco) • PLAiNTEXT PASSWORDS

    (/var/passwd) • BACKDOORS/ISP ACCOUNTS • AUTH BYPASS • USER iNPUT MiSVALiDATiON (COMMAND/SQL/HTML/XML injection) • iNFORMATiON DiSCLOSURE • CSRF • XXE • BOF (stack, heap, of-by-one) • WPS*

  6. VENDORS & VULNS @ EXPLOiT DB • Cisco 144 •

    D-link 81 • Linksys 49 • Netgear 36 • TP-Link 18 • Zyxel 15 • Huawei 13

  7. MODEMZ

  8. 3G/4G modems. Made in China by Huawei.

  9. Zero CD

  10. Zero CD-RW

  11. EViL C0NF

  12. OUC.EXE = OUCH LPE

  13. 3G/4G MODEM -> CYBERWEAPON

  14. CR0SSPLATF0RM 3G/4G M0D3M R00TKiT

  15. ROUTERZ

  16. SDLC BUBEN DANCiNG

  17. None

  18. BACKUP=FCUKUP

  19. GET HTTP REQUEST

  20. 20 AUTH BYPASS + CSRF = CONFiG UPLOAD 8) •

    Firewall/AV bypass • Botnet via Habrahabr <IMG SRC =“PWN”…

  21. 21 habrahabr.ru CSRF Evil FTP server Config CSRF

  22. • Network configuration • PPPOE account • SIP account CONFiGURATiON

  23. OLD DAYS…

  24. 24 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 XXI century

  25. AUTH BYPASS + CSRF + COMMAND INJECTION = w00t w00t

    rem0t3 reb00t… Back to 90’s….. Do you remember +++ATH.jpg trick? WARNINNG!!! WARNINNG!!! WARNINNG!!!

  26. Huawei HG8245 Jtagulator Huawei 8245 hacking

  27. PLACE 4 FUTURE ViRUSES

  28. PASSWORDS….

  29. How to rob the train in XXI century? Easy!

  30. WARNINNG!!! WARNINNG!!! WARNINNG!!! • WITH GREAT POWER COMES GREAT RESPONSIBILITY

    • ВАС ПРИСТРЕЛЯТ ПО УТРУ – НЕ РАБОТАЙТЕ ПО РУ • 272, 273, 274

  31. STAGE 0x00 • Search for train with WiFi • Buy

    train ticket • Don’t miss the train

  32. STAGE 0x01 admin

  33. STAGE 0x02

  34. STAGE 0x03

  35. STAGE 0x04

  36. SIP hacking? • Port 5060 + SHODAN • Auth needed?

    • Web interface?

  37. CALL TO UID 0

  38. but check! Trust,

  39. Any questions? INFO: @090h root@0x90.ru Links https://github.com/0x90/routerz https://github.com/0x90/modemz