Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Oleg Kupreev - Telecommunication Hardware Vulnerabilities

0c988f4618b436b14ce6ddcecd52d11d?s=47 DC7499
July 03, 2015
Research
0
33

Oleg Kupreev - Telecommunication Hardware Vulnerabilities

DEFCON Moscow 9

0c988f4618b436b14ce6ddcecd52d11d?s=128

DC7499

July 03, 2015
Tweet

More Decks by DC7499

See All by DC7499
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
200
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
140
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
220
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
1
190
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
1
160
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
180
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
260
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
310
0c988f4618b436b14ce6ddcecd52d11d?s=48 defcon
0
300

Other Decks in Research

See All in Research
C612ab39597a17ba5948cae54d13f99f?s=48 mkimura
2
240
0d4ef9af8e4f0cf5c162b48ba24faea6?s=48 ept
0
12k
Fdcc88b334334c866232fab429ccca33?s=48 lancers_pr
0
4.8k
Fccb5974b63d64636a7c90faf3bab51f?s=48 kikuzo
1
160
27e6303669f854882d672f3cd3fcb796?s=48 dasayan05
0
560
B1cc148711c6a37a5c922b6e72a4ad52?s=48 upura
1
790
Cf3645811bcc4a1996c8915b3de9f950?s=48 masakioka
0
320
191b51e394766638990831da6691d089?s=48 tkym1220
0
600
1cbdba8854baff36227bc71be1063504?s=48 mattenn
8
9.4k
Af063a6baa6f4b5543c76c2fad554a06?s=48 patanamon
0
110
C612ab39597a17ba5948cae54d13f99f?s=48 mkimura
3
3.2k
646cd36145dfc164ce5ee759bf582eee?s=48 forgetmenotjun
0
330

Featured

See All Featured
E190023b66e2b8aa73a842b106920c93?s=48 zenorocha
300
40k
B3ace07412a5178ea778e7eec161fc0a?s=48 jcasabona
10
710
78b475797a14c84799063c7cd073962f?s=48 holman
293
130k
9cde37f47e4a800ea081ea42de8d749a?s=48 dougneiner
122
8.2k
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
33
2.3k
E43f8dfd01057f8304f5f8fb9a294d7d?s=48 jeffersonlam
333
16k
0bce06bd06ee7a2c4f5500f25dcf7f18?s=48 paulrobertlloyd
72
3.8k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
779
240k
C51b39fa3c79ccb99dcb8a076bc98287?s=48 brianwarren
85
5k
053e75a5b48b44d6dd0612795dfb326d?s=48 notwaldorf
48
2.9k
719435d98d452de7ac367c828266cf01?s=48 erikaheidi
24
4.8k
C86443373fbfe92996aa882d0d7a59f8?s=48 imathis
482
150k

Transcript

  1. None

  2. Telecommunication Hardware Vulnerabilities

  3. WHOAMI • HACKER REASEARCHER @ DSEC.RU • @090h, root@0x90.ru •

    ADMIN @ ISP IN THE PAST • HACKING TELECOMMUNICATIONS SINCE 2001 • HACKING HARDWARE SINCE 2012 • DREAM TO LEARN, LEARN TO DREAM

  4. TELECOM HARDWARE • MODEM • ROUTER • SWiTCH • ATS

    • HYBRiD

  5. VULNERABiLiTiES • DEFAULT CREDENTiALS (admin:admin, admin:1234, cisco:cisco) • PLAiNTEXT PASSWORDS

    (/var/passwd) • BACKDOORS/ISP ACCOUNTS • AUTH BYPASS • USER iNPUT MiSVALiDATiON (COMMAND/SQL/HTML/XML injection) • iNFORMATiON DiSCLOSURE • CSRF • XXE • BOF (stack, heap, of-by-one) • WPS*

  6. VENDORS & VULNS @ EXPLOiT DB • Cisco 144 •

    D-link 81 • Linksys 49 • Netgear 36 • TP-Link 18 • Zyxel 15 • Huawei 13

  7. MODEMZ

  8. 3G/4G modems. Made in China by Huawei.

  9. Zero CD

  10. Zero CD-RW

  11. EViL C0NF

  12. OUC.EXE = OUCH LPE

  13. 3G/4G MODEM -> CYBERWEAPON

  14. CR0SSPLATF0RM 3G/4G M0D3M R00TKiT

  15. ROUTERZ

  16. SDLC BUBEN DANCiNG

  17. None

  18. BACKUP=FCUKUP

  19. GET HTTP REQUEST

  20. 20 AUTH BYPASS + CSRF = CONFiG UPLOAD 8) •

    Firewall/AV bypass • Botnet via Habrahabr <IMG SRC =“PWN”…

  21. 21 habrahabr.ru CSRF Evil FTP server Config CSRF

  22. • Network configuration • PPPOE account • SIP account CONFiGURATiON

  23. OLD DAYS…

  24. 24 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 XXI century

  25. AUTH BYPASS + CSRF + COMMAND INJECTION = w00t w00t

    rem0t3 reb00t… Back to 90’s….. Do you remember +++ATH.jpg trick? WARNINNG!!! WARNINNG!!! WARNINNG!!!

  26. Huawei HG8245 Jtagulator Huawei 8245 hacking

  27. PLACE 4 FUTURE ViRUSES

  28. PASSWORDS….

  29. How to rob the train in XXI century? Easy!

  30. WARNINNG!!! WARNINNG!!! WARNINNG!!! • WITH GREAT POWER COMES GREAT RESPONSIBILITY

    • ВАС ПРИСТРЕЛЯТ ПО УТРУ – НЕ РАБОТАЙТЕ ПО РУ • 272, 273, 274

  31. STAGE 0x00 • Search for train with WiFi • Buy

    train ticket • Don’t miss the train

  32. STAGE 0x01 admin

  33. STAGE 0x02

  34. STAGE 0x03

  35. STAGE 0x04

  36. SIP hacking? • Port 5060 + SHODAN • Auth needed?

    • Web interface?

  37. CALL TO UID 0

  38. but check! Trust,

  39. Any questions? INFO: @090h root@0x90.ru Links https://github.com/0x90/routerz https://github.com/0x90/modemz