Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Oleg Kupreev - Telecommunication Hardware Vulne...

Avatar for DC7499 DC7499
July 03, 2015
Research
66
0

Oleg Kupreev - Telecommunication Hardware Vulnerabilities

DEFCON Moscow 9

Avatar for DC7499

DC7499

July 03, 2015

More Decks by DC7499

See All by DC7499
Sergey Sobko - Hackashop: Hackathon + Pentest + Workshop [RU]
Avatar for DC7499 defcon
0
600
Dmitry Sklyarov - Intel ME: Security keys Genealogy, Obfuscation and other Magic
Avatar for DC7499 defcon
0
330
Anton Lopanitsyn - Initial reconnaissance of web applications.
Avatar for DC7499 defcon
0
320
Dmitry Volkov - Private messengers: without pain??
Avatar for DC7499 defcon
1
260
Andrey Skuratov and Sergey Migalin - DNS tunneling in 2018. What is that, and what to do with it?
Avatar for DC7499 defcon
2
260
Sergey Belov - Another side of Bug Bounty programs
Avatar for DC7499 defcon
0
340
Dmitry Sklyarov - Intel ME: Flash file system explained
Avatar for DC7499 defcon
0
600
Maxim Goryachiy & Mark Ermolov - Inside Intel Management Engine
Avatar for DC7499 defcon
0
710
Sergey Golovanov - Indecent Response 2018
Avatar for DC7499 defcon
0
590

Other Decks in Research

See All in Research
COMETAを用いたデータ民主化運動の歴史
Avatar for Kazuya Mori sazimai
0
250
RS-Agent: Automating Remote Sensing Tasks through Intelligent Agent
Avatar for SatAI.challenge satai
3
560
ハードウェア研究で国際トップ会議を目指す！IROS 2027での論文採択を目指して
Avatar for 金田礼人 ayatokanada
7
3.8k
EIRによる不正端末のブロッキング 5G時代におけるデバイス識別と不正対策の進化
Avatar for Stellar Craft, Inc. stellarcraft
0
130
データサイエンティストの就労意識～2015 → 2026 一般(個人)会員アンケートより
Avatar for The Japan DataScientist Society datascientistsociety
PRO
0
840
CVPR2026論文紹介_VLMにとって​良いvision encoderとは何か？​Rethinking Model Selection in VLM Through the Lens of Gromov-Wasserstein Distance​
Avatar for 小林優斗 kobayashi31
1
220
2026年 オープンキャンパス 研究室紹介
Avatar for Jun Kurihara junkurihara
0
210
Physical AIでモデリングはどう変わるか/How Physical AI Will Change Modeling
Avatar for Shota Kato stktu
0
250
JICA QUEST 共創×革新プログラム Impact Report（海ノ向こうコーヒー）
Avatar for 坂ノ途中 ontheslope
0
620
論文読み会 SNLP2026 Tau2-Bench: Evaluating Conversational Agents in a Dual-Control Environment
Avatar for S s_mizuki_nlp
0
250
Harness Engineering and Al Agent
Avatar for Kazuki Inamura kzinmr
3
2k
【Zozo Research 技術共有会】三次元領域の現在と展望
Avatar for 小島瑞貴 mickey_0226
3
610

Featured

See All Featured
Making Projects Easy
Avatar for Brett Harned brettharned
120
6.8k
Neural Spatial Audio Processing for Sound Field Analysis and Control
Avatar for NII S. Koyama's Lab skoyamalab
0
510
Technical Leadership for Architectural Decision Making
Avatar for Kenny Baas-Schwegler baasie
3
570
The Impact of AI in SEO - AI Overviews June 2024 Edition
Avatar for Aleyda Solis aleyda
6
1.2k
Max Prin - Stacking Signals: How International SEO Comes Together (And Falls Apart)
Avatar for Tech SEO Connect techseoconnect
PRO
0
470
Joys of Absence: A Defence of Solitary Play
Avatar for Sebastian Deterding codingconduct
1
520
The Director’s Chair: Orchestrating AI for Truly Effective Learning
Avatar for Mike Taylor tmiket
1
300
A Guide to Academic Writing Using Generative AI - A Workshop
Avatar for Kenji Saito ks91
PRO
1
470
Conquering PDFs: document understanding beyond plain text
Avatar for Ines Montani inesmontani
PRO
4
3.1k
Color Theory Basics | Prateek | Gurzu
Avatar for Gurzu gurzu
1
470
Improving Core Web Vitals using Speculation Rules API
Avatar for Sergey Chernyshev sergeychernyshev
21
1.6k
New Earth Scene 8
Avatar for Sydney Stone popppiees
4
2.6k

Transcript

  1. None

  2. Telecommunication Hardware Vulnerabilities

  3. WHOAMI • HACKER REASEARCHER @ DSEC.RU • @090h, [email protected] •

    ADMIN @ ISP IN THE PAST • HACKING TELECOMMUNICATIONS SINCE 2001 • HACKING HARDWARE SINCE 2012 • DREAM TO LEARN, LEARN TO DREAM

  4. TELECOM HARDWARE • MODEM • ROUTER • SWiTCH • ATS

    • HYBRiD

  5. VULNERABiLiTiES • DEFAULT CREDENTiALS (admin:admin, admin:1234, cisco:cisco) • PLAiNTEXT PASSWORDS

    (/var/passwd) • BACKDOORS/ISP ACCOUNTS • AUTH BYPASS • USER iNPUT MiSVALiDATiON (COMMAND/SQL/HTML/XML injection) • iNFORMATiON DiSCLOSURE • CSRF • XXE • BOF (stack, heap, of-by-one) • WPS*

  6. VENDORS & VULNS @ EXPLOiT DB • Cisco 144 •

    D-link 81 • Linksys 49 • Netgear 36 • TP-Link 18 • Zyxel 15 • Huawei 13

  7. MODEMZ

  8. 3G/4G modems. Made in China by Huawei.

  9. Zero CD

  10. Zero CD-RW

  11. EViL C0NF

  12. OUC.EXE = OUCH LPE

  13. 3G/4G MODEM -> CYBERWEAPON

  14. CR0SSPLATF0RM 3G/4G M0D3M R00TKiT

  15. ROUTERZ

  16. SDLC BUBEN DANCiNG

  17. None

  18. BACKUP=FCUKUP

  19. GET HTTP REQUEST

  20. 20 AUTH BYPASS + CSRF = CONFiG UPLOAD 8) •

    Firewall/AV bypass • Botnet via Habrahabr <IMG SRC =“PWN”…

  21. 21 habrahabr.ru CSRF Evil FTP server Config CSRF

  22. • Network configuration • PPPOE account • SIP account CONFiGURATiON

  23. OLD DAYS…

  24. 24 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 XXI century

  25. AUTH BYPASS + CSRF + COMMAND INJECTION = w00t w00t

    rem0t3 reb00t… Back to 90’s….. Do you remember +++ATH.jpg trick? WARNINNG!!! WARNINNG!!! WARNINNG!!!

  26. Huawei HG8245 Jtagulator Huawei 8245 hacking

  27. PLACE 4 FUTURE ViRUSES

  28. PASSWORDS….

  29. How to rob the train in XXI century? Easy!

  30. WARNINNG!!! WARNINNG!!! WARNINNG!!! • WITH GREAT POWER COMES GREAT RESPONSIBILITY

    • ВАС ПРИСТРЕЛЯТ ПО УТРУ – НЕ РАБОТАЙТЕ ПО РУ • 272, 273, 274

  31. STAGE 0x00 • Search for train with WiFi • Buy

    train ticket • Don’t miss the train

  32. STAGE 0x01 admin

  33. STAGE 0x02

  34. STAGE 0x03

  35. STAGE 0x04

  36. SIP hacking? • Port 5060 + SHODAN • Auth needed?

    • Web interface?

  37. CALL TO UID 0

  38. but check! Trust,

  39. Any questions? INFO: @090h [email protected] Links https://github.com/0x90/routerz https://github.com/0x90/modemz