Oleg Kupreev - Telecommunication Hardware Vulnerabilities

DEFCON Moscow 9

Transcript

2. Telecommunication Hardware Vulnerabilities
3. WHOAMI • HACKER REASEARCHER @ DSEC.RU • @090h, root@0x90.ru • ADMIN @ ISP IN THE PAST • HACKING TELECOMMUNICATIONS SINCE 2001 • HACKING HARDWARE SINCE 2012 • DREAM TO LEARN, LEARN TO DREAM
4. TELECOM HARDWARE • MODEM • ROUTER • SWiTCH • ATS • HYBRiD
5. VULNERABiLiTiES • DEFAULT CREDENTiALS (admin:admin, admin:1234, cisco:cisco) • PLAiNTEXT PASSWORDS (/var/passwd) • BACKDOORS/ISP ACCOUNTS • AUTH BYPASS • USER iNPUT MiSVALiDATiON (COMMAND/SQL/HTML/XML injection) • iNFORMATiON DiSCLOSURE • CSRF • XXE • BOF (stack, heap, of-by-one) • WPS*
6. VENDORS & VULNS @ EXPLOiT DB • Cisco 144 • D-link 81 • Linksys 49 • Netgear 36 • TP-Link 18 • Zyxel 15 • Huawei 13
7. MODEMZ
8. 3G/4G modems. Made in China by Huawei.
9. Zero CD
10. Zero CD-RW
11. EViL C0NF
12. OUC.EXE = OUCH LPE
13. 3G/4G MODEM -> CYBERWEAPON
14. CR0SSPLATF0RM 3G/4G M0D3M R00TKiT
15. ROUTERZ
16. SDLC BUBEN DANCiNG
18. BACKUP=FCUKUP
19. GET HTTP REQUEST
20. 20 AUTH BYPASS + CSRF = CONFiG UPLOAD 8) • Firewall/AV bypass • Botnet via Habrahabr <IMG SRC =“PWN”…
21. 21 habrahabr.ru CSRF Evil FTP server Config CSRF
22. • Network configuration • PPPOE account • SIP account CONFiGURATiON
23. OLD DAYS…
24. 24 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 2-12-85-06 XXI century
25. AUTH BYPASS + CSRF + COMMAND INJECTION = w00t w00t rem0t3 reb00t… Back to 90’s….. Do you remember +++ATH.jpg trick? WARNINNG!!! WARNINNG!!! WARNINNG!!!
26. Huawei HG8245 Jtagulator Huawei 8245 hacking
27. PLACE 4 FUTURE ViRUSES
28. PASSWORDS….
29. How to rob the train in XXI century? Easy!
30. WARNINNG!!! WARNINNG!!! WARNINNG!!! • WITH GREAT POWER COMES GREAT RESPONSIBILITY • ВАС ПРИСТРЕЛЯТ ПО УТРУ – НЕ РАБОТАЙТЕ ПО РУ • 272, 273, 274
31. STAGE 0x00 • Search for train with WiFi • Buy train ticket • Don’t miss the train
32. STAGE 0x01 admin
33. STAGE 0x02
34. STAGE 0x03
35. STAGE 0x04
36. SIP hacking? • Port 5060 + SHODAN • Auth needed? • Web interface?
37. CALL TO UID 0
38. but check! Trust,
39. Any questions? INFO: @090h root@0x90.ru Links https://github.com/0x90/routerz https://github.com/0x90/modemz