Slashdot Mirror
Time Warner Cable Modems Expose Users
eldavojohn writes "Wired is reporting on a simple hack putting some 65,000 customers at risk. The hack to gain administrative access to the cable modem/router combo is remarkably simple: '[David] Chen, founder of a software startup called Pip.io, said he was trying to help a friend change the settings on his cable modem and discovered that Time Warner had hidden administrative functions from its customers with Javascript code. By simply disabling Javascript in his browser, he was able to see those functions, which included a tool to dump the router's configuration file. That file, it turned out, included the administrative login and password in cleartext. Chen investigated and found the same login and password could access the admin panels for every router in the SMC8014 series on Time Warner's network — a grave vulnerability, given that the routers also expose their web interfaces to the public-facing internet.' If you use Time Warner's SMC8014 series cable modem/Wi-Fi router combo, watch for firmware to be released soon that they are reportedly in the process of testing."
I wonder if this is the same 'hack' used to attack Belgacom.
http://tweakers.net/nieuws/63200/belgacom-hacker-publiceerde-authentieke-inloggegevens-van-klanten.html
For the curious, a quick recap in English...
A hacker going by the name 'Vendetta', supposedly an American living in Belgium, got fed up with the monthly data cap (at Belgacom, figured out that there's a way to find the username/password for a modem by browsing to it (much as in this article), did that to a claimed several thousand (285,000) modems, and is threatening to release them slowly over time until November 30th as long as Belgacom keeps its monthly data cap.
So far this hacker released 30 usernames/passwords, and they were found to be genuine.
Belgacom contacted authorities, is investigating the claimed method of hacking, blabla.
The modem in question with Belgacom is labeled a "B-Box2-modem".
According to TFA (my karma be damned), Web-based admin UI is enabled on these routers, not only for the LAN but for the whole fucking Internet. This must be the dumbest default setting ever.
Although I agree that it is dumb, I think that it is to make technical support easier for the company. If the company can go straight to your router and configure it then it makes their life easier. Of course, it turns out that it makes a lot of people's lives easier including hackers.
My initial, gut response to this was sheer horror. They list exploit and target side-by-side! The only mention of a fix is that it's to be 'released soon', informing any malicious agents out there that now is the time to strike.
Reading the Wired article, the right thing was done. Big company was sitting on their hands, and now that publicity has been made, they're starting to move.
Wired did the right thing. But this summary, it's fear-mongering and bad journalism.
So you are saying I should go back to dial-up...? Because that is my only alternative. Thanks for doing my cost/benefit analysis of this situation for me! It is definitely better to have worthless internet than to just maintain my own router!
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Initially I was a little confused about the cable modem not being in bridge mode and having an admin interface at all. After RTFA, this vulnerability is only for SMC router/modem combo devices from TW. There was no mention of the Motorola cable modem I have from TW. The Motorola cable modems are acting as a bridge already because my router gets the lease to the public IP.
So apparently no worries regarding this vulnerability for me, but this certainly sucks for 65K other people.