Slashdot Mirror
600,000 Arris Cable Modems Have 'Backdoors In Backdoors,' Researcher Claims (thestack.com)
An anonymous reader writes: A security researcher using Shodan to probe Arris cable modems for vulnerabilities has found that 600,000 of the company's modems not only have a backdoor, but that the backdoor itself has an extra backdoor. Brazilian vulnerability tester Bernardo Rodrigues posted that he found undocumented libraries in three models, initially leading to a backdoor that uses an admin password disclosed back in 2009. Brazilian researcher Bernardo Rodrigues notes that the secondary backdoor has a password derived in part from the final five digits from the modem's serial number. However, the default 'root' password for the affected models remains 'arris.'
I used to have that terrible modem with my previous ISP... Glad I'm not with them anymore.
You can bet NSA has been exploiting this one for years.
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
...it's crap!
Time to get a customer-owned modem!
Really? Citadel Station ought to have learned by now...
It almost certainly wasn't done maliciously by Arris. The people that built the thing and programmed it were probably just incompetent, or they cut corners somewhere so they could make more of a profit. That's usually how it works.
They even do that sort of thing with nuclear reactors, because apparently meltdowns are cheaper and more cost-effective than performing preventative maintenance. Capitalism.
"I heard you like backdoors, so I put a backdoor in your backdoor" ... yeah, I can see why someone hasn't posted this yet.
Yet another ridicolous AC claiming to be "me"... Grow up and do something useful & you won't ever make something as good as my HOST file engine.
P.S:=> I suck dicks ... APK
P.P.S: I am the real one.
Interesting news for all some nations networks. :)
Will a VPN ready router with OpenVPN help after the telco hardware?
Spend another few $ per month to try and secure your computer from the 'provided' hardware.
This is why everyone needs good crypto. Even the hardware has extra ways in
Domestic spying is now "Benign Information Gathering"
so I am immagrant to here
comcast empathy class is low bandwidth but I can have for nothing until better jobs
how to return arris modem to comcast or force firmware update fix
will enabing bridge mode help if I put old cisco behind it
thank you
I bought an Arris DOCSIS 2.0 modem two years ago as the purchase cost was only 4X the monthly ISP rental fee for a DOCSIS 1.X modem. The linked exploit does not work on my modem (although I'm sure it still has some vulnerabilities). The bottom line is that I have more than gotten my moneys worth and know now to periodically scan my modem with nmap to look for open telnet and ssh ports. I predict that the population of modems that can be owned with the current exploit will remain sufficiently large that I won't have any problems prior to the next best thing coming along.
I used to work for Arris. But we did the DVR software, which was originally a different company than the people doing the cable modems. The DVR software is a lot more secure than this. There still a PWOD protected technician interface, the DVRs are remotely managed device, but it doesn't let you do anything that would compromise the software. I'd be interested in seeing how someone would hack it. It shouldn't be possible to get a root shell.
Someone did want to allow the player to pair over wifi automatically to the gateway by having the WPA2-PSK be derived from the device ID. I tried to stress what a terrible idea that was but those were people in a different division who didn't need to listen to me.
Don't trust any router software unless you can put openwrt on it. The router companies have shown they can not be trusted. All companies are subject to enormous pressure from NSA. Control the software that runs on your router yourself.
This is simply hilarious.
The backdoors are so widespread that there is not much space left for useful software.
Fuck Backdoors.
aaaaaaa
My game bypasses your HOST engine. Ads display just fine.
You're fucked. So's your HOSTs engine. Trivial to bypass.
Captcha: slicker - yes, I am.
This is why I use Cisco enterprise equipment at home.
Hint: 'Arris in England has the same meaning as Azz in USA.
Sent from my ASR33 using ASCII
Anyone familiar with cockney rhyming slang shoudn't be too surprised when Arris products contain an unexpectedly slack backdoor...
I had a dream, bright and carefree, but now there's doubt and gravity
It should be noted that this expoit is for the managed gateways (TG862A, TG862G, DG860A, etc).
I doubt this exploit can be used with off the shelf docis modems.
More details are at the w00tsec article.
https://w00tsec.blogspot.com.au/2015/11/arris-cable-modem-has-backdoor-in.html?m=1
Arris Cable Modems Have 'Backdoors In Backdoors,' Researcher Claims
This is exactly like saying Donald Trump has an asshole.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Valeu, Bernardão!
https://w00tsec.blogspot.com.a...
The article in the summary doesnt list which modems are affected as i have an Arris Modem myself, but looks to be the TG862A, TG862G, and DG860A.
Also notable that a quick glance of reviews on Amazon says there is no end user support for these, they are always ISP controlled.
If you do not understand shit about it, stop using computers
had to buy one of these, one of the only models I could replace my Xfinity rented box with (providing telephone as well as internet). As I understand, it was originally produced for Comcast / Xfinity, or at least Comcast still has a lot of confused technicians who think this Arris was made only for Comcast and can't be purchased... I had to go through 3 techs to get them to hook it up. I wonder if the backdoor of the router was designed in for Comcast, which I can imagine has thought of justifications (e.g. providing tech support to subscribers).
On the plus side, it eliminated the XFinity login by wifi (see Slashdot a few links up)
http://mydeviceinfo.comcast.net/
Gently reply
I purchased a Motorola modem three years ago. Arris acquired Motorola's modem business, but I do not know when. How can I tell if my modem is affected?
See subject: How damn lame could you puny trolls be? You cannot successfully imitate my inimitable style! You wish you were me - this merely proves it!
APK
P.S.=> You know it's true - trying to be me merely reinforces it in your impersonating me... apk
See subject: How damn lame could you puny trolls be? You can't successfully imitate my inimitable style!
* You wish you were me!
APK
P.S.=> You know it's true - trying to be me merely reinforces it in your impersonating me... apk
Check out these greate Arris Modem Features:
- 3X Faster than Wi-Fi N (wohoo!)
- 8X Faster than DOCSIS 2.0 (super!)
- 2X Backdoored (awesome!)
When it comes to modems as a whole you should NEVER trust the modem as a primary gateway/router. Using a bridged mode pass through to a full firewall, and secured router separate from the modem is highly recommended for both wired and wireless communications. Most ISP modems have security holes built into the firmware by the modem manufacturers for different purposes. This was something I learned early on from systems engineers I worked with when pen testing network security flaws. Previous posts were correct when it was stated that such exploits were intentional, and never removed post production.
"With a straight face, I'm imploring you to trust me with a part of your information security. "
Nope. My game can bypass your HOSTs file, ads load just fine in it. Browsers can bypass it. The operating system itself can ignore it if it so chooses. Programs can ignore it all day. It is trivially bypassed.
Useless. I expect nothing less from someone relying upon Windows 9x computer naming technology for 'security.'
https://www.google.com/search?q=harris+rhyming+slang&ie=utf-8&oe=utf-8
See subject & this quote: "Even Dr. Manhattan can't be everywhere @ once..." & neither can I, or hosts - I never said hosts files 'cure all'" did I?
Show us where I did... ok??
* What I have said, repeatedly, is that hosts do MORE than ANY single other "so-called 'solution'" out there for speed & security, bar-none, doing so with less (less is more = good engineering, using what you have natively already vs. stupidly & illogically "Bolting on 'MoAr'"...)
APK
P.S.=> I'm fucked? No, it appears YOU'RE fucked - who knows what's in those ads you're seeing & if hosts can't stop it, learn to trace such things using tools like wireshark & block it in a firewall if hosts don't stop it (hosts only stop host-domain names, NOT IP address served ads OR threats - that's a firewall's job)... apk
The article in the summary doesnt list which modems are affected as i have an Arris Modem myself, but looks to be the TG862A, TG862G, and DG860A.
Well actually what they say is "affecting many of their devices including TG862A, TG862G, DG860A" so technically all one can say is that those models are definitely affected, but my reading is that others may be affected as well. Does anyone know of a comprehensive list of every known backdoored Arris model? And yeah, I know, the safe and likely correct answer is "probably all of them."
See subject: Hosts do stop online threats of host-domain name using ones (most used type by far vs. IP address served) & by far more dangerous/harder to stop due to "fastfluxing"...
* Should've noted that earlier but I didn't, so I am now...
APK
P.S.=> "And, there ya go..."
... apk
"While researching on the subject, I found a previously undisclosed backdoor on ARRIS cable modems, affecting many of their devices including TG862A, TG862G, DG860A."
The back door of your back door is: The front door.
recursive goatse