Slashdot Mirror
Over 135 Million Routers Vulnerable To Denial-of-service Flaw (zdnet.com)
schwit1 quotes a report from ZDNet: [More than 135 million modems are said to be vulnerable to a flaw that can leave users cut-off from the internet -- just by someone clicking on a trick link.] The problem lies with how a widely-used router, the ArrisSurfBoard SB6141, handles authentication and cross-site requests. Arris (formerly Motorola) said that it has sold more than 135 million of the SurfBoard SB6141 routers. That means the millions of Comcast, Time Warner Cable, or Charter customers who are shipped one of these routers when they subscribe are vulnerable. The flaw is so easy to exploit that anyone on an affected network can be tricked into clicking on a specially crafted web page or email. Security researcher David Longenecker, who found the flaws and posted the write-up on the Full Disclosure list earlier this week, released the "exploit" link after Arris stopped responding to emails he sent as part of the responsible disclosure process. There's no practical fix for the flaw, according to Longenecker. "The simplest solution would be a firmware update such that the web [user interface] requires a username and password before allowing disruptive actions such as rebooting or resetting the modem, and that validates that a request originated from the application and not from an external source," he said. But even if Arris released a fix, he said that the cable modems are not upgradable by their owners, meaning the internet provider would have to roll out the fix.
It's a cable modem.
Jesus fucking christ are coders STILL writing shit like this, in 2016? Why is it not drilled into the skulls of ANYONE who ever goes near a code editor that:
You DO NOT construct SQL strings by concatenating shit together
You DO NOT allow GET requests to perform any non-idempotent or destructive action
You DO NOT fire back user entered text without sanitising the shit out of it, ESPECIALLY to remove tags
Just follow these three rules and 99% of the web app disasters out there will be avoided.
First off this thing is a modem, not a router. It just handles converting DOCSIS to ethernet, no built in routing capabilities or anything. They do make devices that are all-in-ones, but this one isn't.
Second, that "135 million" number is a marketing number. It is how many SurfBoard modems, and combo units total Arris claims they've sold, including when it was a Motorola brand. My SB6190, which has been on sale for all of like 5 months, has that same number stamped on it.
Third, many people are automatically protected by their routers since many routers ship with "disable private networks on WAN interface" turned on by default. That is, of course, a practical solution to the problem on any network. You can filter private networks (or just 192.168.100.1) on your WAN port, to which your modem is attached and then there's no issue.
Finally, while you could be mildly annoying with it, causing the modem to reboot, that's all you could do. It also wouldn't stick in a loop or anything like that as it requires you to click the link to make this happen.
So not a brilliant situation, but not really a big problem either. Also despite the scare words of "IPSs would have to roll out the fix" that is precisely what can, and likely will, happen. Your cable modem is under the control of your ISP and they can push new firmware to it when they need to. So fixes don't have to go out to lots of individuals, they just have to get them to the ISPs and then it can be automatically sent to all users. Updating modem firmware is something they do anyhow.
This is rather click-batey Slashdot piece :P
http://192.168.100.1/Reboot.ht...
I have it bookmarked so I can freshen up the channels before I do a speedtest.
Pepper your blogs with this. People clicking it will lose their Internets for 45 seconds.
Stay flaws-in
The way it works is by getting your browser to go to the reboot page. However, if your browser can't, then it won't work. Since blocking the IP on your router will do that, you'll be safe. There is no public access to this interface, you have to get a computer on the local network to access it.
Uh yeah. I used to denial-of-service myself with UDP floods on an old wi-fi router. The stupid thing crashed during connection tracking for NAT or something. No firmware updates available. Still have it, don't use it anymore. It's just a dumb brick.
If you want something that you can fix yourself, you build your own router from scratch. I could, but I don't want to, because I'm cheap and I'm lazy and I don't fucking care.
Had assumed since ancient 5121 some 10 years ago this was possible. Even firewalled the modem from LAN as TFA suggests to prevent any kind of scripted data collection or reboot shenanigans.
There is no login on the surfboard interface, no accounts, no credentials. There are big juicy buttons to reboot and set factory defaults. Comcast's own portal had the browser follow reboot link thru web interface and anyone who wanted could do the same. I could be wrong and it could have been backend SNMP.. Never actually tried it but always assumed it worked that way.
If Arris pushes a fix I hope they also send X-Frame-Options or someone will just create a clickjack version of the same problem.
Reminds me of an ancient rumor for disconnecting modems by sending modem escape sequence in ICMP ping request and waiting for your victim to disconnect themselves by echoing it back.
when the *bleep* did Motorola change their name and/or get bought out? And what the heck kinda name is Arris anyway? If Motorola was good enough for the Megadrive and Amiga's 68k it was good enough for me.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Wow this is right up there with the old IRC trick where you could knock off tons of dialup users by sending a ctcp command of ATH+++
As I understand it's a modem, not router. So you need either a router or a PPPoE in your computer. My policy is that
1) the boundary between the Internet and my internal network lies between the equipment I control and equipment I don't control. In other words, either I choose the equipment, flash there anything I want and set any password I want - or this equipment is yours, you must do everything to return it in working order. And if you don't - I either go to some other provider or write a complain to Roskomnadzor. It's exactly what happened with my friend and his Motorola DOCSIS modem. The ISP personnel had seizures seeing his number on their phone. They reflashed the modem many times. But he still called them every time the problem occurred. They agreed to pay him to move to any other provider but he refused.
2) Either my router has an ability to install alternative firmwares, or it's not my router. Period.
"Restricting access to the Surfboard's web interface by using proxy filtering rules, router access control lists or firewall rules will mitigate this vulnerability. To effectively block access, the rules must prevent users on the LAN side of the cable modem from connecting to the web interface's IP address (usually 192.168.100.1)."
http://www.kb.cert.org/vuls/id/643049
I've never heard of this model/brand being used in consumer hardware available in Europe. Are these units mostly sold in the US?
Target and Best Buy, at least (CompUSA, IIRC), sold them retail. I got mine at Target. There's no need for an ISP "fix", if Arris just doesn't use that as an excuse not to provide an update.
Who owns the equipment is just a matter of who replaces it if it breaks and maybe if you pay rental fees. From the operational point of view, it is all under the control of the cable company. When you hook up a modem you have to register it with your cable provider or it won't work. Due to the nature of DOCSIS, it isn't a "plug and go" situation they have to have it provisioned on their system. It has to be an approved model too, because they need to be able to send it a boot file which tells it various configuration options it needs. Also their equipment will ask the modem about its firmware, and update it if needed. Often when you first hook up a new modem your purchased it'll come up, get new firmware, and then reboot right away.
There's no difference to their equipment where a modem came from. All it cares about it what model it is. It then looks to see what bootfile and what firmware said modem ought to get.
My router on 192.168.0 routes to 192.168.100 just fine. This is normal. 10 is the same. You in that glass house, put down that hay and use toilet paper like the rest of the 1st world.
Dunno if they are used much though. They support EuroDOCSIS so you can in theory use them everywhere (DOCSIS is for NTSC systems, EuroDOCSIS for PAL). IT is also possible that the same firmware is on units with a different model number or brand in other countries, sometimes a product will be rebadged in different markets.
It is kinda hard to say. A simple test is to go to 192.168.100.1. If that doesn't come up, then you have nothing to worry about since that's the IP the Arris modems use. If it does come up, then it depends on the specifics of the firmware. The older ones like the SB6141 have a reboot html page you could load, the newer ones do a button click and verification which makes this not work.
Yes, there is. DOCSIS doesn't permit user updates of the modem's firmware, because that would allow users to bypass limitations set by the cable provider based on what service they've purchased. Only the cable head-end can download firmware to the modem, so the ISPs have to add the fix to their firmware images and deploy them to the modems. Yeah, I know, but the network design treats the modem as a part of the cable network and not as an end-user device like a router would be. Just remind yourself that the cable network ends at the Ethernet jack on the back of the modem, not at the coax outlet on the wall.
Sorry, but "no". I have already updated it once, back when an earlier vulnerability was found. As long as it's a manufacturer-supplied update, TWC doesn't care.
Can't believe a tech site like ZDnet can't tell a cable modem from a router? But obviously if it requires a firmware upgrade to fix this issue, it would have to come form the ISP in a upgrade. Users will not be able to do anything.
[More than 135 million modems are said to be vulnerable to a flaw that can leave users cut-off from the internet -- just by someone clicking on a trick link.]
[ ( { What is this bizarre thing Slashdot has lately for chucking in brackets } for no good ) reason? ]
systemd is Roko's Basilisk.
Hell, consumer routers barely qualify as routers. Even top of the line Netgear and Linksys ones don't support any routing protocols (RIP/OSPF/BGP).
"National Security is the chief cause of national insecurity." - Celine's First Law
Anyone?
I use 10.0.2.0/24 as my physical LAN. Which means any OTHER network gets routed to the default gateway, which is the modem.
Most people use 192.168.1.0 on the LAN side. The cable modem isn't on that network either, it's on 192.168.100.1. So the bone-stock default is the same - the modem, on the WAN side, is a different network from the LAN side. What network you use on the LAN doesn't matter, unless you were to also use 192.168.100 on the LAN.
For the dumbasses that keep complaining...
DHCP Server Enabled The SURFboard cable modem can be used as a gateway to the Internet by a maximum of 32 users on a Local Area Network (LAN). When the Cable Modem is disconnected from the Internet, users on the LAN can be dynamically assigned IP Addresses by the Cable Modem DHCP Server. These addresses are assigned from an address pool which begins with 192.168.100.11 and ends with 192.168.100.42. Statically assigned IP addresses for other devices on the LAN should be chosen from outside of this range
Comcast has an annoying habit of assigning me channels with terrible packet loss. My solution was to write a cron job that fetches the "Signals" page ever minute, then examine the SNR and calculate the percent of "Uncorrectable Codewords". If any channel has SNR 2%, then it issues the reboot URL. Life has been sooo much better since I did this!
If you run OpenWRT on your router, follow these steps to block access to the modem from the LAN/WiFi:
1. In LuCI web interface, go to Network\Firewall.
2. Go to Traffic Rules.
3. Add a new Forward Rule. Name it BlockModem. Source zone is lan and destination zone is wan.
4. On the new rule, set these settings:
4a. Restrict to address family to IPv4 only.
4b. Source zone to Any zone. (Especially important if you also have a guest zone like me.)
4c. Destination address to 192.168.100.1. (Address of cable modem).
4d. Action to reject.
4e. Click Save & Apply.
5. You will have to temporarily disable this rule when you need to check cable modem status in the future. During that time, you'll be vulnerable to the above security flaw.
If the modem has an IPv6 address that also needs blocking, please let me know. :)
Hmm... Does a cable modem actually modulate and demodulate the signal or does it just route the signal at the end?
"So long and thanks for all the fish."
CMs don't route anything. They're more like Ethernet to DOCSIS bridges. They use IP for configuration/management, but you could theoretically use non-IP protocols through them (Good luck finding a service provider who would do anything with an IPX or AppleTalk packet)
"National Security is the chief cause of national insecurity." - Celine's First Law
Look what we have here, another know-it-all dumb fuck.
It doesn't have to support routing protocols to be a defined as a router; all it needs to do is forward between networks.
He said 'barely qualify', which means that they do, in fact, qualify as routers.
Static routing is still routing. The difference between a switch or hub and a router is the network layer on which they operate. Switches handle frames on layer 2, the data link layer. Routers handle packets on layer 3, the network layer. Consumer routers are routers, and more.
not new but known for over a decade
Don't need to trick user to click anything either. An img tag works just fine.
What about really ancient older models like my parents have from Time Warner Cable, a model SB5101 circa 2001 ? TWC is absolutely awful, not only won't they upgrade the modem, they are the only game in town, and they can't seem to configure a DNS to save their own lives. Their DNS server are on the same subnet on sequential IP's, so that in the event of any disruption, both DNS servers fail together. Sadly the number of interruptions is staggeringly high, and only my addition of an OpenDNS server makes their connection function in a great number of instances.
errr....umm...*whooosh* *whoosh* Is this thing on ?
That's strange, because the manufacturer says there are no firmware updates available for the SB6141 (or any of their other cable modems). It's possible to update the firmware of the router portion of their combined products, but that update doesn't touch the cable modem portion. Plus seeing as how the very first thing the cable modem will do after it establishes a connection to the head-end is check it's firmware image against the head-end and download and overwrite if they don't match...
DOCSIS 1.0 security specifications REQUIRE firmware downloads through the HFC interface ONLY. Users CANNOT update DOCSIS compliant modems. In fact, END USERS have no access to vendor images in the first place. (If you happen to have your own CMTS, and thus "cable network", then yes, you can load practically anything you want -- i.e. anything the existing firmware will accept.)
Yes, you can hack your modem... open it, attach a JTAG header, and screw with the system. That is not what we're talking about.
1.0.6.16 apparently has a "fix" -- they removed the buttons. If all they did was remove the clickable buttons but left the actual "reset.htm" pages in there, then it isn't fixed. As there are legitimate reasons to use those buttons (and no physical reset button), removing them is a Bad Idea(tm).