Security hole in Adsl router

crazy

Hey,

So I was trying some "stuff" 10mn ago, I stumbled upon a huge security issue in ADSL router of an ISP in lebanon. You know how nobody except maybe us here change the default password of the box which is usually admin or sometimes nothing (depends on the brand of the router).
Well did you ever try to access the router using the external IP (WAN IP) of the modem? Well, you can, and the access is not blocked, it just asks for the username and passwd (which 99% of the population do not change) and tadaaa you have access to the router.

I knew that lebanese ISP regards security as a luxury, and even sometimes do not even consider it, but come on... this is huge, a simple access list would do the trick! a simple command!

Anyway, I felt that I needed to share this stupidity of ISPs (which is not the first nor the last) with you guys, and mind you that no router was damaged during this experience, and I wish nobody would use this method to attack or damage any router whatsoever.

Crazy

Aj_BlaZ

i think anyone knew that before search the forums you'll see what i mean :)

Kassem

On month 11 of last year my whole 4GB free download quota was consumed in less than 5 days. And then it kept going at a rate close to 600MB/day until it finally hit 10GB and I had to pay 107,000 L.L for extra usage. In the middle of the month I changed my default username and password but I didn't feel that changed much at that time. But amazingly, starting the next month things got back to normal and I do not have any more problems. I went to Ogero in Bourj Al Murr and in Beir Hassan, and just as I expected they actually blamed "me" :). They simply assumed that I'm ignorant when it comes to computers and then started making stupid theories of what might have happened, and eventually the report was "The complaint you submitted was rejected because our technical team did not find any problems with your account"... Typical :)

crazy

Aj_BlaZ wrotei think anyone knew that before search the forums you'll see what i mean :)

If I remember correctly we tackled issue about cracking the password of the router, or your router locally. This is another issue.

Kareem

crazy wroteHey,

So I was trying some "stuff" 10mn ago, I stumbled upon a huge security issue in ADSL router of an ISP in lebanon. You know how nobody except maybe us here change the default password of the box which is usually admin or sometimes nothing (depends on the brand of the router).
Well did you ever try to access the router using the external IP (WAN IP) of the modem? Well, you can, and the access is not blocked, it just asks for the username and passwd (which 99% of the population do not change) and tadaaa you have access to the router.

I knew that lebanese ISP regards security as a luxury, and even sometimes do not even consider it, but come on... this is huge, a simple access list would do the trick! a simple command!

Anyway, I felt that I needed to share this stupidity of ISPs (which is not the first nor the last) with you guys, and mind you that no router was damaged during this experience, and I wish nobody would use this method to attack or damage any router whatsoever.

Crazy

Yep, but even if they get access to the router i dont find it a big deal, the worst thing they can do is capturing your pppoe username and password, which is useless because accounts usually are assigned to phone numbers, at least in europe, and they should have access to the ISP network. They cannot use your internet connection making you pay extra charge. Another point is that they need to know your IP address which is dynamic at least for the DSL users in Lebanon where you get an IP everytime you switch on your computer.
My Linksys router has the WAN access blocked by default and it doesnt work unless you specify https in the address bar.

However you are correct, people should be aware of it, that wouldnt hurt.

crazy

@Kareem, no they can do more than just capture your pppoe username and passwd. Any change of configuration could totally change the world of the user, and make him crazy (specially if he's not familiar with that). You can block for instance services or protocols and the list goes on..

This has to be reported to the technical staff of ISPs so they fix it.. And about dynamic addressing, its easy to re-find the IP of a victim... if a victim exists

Kareem

crazy wroteAnd about dynamic addressing, its easy to re-find the IP of a victim... if a victim exists

How? unless you are on IRC, its not that easy to find your real IP.

samer

And about dynamic addressing, its easy to re-find the IP of a victim... if a victim exists

The problem here is that ISPs usually make you go through a squid proxy, if you're logging IPs that's the one you'll pick up.

crazy

I tried a chunk of IP addresses changing only the last 8 bits, they all answered to the same ISP, and if I'm not mistaken the IPs are divided geographically, so I repeat that IF (coz even if its dynamic the IP does not always change) the IP changes, you can always find your victim.

Anyway, the IP is not the issue here, the problem is that you can randomly access people's router and mess with their connection.

Abbabbj

well if you can access the router mangement then you could access his internet and shared folders and you could even block him from his own internet usage but my isp change all the passwords before selling the adsl router so that every router has its own user and pass actually i reset my router every week changing all its security issues but the most of what i hate is its slowness in startup(i know that is normal)

Kareem

Abbabbj wrotewell if you can access the router mangement then you could access his internet and shared folders

??????????

HOw?

Abbabbj

i mean in case of wireless one

Kareem

Abbabbj wrotei mean in case of wireless one

But how can you access shared folders through router without being connected to network if you are controlling the modem through WAN interface? Might be interesting

Padre

lol, you guys are a bit late on that ;) if you only block the guy's access ...you are being too nice.
you can by routing your traffic through the router. You just have to add an iptables rule on the router, and set the router as a gateway for the subnet ur are trying to access on ur PC.

Abbabbj

Kareem wrote
Abbabbj wrotei mean in case of wireless one
But how can you access shared folders through router without being connected to network if you are controlling the modem through WAN interface? Might be interesting

sorry i forgot that we are using an external IP wan but if you control the router of your neighbor for example then you could access his network

Kareem

Padre wrotelol, you guys are a bit late on that ;) if you only block the guy's access ...you are being too nice.
you can by routing your traffic through the router. You just have to add an iptables rule on the router, and set the router as a gateway for the subnet ur are trying to access on ur PC.

That doen't work on all routers, does it ?

rolf

Kassem wrote"The complaint you submitted was rejected because our technical team did not find any problems with your account"... Typical :)

Of course, because the problem is not with your account but their procedure
And frankly I think the problem goes far deeper then that.

Padre

And frankly I think the problem goes far deeper then that.

there you go ;)

samer

Padre wrotelol, you guys are a bit late on that ;) if you only block the guy's access ...you are being too nice.
you can by routing your traffic through the router. You just have to add an iptables rule on the router, and set the router as a gateway for the subnet ur are trying to access on ur PC.

Or change their DNS entries to some phony DNS server you control?

crazy

So, in the end, we agree that this is a seriouse security issue.
Is there a way to contact the "right" people in the ISPs and tell them about it? So at least they would know about it (if this is not done on purpose that is) and fix it.

Who knows, maybe they did it on purpose and like that they can play with people's connection...

Not long ago, alfa was sending the username and password as clear text, so you could simply sniff it using wireshark or another packet sniffer, the right people were contacted at alfa, and now I guess they fixed it.
So, there is a chance that ISPs could fix the problem :)