Klient Cox Communications, t\u0159et\u00edho nejv\u011bt\u0161\u00edho poskytovatele kabelov\u00e9 televize v USA a jednoho z nejv\u011bt\u0161\u00edch oper\u00e1tor\u016f \u0161irokop\u00e1smov\u00e9ho p\u0159ipojen\u00ed, kter\u00fd m\u00e1 6,5 milionu p\u0159edplatitel\u016f, zve\u0159ejnil v\u00fdsledky experiment\u016f s pou\u017e\u00edvan\u00fdm intern\u00edm Web API poskytovatele, kter\u00e9 je p\u0159\u00edstupn\u00e9 pro extern\u00ed dotazy a pou\u017e\u00edv\u00e1 se nap\u0159\u00edklad pro p\u0159\u00edstup z\u00e1kaznick\u00e9 podpory k modem\u016fm p\u0159edplatitel\u016f a u\u017eivatelsk\u00e9 datab\u00e1zi. Uk\u00e1zalo se, \u017ee pokud m\u00e1 \u00fato\u010dn\u00edk pouze MAC adresu p\u0159edplatitelsk\u00e9ho za\u0159\u00edzen\u00ed, m\u016f\u017ee z\u00edskat plnou kontrolu nad modemem, co\u017e mu umo\u017e\u0148uje m\u011bnit nastaven\u00ed a prov\u00e1d\u011bt jak\u00e9koli p\u0159\u00edkazy na modemu. V podstat\u011b m\u016f\u017ee jak\u00fdkoli \u00fato\u010dn\u00edk z\u00edskat p\u0159\u00edstup k modemu, kter\u00fd je srovnateln\u00fd s in\u017een\u00fdrsk\u00fdm p\u0159\u00edstupem, jak\u00fd m\u00e1 z\u00e1kaznick\u00e1 podpora oper\u00e1tora. <\/p>\n
Je pozoruhodn\u00e9, \u017ee MAC adresu p\u0159edplatitelsk\u00e9ho za\u0159\u00edzen\u00ed lze zjistit prost\u0159ednictv\u00edm dotazu na ve\u0159ejn\u00e9 Web API bez ov\u011b\u0159en\u00ed, pou\u017eit\u00edm funkce pro vyhled\u00e1v\u00e1n\u00ed p\u0159edplatitel\u016f, nap\u0159\u00edklad pomoc\u00ed emailu nebo \u010d\u00edsla \u00fa\u010dtu (p\u0159i\u010dem\u017e lze postupn\u011b vyb\u00edrat \u010d\u00edsla a z\u00edsk\u00e1vat informace o klientech). Krom\u011b MAC adresy jsou zobrazeny tak\u00e9 dal\u0161\u00ed informace o p\u0159edplatiteli, v\u010detn\u011b adresy, telefonu, jm\u00e9na a p\u0159\u00edjmen\u00ed a emailu. Ve\u0161ker\u00e9 informace jsou dostupn\u00e9 pro dotazy z vn\u011bj\u0161\u00ed s\u00edt\u011b bez ov\u011b\u0159en\u00ed. Krom\u011b toho je mo\u017en\u00e9 nejen z\u00edskat informace, ale tak\u00e9 je zm\u011bnit. Ve\u0159ejn\u011b dostupn\u00e9 API obsahuje v\u00edce ne\u017e 700 zpracovatel\u016f, z nich\u017e mnoh\u00e9 realizuj\u00ed operace spr\u00e1vy. <\/p>\n
Pro ov\u011b\u0159en\u00ed p\u0159enosu p\u0159\u00edkaz\u016f a nastaven\u00ed na modemy u\u017eivatel\u016f se pou\u017e\u00edval za\u0161ifrovan\u00fd parametr, ale funkce pro \u0161ifrov\u00e1n\u00ed byly nalezeny v jednom ze skript\u016f v jazyce JavaScript, vracen\u00fdch webem webcdn-business.cox.com. Kl\u00ed\u010d pro \u0161ifrov\u00e1n\u00ed se poda\u0159ilo ur\u010dit nastaven\u00edm bodu p\u0159eru\u0161en\u00ed na tyto funkce v JavaScriptov\u00e9m debuggeru prohl\u00ed\u017ee\u010de b\u011bhem registrace na str\u00e1nk\u00e1ch myaccount-business.cox.com. Kl\u00ed\u010d pro \u0161ifrov\u00e1n\u00ed byl generov\u00e1n pomoc\u00ed MAC adresy, identifik\u00e1toru za\u0159\u00edzen\u00ed a \u010d\u00edsla u\u017eivatelsk\u00e9ho \u00fa\u010dtu, jako\u017e i n\u011bkolika pomocn\u00fdch parametr\u016f, jako je model za\u0159\u00edzen\u00ed a zp\u016fsob p\u0159\u00edstupu. <\/p>\n
\u00datok spo\u010d\u00edv\u00e1 v nalezen\u00ed ob\u011bti prost\u0159ednictv\u00edm ve\u0159ejn\u00e9ho API, pomoc\u00ed dotazu podle jm\u00e9na, telefonn\u00edho \u010d\u00edsla, e-mailu nebo \u010d\u00edsla \u00fa\u010dtu. Pot\u00e9 \u00fato\u010dn\u00edk kontaktuje API pro vyta\u017een\u00ed kompletn\u00edho souboru osobn\u00edch \u00fadaj\u016f p\u0159edplatitele, pou\u017e\u00edvaje UUID z\u00edskan\u00e9 p\u0159i hled\u00e1n\u00ed v prvn\u00edm kroku. Pou\u017eit\u00edm MAC adresy modemu, kter\u00e1 je obsa\u017eena v \u00fadaj\u00edch o p\u0159edplatiteli, m\u016f\u017ee \u00fato\u010dn\u00edk zjistit seznam za\u0159\u00edzen\u00ed p\u0159ipojen\u00fdch k modemu, zm\u011bnit jak\u00e9koli parametry na modemu, po\u017e\u00e1dat o heslo pou\u017e\u00edvan\u00e9 pro p\u0159ipojen\u00ed k Wi-Fi, a prov\u00e9st jak\u00e9koli p\u0159\u00edkazy na za\u0159\u00edzen\u00ed, co\u017e lze pou\u017e\u00edt nap\u0159\u00edklad pro anal\u00fdzu nebo p\u0159esm\u011brov\u00e1n\u00ed u\u017eivatelsk\u00e9ho provozu. \u041a\u043b\u0438\u0435\u043d\u0442 Cox Communications, \u0442\u0440\u0435\u0442\u044c\u0435\u0433\u043e \u043f\u043e \u0432\u0435\u043b\u0438\u0447\u0438\u043d\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 \u043a\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0435\u043b\u0435\u0432\u0438\u0434\u0435\u043d\u0438\u044f \u0432 \u0421\u0428\u0410 \u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0448\u0438\u0440\u043e\u043a\u043e\u043f\u043e\u043b\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 6.5 \u043c\u043b\u043d \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c Web API, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0434\u043b\u044f \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u043c, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043a \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0441\u043a\u0438\u043c \u043c\u043e\u0434\u0435\u043c\u0430\u043c \u0438 \u0431\u0430\u0437\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0437\u043d\u0430\u044f \u043b\u0438\u0448\u044c MAC-\u0430\u0434\u0440\u0435\u0441 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116339","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mo\u017enost spr\u00e1vy modem\u016f milion\u016f p\u0159edplatitel\u016f ISP Cox bez autentizace | ProHoster","description":"Z\u00e1kazn\u00edk Cox Communications, t\u0159et\u00edho nejv\u011bt\u0161\u00edho poskytovatele kabelov\u00e9 televize ve Spojen\u00fdch st\u00e1tech a jednoho z nejv\u011bt\u0161\u00edch poskytovatel\u016f \u0161irokop\u00e1smov\u00e9ho p\u0159ipojen\u00ed s 6,5 miliony p\u0159edplatitel\u016f, zve\u0159ejnil v\u00fdsledky.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432 ISP Cox \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442 Cox Communications, \u0442\u0440\u0435\u0442\u044c\u0435\u0433\u043e \u043f\u043e \u0432\u0435\u043b\u0438\u0447\u0438\u043d\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 \u043a\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0435\u043b\u0435\u0432\u0438\u0434\u0435\u043d\u0438\u044f \u0432 \u0421\u0428\u0410 \u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0448\u0438\u0440\u043e\u043a\u043e\u043f\u043e\u043b\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 6.5 \u043c\u043b\u043d \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-04T19:40:05+00:00","article:modified_time":"2024-06-04T19:40:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116339","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 01:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 01:43:19","updated":"2026-01-23 01:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/116339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=116339"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/116339\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=116339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=116339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=116339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"