{"id":116339,"date":"2024-06-04T21:40:05","date_gmt":"2024-06-04T19:40:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii"},"modified":"2024-06-04T21:40:05","modified_gmt":"2024-06-04T19:40:05","slug":"vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","title":{"rendered":"The ability to manage the modems of millions of ISP Cox subscribers without authentication","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Cox Communications, the third largest cable television provider in the U.S. and one of the largest broadband operators with 6.5 million subscribers, has published results from experiments with its internal Web API that is accessible for external requests. This API is used, among other things, to provide customer support access to subscriber modems and a user database. It was found that simply knowing the MAC address of a subscriber's device allows one to gain full control over the modem, enabling the alteration of settings and execution of any commands on the modem. Essentially, anyone attacking can access the modem in a manner similar to the engineering access that the telecommunication operator's support service gets. <\/p>\n
Notably, the MAC address of a subscriber's device can be obtained by querying the public Web API without authentication, using a subscriber search function, for example, by filtering by email or account number (by iterating over the numbers, one can successively extract customer data). In addition to the MAC address, other subscriber information is also displayed, including address, phone number, full name, and email. All information is available for requests from an external network without authentication. Moreover, it is possible not only to retrieve the information but also to modify it. The publicly available API includes over 700 handlers, many of which implement administrative operations. <\/p>\n
To verify the transmission of commands and settings to user modems, an encrypted parameter was used, but functions for encryption were found in one of the JavaScript scripts served by the website webcdn-business.cox.com. The encryption key was identified by setting a breakpoint on these functions in the browser's JavaScript debugger during registration on the website myaccount-business.cox.com. The encryption key was generated using the MAC address, device identifier, account number, and several auxiliary parameters, such as the device model and access type. <\/p>\n
The attack scenario involves searching for a victim through a public Web API using a request by name, phone number, email, or account number. The attacker then accesses the Web API to extract the complete set of personal data of the subscriber, using the UUID obtained during the initial search. By using the modem's MAC address provided among the subscriber's data, the attacker can view the list of devices connected to the modem, change any settings on the modem, request the password used to connect to Wi-Fi, and execute any commands on the device, which can be applied, for example, to conduct analysis or redirect user traffic. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"