Cox Communications, USA's third-largest cable television provider and one of the largest broadband operators with 6.5 million subscribers, published the results of experiments with their internal Web API, which is accessible for external requests and used, among other things, for customer support access to subscriber modems and user databases. It turned out that by knowing just the MAC address of the subscriber's device, one could gain complete control over the modem, allowing the modification of settings and execution of any commands on the modem. Essentially, any attacker can access the modem with privileges similar to those of the support service of the telecommunications operator.
Notably, the MAC address of the subscriber's device can be discovered by accessing a public Web API without going through authentication, using the subscriber search function, for example, by querying by email or account number (by iterating through numbers, one can sequentially extract client data). Besides the MAC address, other subscriber information is also displayed, including address, phone number, full name, and email. All information is accessible for requests from external networks without authentication. Moreover, the information can not only be retrieved but also modified. The publicly accessible API includes over 700 handlers, many of which implement administrative operations.
To verify the transmission of commands and settings to users' modems, an encrypted parameter was used, but functions for encryption were found in one of the scripts written in JavaScript served by the webcdn-business.cox.com website. The encryption key was determined by setting a breakpoint on these functions in the browser's JavaScript debugger during registration on the myaccount-business.cox.com site. The encryption key was formed using the MAC address, device identifier, and user account number, as well as several auxiliary parameters, such as device model and access type.
Rünnakuskeem hõlmab sihtmärgiks oleva isiku leidmist avalikust Web API-st, kasutades otsingupäringut nime, telefoninumbri, e-posti või konto numbri järgi. Seejärel pöördub ründaja Web API poole, et saada välja kõik isikuandmed abonendi kohta, kasutades esimeses etapis saadud UUID-d. Kasutades abonendi andmetes toodud modemi MAC-aadressi, saab ründaja vaadata modemi külge ühendatud seadmete loetelu, muuta modemi konfiguratsiooni, küsida Wi-Fi-ühenduseks kasutatavat parooli ja teostada seadmel igasuguseid käske, mida saab kasutada näiteks kasutaja liikluse analüüsimiseks või suunamiseks.
Allikas: opennet.ru
