{"id":116339,"date":"2024-06-04T21:40:05","date_gmt":"2024-06-04T19:40:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii"},"modified":"2024-06-04T21:40:05","modified_gmt":"2024-06-04T19:40:05","slug":"vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","title":{"rendered":"ISP Cox'i miljonite abonentide modemite juhtimise v\u00f5imalus ilma autentimiseta","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cox Communications, Ameerika \u00dchendriikide kolmas suurim kaabeltelevisiooni teenusepakkuja ja \u00fcks suurimaid lairiba\u00fchendusettev\u00f5tteid, millel on 6,5 miljonit liiget, avaldas tulemused katsetest, mis viidi l\u00e4bi pakkuja sisemise Web API kohta, mis on v\u00e4liste p\u00e4ringute jaoks avatud ja mida kasutatakse muu hulgas klienditeeninduse juurdep\u00e4\u00e4suks tellijate modemitele ja kasutajate andmebaasile. Selgus, et teadmisega ainult tellija seadme MAC-aadressist on v\u00f5imalik saada t\u00e4ielik kontroll modemi \u00fcle, mis v\u00f5imaldab muutusi seade seadetes ja k\u00e4ivitada mis tahes k\u00e4ske modemil. Essentsiaalselt v\u00f5ib iga r\u00fcndaja saada juurdep\u00e4\u00e4su modemile, mis on sarnane inseneri juurdep\u00e4\u00e4sule, mida saavad teenusepakkuja tugiteenused. <\/p>\n

Oluline on m\u00e4rkida, et tellija seadme MAC-aadressi on v\u00f5imalik saada, tehes p\u00e4ringu avalikule Web API-le ilma autentimiseta, kasutades tellijate otsimise funktsiooni, n\u00e4iteks e-posti v\u00f5i konto numbri alusel (numbrite j\u00e4rjestamisega on v\u00f5imalik j\u00e4rjestikku laadida andmeid klientide kohta). Lisaks MAC-aadressile n\u00e4idatakse ka muid teavet tellija kohta, sealhulgas aadress, telefon, nimi ja e-post. K\u00f5ik andmed on v\u00e4lisest v\u00f5rgust ilma autentimiseta kergesti k\u00e4ttesaadavad. Samuti on v\u00f5imalik teavet mitte ainult saada, vaid ka muuta. \u00dchtekokku on avalikult k\u00e4ttesaadav API rohkem kui 700 t\u00f6\u00f6tlejat, millest paljud teostavad haldusoperatsioone. <\/p>\n

K\u00e4skude ja seadete edastamise kinnitamiseks kasutati modemitele kr\u00fcpteeritud parameetrit, kuid kr\u00fcpteerimise funktsioonid leiti \u00fche JavaScripti skripti seest, mida edastati saidilt webcdn-business.cox.com. Kr\u00fcpteerimisv\u00f5ti suudeti kindlaks teha, seades need funktsioonid JavaScripti silurisse peatamise punktiks MyAccount-Business.cox.com saidil registreerumise ajal. Kr\u00fcpteerimisv\u00f5ti kujundati kasutades MAC-aadressi, seadme identifikaatorit ja kasutaja konto numbrit ning mitmeid abiparameetreid, nagu seadme mudel ja juurdep\u00e4\u00e4su t\u00fc\u00fcp. <\/p>\n

R\u00fcnnakuskeem sisaldab ohvri otsimist avaliku Web API kaudu, kasutades p\u00e4ringut nime, telefoninumbri, e-posti v\u00f5i konto numbri kaupa. Seej\u00e4rel p\u00f6\u00f6rdub r\u00fcndaja Web API poole, et laadida alla kogu komplekt isikuandmeid tellija kohta, kasutades UUID-d, mis saadi esimese etapi otsingust. Kasutades tellija andmete seas sisalduvat modemi MAC-aadressi, v\u00f5ib r\u00fcndaja vaadata loendit modemi k\u00fclge \u00fchendatud seadmetest, muuta mis tahes parameetreid modemis, k\u00fcsida parooli, mida kasutatakse Wi-Fi-ga \u00fchendamiseks ning t\u00e4ita mis tahes k\u00e4sklusi seadmes, mida saab kasutada n\u00e4iteks kasutaja liikluse anal\u00fc\u00fcsimiseks v\u00f5i suunamiseks.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043b\u0438\u0435\u043d\u0442 Cox Communications, \u0442\u0440\u0435\u0442\u044c\u0435\u0433\u043e \u043f\u043e \u0432\u0435\u043b\u0438\u0447\u0438\u043d\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 \u043a\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0435\u043b\u0435\u0432\u0438\u0434\u0435\u043d\u0438\u044f \u0432 \u0421\u0428\u0410 \u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0448\u0438\u0440\u043e\u043a\u043e\u043f\u043e\u043b\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 6.5 \u043c\u043b\u043d \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c Web API, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0434\u043b\u044f \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u043c, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043a \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0441\u043a\u0438\u043c \u043c\u043e\u0434\u0435\u043c\u0430\u043c \u0438 \u0431\u0430\u0437\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0437\u043d\u0430\u044f \u043b\u0438\u0448\u044c MAC-\u0430\u0434\u0440\u0435\u0441 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116339","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cox ISP modemite haldamise v\u00f5imalus ilma autentimiseta | ProHoster","description":"Cox Communications, Ameerika \u00dchendriikide kolmas suurim kaabeltelevisiooni teenusepakkuja ja \u00fcks suurimaid lairiba\u00fchendusettev\u00f5tteid, millel on 6,5 miljonit liiget, avaldas tulemused katsetest, mis viidi l\u00e4bi pakkuja sisemise Web API kohta, mis on v\u00e4liste p\u00e4ringute jaoks avatud ja mida kasutatakse muu hulgas klienditeeninduse juurdep\u00e4\u00e4suks tellijate modemitele ja kasutajate andmebaasile. Selgus, et teadmisega ainult tellija seadme MAC-aadressist on v\u00f5imalik saada t\u00e4ielik kontroll modemi \u00fcle.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432 ISP Cox \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442 Cox Communications, \u0442\u0440\u0435\u0442\u044c\u0435\u0433\u043e \u043f\u043e \u0432\u0435\u043b\u0438\u0447\u0438\u043d\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 \u043a\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0435\u043b\u0435\u0432\u0438\u0434\u0435\u043d\u0438\u044f \u0432 \u0421\u0428\u0410 \u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0448\u0438\u0440\u043e\u043a\u043e\u043f\u043e\u043b\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 6.5 \u043c\u043b\u043d \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c Web API, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0434\u043b\u044f \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u043c, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043a \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0441\u043a\u0438\u043c \u043c\u043e\u0434\u0435\u043c\u0430\u043c \u0438 \u0431\u0430\u0437\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0437\u043d\u0430\u044f \u043b\u0438\u0448\u044c MAC-\u0430\u0434\u0440\u0435\u0441 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-04T19:40:05+00:00","article:modified_time":"2024-06-04T19:40:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116339","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 01:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 01:43:19","updated":"2026-01-23 01:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/116339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=116339"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/116339\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=116339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=116339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=116339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}