{"id":116339,"date":"2024-06-04T21:40:05","date_gmt":"2024-06-04T19:40:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii"},"modified":"2024-06-04T21:40:05","modified_gmt":"2024-06-04T19:40:05","slug":"vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","title":{"rendered":"V\u00f5imalus kontrollida ISP Coxi miljonite klientide modemeid ilma autentimiseta","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Cox Communications, USA's third-largest cable television provider and one of the largest broadband operators with 6.5 million subscribers, published the results of experiments with their internal Web API, which is accessible for external requests and used, among other things, for customer support access to subscriber modems and user databases. It turned out that by knowing just the MAC address of the subscriber's device, one could gain complete control over the modem, allowing the modification of settings and execution of any commands on the modem. Essentially, any attacker can access the modem with privileges similar to those of the support service of the telecommunications operator. <\/p>\n
Notably, the MAC address of the subscriber's device can be discovered by accessing a public Web API without going through authentication, using the subscriber search function, for example, by querying by email or account number (by iterating through numbers, one can sequentially extract client data). Besides the MAC address, other subscriber information is also displayed, including address, phone number, full name, and email. All information is accessible for requests from external networks without authentication. Moreover, the information can not only be retrieved but also modified. The publicly accessible API includes over 700 handlers, many of which implement administrative operations. <\/p>\n
To verify the transmission of commands and settings to users' modems, an encrypted parameter was used, but functions for encryption were found in one of the scripts written in JavaScript served by the webcdn-business.cox.com website. The encryption key was determined by setting a breakpoint on these functions in the browser's JavaScript debugger during registration on the myaccount-business.cox.com site. The encryption key was formed using the MAC address, device identifier, and user account number, as well as several auxiliary parameters, such as device model and access type. <\/p>\n
R\u00fcnnakuskeem h\u00f5lmab sihtm\u00e4rgiks oleva isiku leidmist avalikust Web API-st, kasutades otsingup\u00e4ringut nime, telefoninumbri, e-posti v\u00f5i konto numbri j\u00e4rgi. Seej\u00e4rel p\u00f6\u00f6rdub r\u00fcndaja Web API poole, et saada v\u00e4lja k\u00f5ik isikuandmed abonendi kohta, kasutades esimeses etapis saadud UUID-d. Kasutades abonendi andmetes toodud modemi MAC-aadressi, saab r\u00fcndaja vaadata modemi k\u00fclge \u00fchendatud seadmete loetelu, muuta modemi konfiguratsiooni, k\u00fcsida Wi-Fi-\u00fchenduseks kasutatavat parooli ja teostada seadmel igasuguseid k\u00e4ske, mida saab kasutada n\u00e4iteks kasutaja liikluse anal\u00fc\u00fcsimiseks v\u00f5i suunamiseks. \n Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"