{"id":116339,"date":"2024-06-04T21:40:05","date_gmt":"2024-06-04T19:40:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii"},"modified":"2024-06-04T21:40:05","modified_gmt":"2024-06-04T19:40:05","slug":"vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","title":{"rendered":"Posibilitatea de a gestiona modemurile a milioane de abona\u021bi ISP Cox f\u0103r\u0103 autentificare","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Clientul Cox Communications, al treilea cel mai mare furnizor de servicii de televiziune prin cablu din SUA \u0219i unul dintre cei mai mari operatori de acces la internet cu band\u0103 larg\u0103, av\u00e2nd 6,5 milioane de abona\u021bi, a publicat rezultate ale experimentelor efectuate cu API-ul intern folosit de furnizor, disponibil pentru cereri externe \u0219i aplicat, printre altele, pentru accesul serviciului de asisten\u021b\u0103 la modemurile abona\u021bilor \u0219i baza de utilizatori. S-a constatat c\u0103, cunosc\u00e2nd doar adresa MAC a dispozitivului abonatului, se poate ob\u021bine control total asupra modemului, permi\u021b\u00e2nd modificarea set\u0103rilor \u0219i executarea oric\u0103ror comenzi pe modem. Practic, orice atacator poate ob\u021bine acces la modem, similar cu accesul ingineresc ob\u021binut de serviciul de asisten\u021b\u0103 al operatorului de telecomunica\u021bii. <\/p>\n

Merit\u0103 men\u021bionat c\u0103 adresa MAC a dispozitivului abonatului poate fi ob\u021binut\u0103 prin apelarea unui API public Web f\u0103r\u0103 a trece prin autentificare, folosind func\u021bia de c\u0103utare a abona\u021bilor, de exemplu, printr-o selec\u021bie dup\u0103 email sau num\u0103rul de cont (permi\u021b\u00e2nd extragerea datelor despre clien\u021bi printr-o enumerare a numerelor). Pe l\u00e2ng\u0103 adresa MAC, sunt furnizate \u0219i alte informa\u021bii despre abonat, inclusiv adresa, telefonul, numele complet \u0219i emailul. Toate informa\u021biile sunt disponibile pentru cereri din re\u021beaua extern\u0103 f\u0103r\u0103 autentificare. \u00cen plus, informa\u021bia poate fi nu doar ob\u021binut\u0103, ci \u0219i modificat\u0103. \u00cen total, API-ul public disponibil num\u0103r\u0103 peste 700 de manipulatoare, dintre care multe implementeaz\u0103 opera\u021bii de administrare. <\/p>\n

Pentru verificarea transmiterii comenzilor \u0219i set\u0103rilor c\u0103tre modemurile utilizatorilor a fost folosit un parametru criptat, dar func\u021biile de criptare au fost g\u0103site \u00eentr-unul dintre scripturile \u00een JavaScript returnate de site-ul webcdn-business.cox.com. Cheia pentru criptare a putut fi determinat\u0103 stabilind un punct de oprire \u00een func\u021biile respective \u00een debugger-ul JavaScript al browserului \u00een timpul \u00eenregistr\u0103rii pe site-ul myaccount-business.cox.com. Cheia pentru criptare era generat\u0103 folosind adresa MAC, identificatorul dispozitivului \u0219i num\u0103rul de cont al utilizatorului, precum \u0219i c\u00e2\u021biva parametri auxiliari, cum ar fi modelul dispozitivului \u0219i tipul de acces. <\/p>\n

Scenariul atacului se concentreaz\u0103 pe g\u0103sirea unei victime printr-o API web public\u0103, folosind o cerere dup\u0103 nume, num\u0103r de telefon, email sau num\u0103rul de cont. Ulterior, atacatorul acceseaz\u0103 API-ul web pentru a desc\u0103rca \u00eentregul set de date personale ale abonatului, folosind UUID ob\u021binut \u00een prima etap\u0103 de c\u0103utare. Folosind adresa MAC a modemului, men\u021bionat\u0103 printre datele despre abonat, atacatorul poate vizualiza lista dispozitivelor conectate la modem, poate schimba orice parametru pe modem, poate solicita parola folosit\u0103 pentru conectarea la Wi-Fi \u0219i poate executa orice comenzi pe dispozitiv, ceea ce poate fi folosit, de exemplu, pentru organizarea analizei sau redirec\u021bionarea traficului utilizatorului.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043b\u0438\u0435\u043d\u0442 Cox Communications, \u0442\u0440\u0435\u0442\u044c\u0435\u0433\u043e \u043f\u043e \u0432\u0435\u043b\u0438\u0447\u0438\u043d\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 \u043a\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0435\u043b\u0435\u0432\u0438\u0434\u0435\u043d\u0438\u044f \u0432 \u0421\u0428\u0410 \u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0448\u0438\u0440\u043e\u043a\u043e\u043f\u043e\u043b\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 6.5 \u043c\u043b\u043d \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c Web API, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0434\u043b\u044f \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u043c, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043a \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0441\u043a\u0438\u043c \u043c\u043e\u0434\u0435\u043c\u0430\u043c \u0438 \u0431\u0430\u0437\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0437\u043d\u0430\u044f \u043b\u0438\u0448\u044c MAC-\u0430\u0434\u0440\u0435\u0441 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116339","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Posibilitatea de a gestiona modemurile milioanelor abona\u021bi ISP Cox f\u0103r\u0103 autentificare | ProHoster","description":"Clientul Cox Communications, al treilea cel mai mare furnizor de televiziune prin cablu din SUA \u0219i unul dintre cei mai mari operatori de acces de band\u0103 larg\u0103, av\u00e2nd 6,5 milioane de abona\u021bi, a publicat rezultatele.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432 ISP Cox \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442 Cox Communications, \u0442\u0440\u0435\u0442\u044c\u0435\u0433\u043e \u043f\u043e \u0432\u0435\u043b\u0438\u0447\u0438\u043d\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 \u043a\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0435\u043b\u0435\u0432\u0438\u0434\u0435\u043d\u0438\u044f \u0432 \u0421\u0428\u0410 \u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0448\u0438\u0440\u043e\u043a\u043e\u043f\u043e\u043b\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 6.5 \u043c\u043b\u043d \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-04T19:40:05+00:00","article:modified_time":"2024-06-04T19:40:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116339","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 01:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 01:43:19","updated":"2026-01-23 01:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/116339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=116339"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/116339\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=116339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=116339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=116339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}