{"id":116339,"date":"2024-06-04T21:40:05","date_gmt":"2024-06-04T19:40:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii"},"modified":"2024-06-04T21:40:05","modified_gmt":"2024-06-04T19:40:05","slug":"vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","title":{"rendered":"Mo\u017enost upravljanja z modemom milijonov naro\u010dnikov ISP Cox brez avtentifikacije","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Klient Cox Communications, t\u0159et\u00edho nejv\u011bt\u0161\u00edho poskytovatele kabelov\u00e9 televize v USA a jednoho z nejv\u011bt\u0161\u00edch oper\u00e1tor\u016f \u0161irokop\u00e1smov\u00e9ho p\u0159ipojen\u00ed, zahrnuj\u00edc\u00edho 6,5 milionu p\u0159edplatitel\u016f, zve\u0159ejnil v\u00fdsledky experimentu s pou\u017e\u00edvan\u00fdm poskytovatelem intern\u00edho Web API, dostupn\u00e9ho pro extern\u00ed dotazy a pou\u017e\u00edvaj\u00edc\u00edho se mimo jin\u00e9 pro p\u0159\u00edstup z\u00e1kaznick\u00e9ho servisu k modem\u016fm p\u0159edplatitel\u016f a datab\u00e1zi u\u017eivatel\u016f. Uk\u00e1zalo se, \u017ee pouh\u00fdm znalost\u00ed MAC adresy p\u0159edplatitelsk\u00e9ho za\u0159\u00edzen\u00ed je mo\u017en\u00e9 z\u00edskat plnou kontrolu nad modemem, co\u017e umo\u017e\u0148uje m\u011bnit nastaven\u00ed a prov\u00e1d\u011bt jak\u00e9koli p\u0159\u00edkazy na modemu. V podstat\u011b jak\u00fdkoli \u00fato\u010dn\u00edk m\u016f\u017ee z\u00edskat p\u0159\u00edstup k modemu, kter\u00fd je obdobn\u00fd technick\u00e9mu p\u0159\u00edstupu, kter\u00fd m\u00e1 z\u00e1kaznick\u00fd servis oper\u00e1tora. <\/p>\n

Je pozoruhodn\u00e9, \u017ee MAC adresu p\u0159edplatitelsk\u00e9ho za\u0159\u00edzen\u00ed lze zjistit prost\u0159ednictv\u00edm ve\u0159ejn\u00e9ho Web API bez pot\u0159eby autentifikace, using funkci hled\u00e1n\u00ed p\u0159edplatitel\u016f, nap\u0159\u00edklad prost\u0159ednictv\u00edm vyhled\u00e1v\u00e1n\u00ed podle emailu nebo \u010d\u00edsla \u00fa\u010dtu (proch\u00e1zen\u00edm \u010d\u00edsel je mo\u017en\u00e9 postupn\u011b st\u00e1hnout \u00fadaje o klientech). Krom\u011b MAC adresy jsou zobrazeny i dal\u0161\u00ed informace o p\u0159edplatiteli, v\u010detn\u011b adresy, telefonu, jm\u00e9na a e-mailu. Ve\u0161ker\u00e9 informace jsou dostupn\u00e9 pro dotazy z extern\u00ed s\u00edt\u011b bez autentifikace. Krom\u011b toho je mo\u017en\u00e9 informace nejen z\u00edskat, ale i zm\u011bnit. Celkem ve\u0159ejn\u011b dostupn\u00e9 API m\u00e1 v\u00edce ne\u017e 700 zpracovatel\u016f, z nich\u017e mnoh\u00e9 realizuj\u00ed operace spr\u00e1vy. <\/p>\n

Pro ov\u011b\u0159en\u00ed p\u0159enosu p\u0159\u00edkaz\u016f a nastaven\u00ed na modemy u\u017eivatel\u016f byl pou\u017eit \u0161ifrovan\u00fd parametr, ale funkce pro \u0161ifrov\u00e1n\u00ed byly nalezeny v jednom ze skript\u016f napsan\u00fdch v jazyce JavaScript, kter\u00e9 server webcdn-business.cox.com dod\u00e1v\u00e1. Kl\u00ed\u010d pro \u0161ifrov\u00e1n\u00ed se poda\u0159ilo ur\u010dit nastaven\u00edm bodu p\u0159eru\u0161en\u00ed na tyto funkce v JavaScriptov\u00e9m ladic\u00edm n\u00e1stroji prohl\u00ed\u017ee\u010de b\u011bhem registrace na str\u00e1nce myaccount-business.cox.com. Kl\u00ed\u010d pro \u0161ifrov\u00e1n\u00ed byl vytv\u00e1\u0159en pomoc\u00ed MAC adresy, identifik\u00e1toru za\u0159\u00edzen\u00ed a \u010d\u00edsla \u00fa\u010dtu u\u017eivatele, stejn\u011b jako n\u011bkolika pomocn\u00fdch parametr\u016f, jako je model za\u0159\u00edzen\u00ed a typ p\u0159\u00edstupu. <\/p>\n

Napadna shema vklju\u010duje iskanje \u017ertve prek javnega spletnega API-ja z uporabo poizvedbe po imenu, telefonski \u0161tevilki, e-po\u0161ti ali \u0161tevilki ra\u010duna. Nato napadalec pokli\u010de spletni API, da pridobi popoln niz osebnih podatkov naro\u010dnika, pri \u010demer uporabi UUID, pridobljen med prvim iskanjem. Z uporabo MAC-naslova modema, navedenega med podatki o naro\u010dniku, lahko napadalec pregleda seznam naprav, povezanih z modemom, spremeni kakr\u0161ne koli nastavitve na modemu, zahteva geslo, ki se uporablja za povezavo s Wi-Fi, in izvr\u0161i kakr\u0161ne koli ukaze na napravi, kar se lahko uporabi, na primer, za analizo ali preusmeritev uporabni\u0161kega prometa.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043b\u0438\u0435\u043d\u0442 Cox Communications, \u0442\u0440\u0435\u0442\u044c\u0435\u0433\u043e \u043f\u043e \u0432\u0435\u043b\u0438\u0447\u0438\u043d\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 \u043a\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0435\u043b\u0435\u0432\u0438\u0434\u0435\u043d\u0438\u044f \u0432 \u0421\u0428\u0410 \u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0448\u0438\u0440\u043e\u043a\u043e\u043f\u043e\u043b\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 6.5 \u043c\u043b\u043d \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c Web API, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0434\u043b\u044f \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u043c, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043a \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0441\u043a\u0438\u043c \u043c\u043e\u0434\u0435\u043c\u0430\u043c \u0438 \u0431\u0430\u0437\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0437\u043d\u0430\u044f \u043b\u0438\u0448\u044c MAC-\u0430\u0434\u0440\u0435\u0441 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116339","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mo\u017enost upravljanja z modemi milijonov naro\u010dnikov ISP Cox brez overitve | ProHoster","description":"Stranka Cox Communications, tretji najve\u010dji ponudnik kabelske televizije v ZDA in eden najve\u010djih ponudnikov \u0161irokopasovne povezave, ki \u0161teje 6,5 milijona naro\u010dnikov, je objavila rezultate.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432 ISP Cox \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442 Cox Communications, \u0442\u0440\u0435\u0442\u044c\u0435\u0433\u043e \u043f\u043e \u0432\u0435\u043b\u0438\u0447\u0438\u043d\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 \u043a\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0435\u043b\u0435\u0432\u0438\u0434\u0435\u043d\u0438\u044f \u0432 \u0421\u0428\u0410 \u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0448\u0438\u0440\u043e\u043a\u043e\u043f\u043e\u043b\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 6.5 \u043c\u043b\u043d \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/vozmozhnost-upravleniya-modemami-millionov-abonentov-isp-cox-bez-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-04T19:40:05+00:00","article:modified_time":"2024-06-04T19:40:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116339","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 01:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 01:43:19","updated":"2026-01-23 01:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/116339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=116339"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/116339\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=116339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=116339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=116339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}