#tr069 — Public Fediverse posts

Inspired by Proton's post, I decided to get a new router instead of using just my modem/router combo. The primary driver was that while my #cable modem's modem functionality is fine for my service, the features on the router/wifi side were lacking, so it's not like I haven't been thinking about this for a while. The idea that my #ISP could be using my router's wifi antennas to spy on me was what got me going.

Routers aren't that expensive. I got my Cudy for just $40. It did take a few hours to get switched over, mainly because I like to go through every setting before I consider the installation complete.

Basically the steps are to go through the modem/router's UI and copy down anything you want to carry forward. Then you switch it to bridge mode, swap in the new router, and reboot the lot. Then it's just going through the router's UI to set everything up.

There were lots of improvements. The big one was getting #WiFi7 and #WPA3, which has Perfect Forward Secrecy. That means that even your encrypted data can only be decrypted for a certain time before it becomes worthless. This is important when you realize that in the near future with quantum computing and such, everyone's encrypted data captured now will be trivial to crack.

Another big improvement was the ability to force everyone to use DNS-over-HTTPS (#DoH). Not using DoH means your ISP can see every domain that you visit or even think about visiting. I went with Quad9, which is a Swiss DNS host, which focuses on privacy (duh, it's Swiss).

The third big improvement was #mesh support. I was able to connect it with my access point via CAT7/8 cables and a switch for backbone. So now as I walk around the house, my devices move between the two access points.

Don't forget to turn off #TR069 or your ISP will still have control over your router. I'm still working on how to get WiFi into my backyard.

RE: https://mastodon.social/users/protonprivacy/statuses/116962426790206038

@bithive @oli @Stefan_S_from_H
GCNAT ist lösbar insofern, als dass letztlich zur Umgehung irgendwo eine Ingress/Egress-Adresse gebraucht wird. Dafür gibt es von Self-Host/managed service infinit viel mittlerweile.
Alternativ wird der Markt bei Verbreitung dieses Ansatzes entsprehcend reagieren. Und von IPv6 haben wir dann noch gar nicht geredet.

"Hardware kümmern" reduziert sich bei entsprechender Verteilung zum einen massiv und zum anderen wäre das, zusammen mit dem Egress-Dienst ein anbietbarer Dienst für überschaubare Preis sofern die betriebenen Dienste überschaubare Größe und Standardisierung haben. Es muss ja nicht gleich TR-069 sein, aber sealed distros, bootc, yoctokram und was weiß ich ermöglichen mittlerweile recht viel schöne Dinge.

#yocto #bootc #tr069 #fcos #securecore #managedhosting

heise+ | Wie Provider Heimnetze und #Router fernwarten | c't Magazin https://www.heise.de/hintergrund/Wie-Provider-Heimnetze-und-Router-fernwarten-9876367.html #heiseplus #TR069 #TR369 #USP #UserServicesPlatform #ISP #InternetServiceProvider #network #Netzwerk

Years ago I was toying with my own #ZyXEL #ADSL modem and found an HTTP form in the #TR069 #RomPager httpd server running on port 7676. The form appeared to be some kind of a test page unrelated to the actual TR-069 functionality of the device. I tried entering a command injection to the form input string and the device promptly rebooted. My first though was the command execution somehow made the httpd time out and some watchdog timer would reboot the device. However, I quickly found out that any long enough string would cause the same effect. This seemed some kind of uncontrolled termination of the httpd process. I downloaded a firmware upgrade for the device and promptly dissected it and located the httpd binary for reversing. The binary had no ASLR, or any other security measures that would even remotely resemble anything modern. The reversed binary looked like it escaped the 90s.

I did find out some unique looking function names, and googling for them and the form URL resulted in locating “RomPager Intro Web Server for ThreadX Programming Reference” (RomPager Intro - Web Server - Version 4.64 - June 24, 2010). This document has an example “RomPager Intro Sample User Exit Routine” (RiCgiTst.c) which matched the forms running on the ZyXEL device.

Fair enough, ZyXEL accidentally seemed to have included the test form to the device. Likely it was included as part of the RomPager httpd by default. When reading the code I quickly spotted something rather alarming:

extern void RpExternalCgi(void *theTaskDataPtr, rpCgiPtr theCgiPtr) {
…
char theName[25];
char theValue[25];
…
else if (theCgiPtr->fHttpRequest == eRpCgiHttpPost) {
/*
We got a POST request, so see if it matches the form that
we know.
*/
if (RP_STRCMP(theCgiPtr->fPathPtr, "/ProcessForm") == 0) {
/*
This is our form, so go retrieve the values.
*/
theFormBufferPtr = theCgiPtr->fArgumentBufferPtr;
theFoundFlag = False;
while (!theFoundFlag && *theFormBufferPtr != '\0') {
RpGetFormItem(&theFormBufferPtr, theName, theValue);

As it turns out RpGetFormItem did not do any kind of bound checking, and long enough parameters and values would promptly overflow the stack buffer. When the RpExternalCgi function returned the overwritten program counter would be followed, leading to the crash I was witnessing. I promptly created a proof of concept that used simple gadget to fetch pointer to the parameter string in first function register and then return-to-libc to system() function to execute shell commands on the device as root. Nice 0-day found and exploited... or so I thought.

Even at this stage I had already established the habit of googling for vulnerabilities by manufacturer and/or product name. Vulnerabilities often cluster, and it’s quite common to find similar issues from different models or even vendors. I did google for ZyXEL vulnerabilities and ran into identical issue, literally. I found out that this #vulnerability was old: It had been found by Peter Gessler and Steven Ketelaar and presented as “How I Met Your Modem” at Hack In The Box 2013. Their #exploit was far superior to mine, employing full ROPchain - but effectively it was the very same vulnerability. I then saw the slide page 43 "Responsible #Disclosure" which stated that the issue had been reported and verified to be fixed, and that everyone was happy. Well, I wasn't! Years later the vulnerability was prevalent in thousands of devices, including mine... To make matters far worse this flaw could be exploited without authentication over the WAN interface (read: internet).

I don’t know who dropped the ball, but it seems that the fix to this vulnerability didn’t reach all of ZyXEL's clients using the affected firmware. ZyXEL provides devices to dozens of different ISPs, and most of them have customized firmware dealing with local differences of the DSL network, such as the address of the ACS server (TR-069 Auto Configuration Server) and similar. My best guestimate is that at least at the time there was no proper coordination when the security fix was applied to all the different forks of the firmware, and this likely lead to the fix being applied to only one or some of them.

The "S" in IoT stands for security.

"How I Met Your Modem" slides, the vulnerability is described page 26 onwards: https://archive.conference.hitb.org/hitbsecconf2013ams/materials/D2T1%20-%20Peter%20Geissler%20and%20Steven%20Ketelaar%20-%20How%20I%20Met%20Your%20Modem.pdf