44con 2014 - i hunt tr-069 admins: pwning isps like a boss, shahar tal
DESCRIPTION
44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal Residential gateway (/SOHO router) exploitation is a rising trend in the security landscape - ever so often do we hear of yet another vulnerable device, with the occasional campaign targeted against specific versions of devices through independent scanning or Shodan dorking. We shine a bright light on TR-069/CWMP, the previously under-researched, de-facto CPE device management protocol, and specifically target ACS (Auto Configuration Server) software, whose pwnage can have devastating effects on critical amounts of users. These servers are, by design, in complete control of entire fleets of consumer premises devices, intended for use by ISPs and Telco providers. or nation-state adversaries, of course (sorry NSA, we know it was a cool attack vector with the best research-hours-to-mass-pwnage ratio). We investigate several TR-069 ACS platforms, and demonstrate multiple instances of poorly secured deployments, where we could have gained control over hundreds of thousands of devices. During the talk (pending patch availability), we will release exploits to vulnerabilities we discovered in ACS software, including RCEs on several platforms.TRANSCRIPT
![Page 1: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/1.jpg)
(U) I hunt TR-069 admins
Shahar Tal
TOP SECRET//SI//REL TO 44CON
![Page 2: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/2.jpg)
no ISPs were harmed during the making of this presentation
corporate legal wouldn't let us
![Page 3: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/3.jpg)
![Page 4: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/4.jpg)
• Shahar Tal (@jifa)
• Father, husband, geek
• 10 years with IDF
obligatory whoami
![Page 5: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/5.jpg)
Agenda
• Intro to TR-069
• Why you should care
• Landscape walkthrough
• Top kek pwnage
• Conclusion
• Taylor Swift’s Leaked Frontal Pics
![Page 6: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/6.jpg)
Residential Gateway Security
• It sucks.
• Pedro Joaquin (Routerpwn), Jacob Holcomb (“SO HOpelessly broken”), Zachary Cutlip (“rooting SOHO”), devtty0 (everything)
![Page 7: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/7.jpg)
TR-069 in 69 seconds
CPE WAN Management Protocol
(CWMP/TR-069)
• 2004: v1.0
• 2013: v1.4 (amendment 5)
![Page 8: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/8.jpg)
TR-069 Provisioning Session SOAP RPC
(XML over HTTP)
Always* initiates session
Dual authentication mechanism
ACS can issue “Connection Request”
![Page 9: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/9.jpg)
TR-069 Example RPC (ACSCPE)
<soapenv:Envelope ...>
...
<soapenv:Body>
<cwmp:SetParameterValues>
<ParameterList ...>
<Name>InternetGatewayDevice.ManagementServer.URL</Name>
<Value>http://acs.supersecureisp.com/cwmp/</Value>
</ParameterList>
...
</cwmp:SetParameterValues>
</soapenv:Body>
</soapenv:Envelope>
![Page 10: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/10.jpg)
TR-who?
• Growing trend to adopt TR-069 • Endorsed by Home Gateway Initiative, Digital Video Broadcasting, WiMax Forum
• (2011) Estimated 147M TR-069 enabled devices online • 70% Gateways
• According to zmap, 7547 is open on 1.12% of IPv4
![Page 11: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/11.jpg)
Good Guy ACS
• Provision devices (“zero-touch configuration”)
• Tech Support remote management
• Monitor for faults, errors or malicious activity
• Diagnostics and Performance
• Replace/fix faulty configuration
• Deploy upgraded firmware
![Page 12: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/12.jpg)
Trust Issues
• Who do you trust to run code on your devices?
• Silently?
• Remotely?
• With elevated permissions?
• I *might* trust heavily protected updates from Apple / Microsoft / Google with this, but what about my ISP?
![Page 13: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/13.jpg)
![Page 14: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/14.jpg)
![Page 15: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/15.jpg)
![Page 16: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/16.jpg)
TR-069 Architecture
Photo credit: https://www.etsy.com/shop/sharpwriter
![Page 17: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/17.jpg)
APT APT APT APT APT APT APT APT CYBER APT CYBER
![Page 18: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/18.jpg)
Scumbag ACS
• What would an attacker do if he was in control of an ACS?
• Get private data • SSID, hostnames & MAC addresses, usernames, VoIP
• Get complete configuration incl. passwords (vendor-specific)
• Set every parameter • DNS servers
• Wi-Fi (add new hidden SSID, remove password)
• PPP (replace WAN service with attacker controlled tunnel)
• Download • Configuration, firmware, logs
• Upload • Configuration, firmware
![Page 19: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/19.jpg)
Previous Work?
• Luka Perkov (“ISP’s black box” @ 29c3, UKNOF24)
• A brief survey of CWMP security (3SLabs) • http://blog.3slabs.com/2012/12/a-brief-survey-of-cwmp-security.html
• That’s about it. • (Apologies if my google fu wasn’t strong enough to find you)
![Page 20: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/20.jpg)
Niche Market
• Service Provider world
• TR-069 community?
![Page 21: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/21.jpg)
TR-069 Community
ADB, Affinegy, Agile ACS, Alvarion, Arris, AVSystem, Axiros, Calix, Cisco, Comtrend, Consona, Dimark, Draytek, Fine Point Technologies, Friendly Tech, GIP, Incognito Software, Intraway, Iskratel, iWedia, Jungo, Juniper Bridge, Mobigen, Motive, Netgem communications, Netmania, OneAccess, Pace, ProSyst, Ronankii Infotech, Sigma Systems, Tata Elxsi, Tilgin, Wi-tribe, Wind River, Works Systems
![Page 22: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/22.jpg)
![Page 23: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/23.jpg)
![Page 24: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/24.jpg)
![Page 25: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/25.jpg)
I got TR-069 problems
Insecure Configuration
Insecure Implementation
![Page 26: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/26.jpg)
![Page 27: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/27.jpg)
How do you find ACSs ITW?
• Hack a single router. QED.
• Scanning • zmap/masscan FTW
• 7547 and friends
• UPnP endpoints
• Public datasets • Internet Census 2012
• DNS Census 2013
• lmgtfy • lmstfy
![Page 28: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/28.jpg)
ACS Authentication Drill Down
• SSL
• 2nd option: shared secret
• Shared secret = HTTP auth (basic/digest)
HTTP
81%
HTTPS
19%
is RECOMMENDED
![Page 29: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/29.jpg)
Stealing the Secret
• Router interfaces try to protect ACS passwords.
• But… allow you to change the ACS URL.
• ACS can even enforce HTTP Basic auth • Base64 encoded “username:password”
![Page 30: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/30.jpg)
SSL Certificate Validation
![Page 31: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/31.jpg)
Field Test
![Page 32: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/32.jpg)
Recap
• TR-069 is very powerful
• ACS makes a very lucrative, accessible target
• A LOT of implementations are just not serious enough
![Page 33: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/33.jpg)
OpenACS
• Open source (Java)
• Start auditing
• 3 days later: RCE
• Reflection + Native File Upload = CVE-2014-2840
![Page 34: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/34.jpg)
GenieACS
• Open source (Node.js, Redis, MongoDB)
• Start auditing
• 2 days later: RCE
• Non-Global regex - CVE-2014-4956
• Running as root output = input.replace(/[\[\]\\\^\$\.\|\?\+\(\)]/, "\\$&")
GET /devices?query=["./;require('util').log(‘lolwut');//*"] HTTP/1.1
![Page 35: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/35.jpg)
PWNAGE
>be scanning ipv4 for GenieACS
>detect instance in middle-eastern ISP
>nbi exposed
>picard_facepalm.png
>OP delivers (vulnerability report)
>ISP support center not thrilled with Israeli calling about “vulnerable infrastructure” > No politics here, just pure security research
>8/10 would report again
![Page 36: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/36.jpg)
Undisclosed Vendor
• Massive global install base incl. major providers
• Internal API auth bypass, 2xSQLi, DoS
• Can write arbitrary files to any location • Including C:\Inetpub RCE
• Tested vulnerable provider (with permission)
![Page 37: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/37.jpg)
What can I do?
• Audit your TR-069 settings • Ensure SSL & proper cert validation
• Unsatisfied? disable TR-069 • (If you can)
• Add home security layer • Another router with NAT/FW capabilities
• Open source firmware alternatives
![Page 38: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/38.jpg)
Recap
• Not saying TR-069 is bad, just dangerous when unprotected
• TR-069 can be secure
• We don’t know if vendor X is vulnerable or not, we just have 100% success rate with the handful we’ve assessed. Extrapolate.
![Page 39: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/39.jpg)
Fixing the Problem
• There is no easy fix. • TR-069 has to mature • Bad implementations
are out there
• Awareness is key • Security community
• That’s you guys
• ACS vendors • Write better software, put money in secure coding • Show your security stance (bug bounties?)
• Service Providers • Protect your customers, it’s your responsibility
![Page 40: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/40.jpg)
Future Work
• BBF has responded positively • They are looking into the problems we’ve highlighted, may release a new
amendment with improvements
• TR-069 client pwnage • Stay tuned for 31C3
![Page 42: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/42.jpg)
![Page 43: 44CON 2014 - I Hunt TR-069 Admins: Pwning ISPs Like a Boss, Shahar Tal](https://reader034.vdocument.in/reader034/viewer/2022042512/547999d3b379594e2b8b47f8/html5/thumbnails/43.jpg)
• @swiftonsecurity
• https://www.iol.unh.edu/sites/default/files/knowledgebase/hnc/TR-069_Crash_Course.pdf TR-069 Crash Course (University of New Hampshire Interoperability Laboratory)
• https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf Whitepaper: Security Flaws in Universal Plug and Play: Unplug, Don’t Play. (Rapid7)
• http://internetcensus2012.bitbucket.org/ Internet Census 2012 (anonymous researcher)
• http://www.team-cymru.com/ReadingRoom/Whitepapers/SOHOPharming.html SOHO Pharming (Team Cymru)