I Hunt TR-069 Admins: Pwning ISPs Like a Boss - Presented By Shahar Tal
Автор: 44CON Information Security Conference
Загружено: 2019-08-27
Просмотров: 3633
Residential gateway (/SOHO router) exploitation is a rising trend in the security landscape – ever so often do we hear of yet another vulnerable device, with the occasional campaign targeted against specific versions of devices through independent scanning or Shodan dorking. We shine a bright light on TR-069/CWMP, the previously under-researched, de-facto CPE device management protocol, and specifically target ACS (Auto Configuration Server) software, whose pwnage can have devastating effects on critical amounts of users. These servers are, by design, in complete control of entire fleets of consumer premises devices, intended for use by ISPs and Telco providers. or nation-state adversaries, of course (sorry NSA, we know it was a cool attack vector with the best research-hours-to-mass-pwnage ratio). We investigate several TR-069 ACS platforms, and demonstrate multiple instances of poorly secured deployments, where we could have gained control over hundreds of thousands of devices. During the talk (pending patch availability), we will release exploits to vulnerabilities we discovered in ACS software, including RCEs on several platforms.
Доступные форматы для скачивания:
Скачать видео mp4
-
Информация по загрузке:
