[Music]
all right so we're going to have to go
old school on some stuff because aiio
decided not to work for us today which
is great um I'm just going to move this
out of the way real quick here and uh
we'll get
started all right good on my side all
right
cool so uh yep there we go that's
probably where we want to be so the
reason why you guys are all here
exposing the threat under undercovering
the hidden risk to C
security uh so we're going to go over uh
a little bit about who I
am uh there we
go that is obviously out of place that's
cool all right so I'm a senior Eng a
Senior Systems engineer with over 12
years of experience in implementation
and Consulting I have previously worked
as a network engineer for small in the
Milwaukee area I enjoy disassembling and
uh studying technology to gain a deeper
understanding of how things work um I
tend to wait till the last minute to do
things uh so if this talk is all over
the place uh that's the reason
why so first and foremost we're going to
go over some legal dis the legal
disclaimers everything in this uh this
presentation is uh basically for
educational purpose purp only and uh all
testing was done with privately owned
Hardware it's worth noting that the
information presented applies to Major
isps
worldwide so we're going to go over a
couple of things uh we're going to
explore potential vulnerabilities and
discuss what you can do to address them
we're going to talk about how cable
modelings work and apparently my stuff
is out order but that's okay cuz you
know like I said last minute uh you also
trust that your ISP is protecting you uh
so we're going to take a little bit
closer look at that and uh we're just
going to kind of give you guys a quick
overview of what the uh cable uh plant
looks like from the headend uh you're
going to have a satellite signal uh
coming in from various sources it's
going to go into a combiner
slitter you're going to have a cmts that
stands for the cable mem termination
system uh that is the thing that your
cable modem connects to when you turn it
on uh there's going to be a video
headend there's going to be internet
services there's going to be management
networks uh there's be a time of day
server a tftp server uh that's important
I'll go over some of that a little bit
later uh some local servers and uh local
programming uh a lot of carriers will
have a variation of uh you know uh local
links that they Ed from local TV
stations uh from there uh it goes over
coax through a fiber node uh typically
they consider that the hfc network I
don't remember what hfc stands for off
the top of my head so uh
sorry it is what it is
thank
you uh so at the home you're going to
have a RF uh Network that comes in
you're going to have a cable model
you're going have computers and
television uh stvs which basically are
the devices that will receive your uh TV
signal uh that's how we're going to go
over on that slide so we're going to go
over a quick overview of how cable mod
Works uh this is not definitely not the
extensive list uh but it's presented
here for the sake of Simplicity the
cable modum turns on it will search for
a quam signal it will locate the
Upstream
signal the modem will send a DHCP
request the headend will send a DHCP
response along with the tftp server and
the configuration file for the modem to
download Once the modem connects to the
tftp server and downloads the
configuration file it will determine if
BPI mode is enabled uh that is basically
the quote unquote privacy of your device
when it comes to the internet of how
they essentially uh protect you we're
going to go into that in just a couple
seconds uh assuming that the key
exchange is successful and the network
access equals one which is a
configuration file setting the device
will be connected to the
internet so BPI Baseline
privacy it follows cable mem
registration is as I said before is for
privacy uh it encrypts traffic flows
upstream and downstream providing user
data privacy go into that in a second
provides a cable operator with basic
protection of um theft of
service it incorporates authentication
mechanisms for both the cable modem to
the cmts and from the cmts to the cable
model it includes key distribution for
and and traffic keys for and and
timelines so the uh modem will
essentially uh redo its handshakes uh
when when it needs
to it uses 56-bit
desks as I was
saying um new DSis uh 3.0 and 3.1 AES is
128bit
available and according to the RFC 56
pick Des must be supported so uh most
isps will use 56-bit desk because why
bother they don't
care
anyway so we'll move over to the
configuration file a little
bit uh it controls a whole bunch of
things uh there is a string that allows
remote access uh via SNMP the simple
Network management protocol uh there'll
be usernames passwords for tnet SSH HTTP
assuming that they are enabled uh please
understand that the configuration file
doesn't always uh control this uh it
also does use
tr69 um the just a different method of
uh sending data down to devices out of
band uh it will control things like
speed and
bandwidth it will support things like
qos assuming this ISP supports
it it also will give you options to
update software so if your device is out
of date they will push down a uh
basically a software configuration
package down to your modem
remotely it deals with IP based
firewalls and Port
blocking uh encryption as I mentioned
just a couple seconds ago uh Network
status rather access to the model can
access the network or
not um along with a whole bunch of other
things that we are not going to get into
in this particular
talk so what is tr69 well that's the
technical report 69 it is a technical
specification that defines the
application layer for Remote Management
of end user
devices I'm not going to go into too
much on that it's just a way of managing
the device remotely uh out of band from
uh
basically the headend um there's some
Wikipedia stuff there if you feel like
you want to look into it further so this
is cool but what does it actually
mean well there are numerous
possibilities available if you have the
right information and through thorough
research and analyzing data you'll find
sort of interesting stuff that you can
look at and what I mean by that well it
may surprise you to know that even
seemingly secure devices can be
vulnerable to attacks let's consider an
all cable modem for an example that you
might have in your
house it's possible to retrieve clear
text passwords the wireless passwords of
these devices remotely in plain text it
is Poss and how you might ask it's it
can be done via a simple SNMP walk
against the device it's all it takes it
it is not secured at
all with this method you can it is
possible to obain much more information
than just a wireless password uh is also
potentially reveal a lot of data about
the device the network and the targets
that are on top of that Network as
well it's also worth noting that this
method isn't fullprof and some loads May
more secure than others it all depends
on the ISP and how much time they've
actually went in to worry about trying
to secure
it um it's also important to be aware of
how potential vulnerabilities uh that
yourself you can do to try to protect
yourself against these sort of potential
attacks throughout the rest of the
presentation we'll cover other potential
access methods and security risks
associated with the modem as well as uh
discussion ways to mitigate some of
these risks and to try to keeping your
device as secure as you
can't so as I was saying uh if you send
a s simple SNMP walk uh to a particular
device at a particular oid which is how
you talk to these things over SNMP it
will literally give you the uh SSID and
the password of the device remotely in
plain
text
so that's kind of cool but what does
that actually give you well that's where
wiggle. net comes into play so you can
figure physically locate where that
device is in the world now mind you um
it doesn't always uh give you exactly
what you're looking for uh but if you
know first you know where the device is
physically located and you have the
person's password well you got free
internet now so that's kind of
cool so as I was saying before we have
free Wi-Fi and because you know isps and
installers have particular habits when
it comes to passwords you probably have
their phone number too because for the
most part these CS will have the
person's phone number as their
passwords so let's not try some stuff at
home here
but we can uh as I was saying before we
picked up the wireless SS ID the
password the person's person personal
phone number uh which you can do all
sorts of uh nasty things with but
wouldn't it be cool if you could
intercept all traffic as well over the
Internet because you know that'd be
fun
well we have four ways of doing it first
we can log into the web interface of the
modem remotely um you can find how to
get that in the next couple of slides
here uh second you can do it via SNMP uh
however uh some cases it may not
feasible or possible it all depends on
firewall rules of the local device as if
it's actually going to happen or not
third you can log into the device over
SSH for further access and last but not
least because these things are so
insecure you can loging over tnet
because you know tet's secure
right so let's go over SNMP a little bit
uh we don't have the oid that's
perfectly fine uh we can just tell it to
give us everything by doing an snnp
walk uh doing an snn pwalk on the
Enterprise uh you know um oid structure
will give us um all The Nasty beautiful
things in plain tax for usernames and
passwords for everything across the
board so if you want the tnet well cool
MSO user and and password is the
username and password login to that
particular device um as you can clearly
see even the user passwords are open are
open to plain text U underneath the user
side of the house you can see the
password in this particular case is
password uh but even if the user sets it
to something that they have no idea what
it is uh you can you can look it up
remotely and say okay give me your
password and it says okay here it is no
problem I'll in plain text it's
great but as I was saying before we're
more interested in being able to take
all their traffic over the Internet so
how about we decide to set their DNS
servers because that's
fun or sting it via snnp because you can
do that
too because that's also bad
right
um
so what if you don't have HTTP access uh
or you don't have access to uh you know
basically SNP at all uh and how can you
determine what to scan considering isps
usually have unique networks well Eris
is your friend they come back and give
you all the data for you if you want to
look for things you just have to ask it
hey where is
it and typically speaking they'll come
back and give you the CER range the
handles who to talk to uh who you know
you don't want to talk to uh where the
abuse information is and
Etc um doesn't always work uh some of
the hfc networks are all private and in
that case you just have to scan it
yourself and figure it
out most of them are that way uh some
carriers are not that
way so what if you uh don't have SNMP
access well these things were in Linux
now guys so just log in Via
TTL uh I will say that this is not
always the
easiest uh and what I mean by that if
you look here on the right hand side
you'll see that that is the TX and RX on
top of the CPU you physically have to
destroy the CPU partially without
throwing traces away to get access to
the TTL
cables um and if you think that's too
hard uh just
wait you can always desolder the chip uh
typically oh that's funny um it's
supposed to be SPI not sip that's okay
and then and grab the data directly so
you can do that through this r as you
can clearly see these things are tiny
that that's a dime for
reference which is great you can find
all sorts of interesting information in
these things as well but uh that's not
what this talk is about right now I can
also see that I am way flying through
these but that's
cool um if you haven't gained access to
the modem don't worry most of the mems
at this point will run a HTTP server
locally uh if you do a request to
1921681001 uh provide ided the um device
is on the same network you'll be able to
access that device you can retrieve
things such as the SSID the password the
wireless network um and you can also you
know log into the device and try to gain
access to it with appropriate tools to
identify relevant other devices on the
network and retrieve
data um I can clearly see that I have uh
totally put some slides out of order uh
this is going back to uh making a wild
card uh Zone for DNS uh because you know
we're going to install SSL strip on it
because you might as well just decode
everything that exists out there and I
think you guys kind of had an idea where
this is uh
going so as I was saying uh most of
these modems run Linux uh you have
access to SSH SNMP web interface or TTL
AKA counil all is necessary to log in is
uh you know the logins and passwords
which we just stole from the cable mod
the itself because it said oh here it is
no
problem and apparently I put this slide
back in again as I was saying I was
doing this last second and I'm
sorry all right so cool so we have the
wiress name the wireless password the
modem username the modem password all
the customers traffic and the uh phone
the person's uh personal phone number CU
well um is what it
is uh we also have uh most usernames
passwords for all the local devices
because well it's access to
everything so what can you do to prevent
it well obviously uh for the average
user don't use all- inone cable modems
throw those damn things away and buy
yourself your own your own
router uh for the more text tby users um
they can log into the mem and try to
disable you know the SNMP the web
interface and tet uh be aware that
hacking is going to be required in order
to do that it's it's not going to say
hey I can just turn this off and
everything's happy doesn't work that way
uh skilled programmers they can create
custom firmware with overrides to uh
tell the device to do things that are
not designed to do or to tell it that
hey I don't want this stuff to actually
start or if you really want to you can
just uh download the uh open source
firmware and uh customize it to your
best uh you know whatever you guys want
to do with it it's
great oh okay so we also have some more
prevention stuff again uh changing
default passwords it doesn't help it'll
just tell you what the things are it
does not matter uh disabl unused
features on your device well again you
have to be able to hack it in in order
to turn it off so uh good luck with that
as well um as you can clearly see uh
this particular slide was generated by G
GPT chat so uh a lot of it doesn't
apply uh you secure uh protocols such as
htps when accessing web interfaces while
that's true uh there's still ways of
bypassing that as well uh be wary of any
unsuspicious activity or network yeah
you're not going to even know that this
is even occurring so that doesn't apply
either and uh consider additional
security measures such as using
firewalls or vpns that is not a bad
problem to have uh using vpn's outside
is still a good method uh to try
securing your
devices uh that all being said uh we're
going to go into some more nefarious uh
aspects of the house because at this
point we just got data uh this is all
can be used for nefarious purposes for
impersonating ISP and threaten a user
with disconnection from their services
unless payments are made because this is
fun right we're going to we're going to
go after credit card data
too uh we can use SNMP to do this we can
remotely reboot their
devices uh I also want to make sure that
I reiterate this that you should never
perform these actions details provider
for strictly educational purposes only
in any event you receive a call from ISP
get their technical ID terminate that
that call and contact them back
generously uh be aware that things like
Stingray and other ways of intercepting
that voice traffic are possible so
that's not necessarily A fo a full a
foolproof
way so uh we're going to go into the
first demo and I'm going to go and
temporarily turn his mic off and I got
to do things the hard
way back
on
so as you can see here
particular online all right well I'm
just going to go and halfhazard Le uh
you can clearly see uh or not that this
device is reply uh replying to icmp
requests we're going to do an SNMP set
remotely and you can see now that this
device is no longer online we just told
this device that hey reboot and you can
essentially just continuously do the
same thing over and over over and over
again until uh basically you're creating
yourself a denial service attack against
the Remote device and you're just using
the device is built-in features to do it
it's
great um in a couple seconds when I hit
the refresh here on the query button uh
you'll be able to see that uh the modem
goes from online to uh offline and then
you'll also see that icmp requests start
to reply back again um I am going to
make this Qui quick mention that when
the device does turn online uh icmp will
will start replying and then eventually
stop and then start up again uh that is
it switching from the normal n
protection mode into some protection
mode and uh there you go so we can see
now well you probably can't CU it's too
small um it's offline now and then a
couple seconds from now you going see
that it's going to come back online you
can see that it's responding to Ping
again it's going to go and change over
to BPI
mode which is why it's dropping out now
and it's uh just in the process here of
coming back online and essentially you
can just do the same thing over and over
and over again it's great so you just
create yourself a denial of service
attack and uh basically force that user
to pay you with her credit card it's
great um this is going to be a problem
when I go to the other video but that's
okay so I'm just going to skip over that
so whatever things are possible on the
cable mum side of the house while
skilled hackers can duplicate your
device online basically providing them
complete control of your online identity
and actions so what I mean by that is
any activities that they do they appear
to be from your account this includes
thing illegal things with little
consequences to the person who's
actually doing it so if they want to
become you all they have to do is steal
the the identifying information of that
cable modem and essentially you can
become that person
online um ISP do have a method of
matching Mac addresses to an IP address
um they have to be court ordered um the
the process is mandated by the 2007 FCC
CPI order which is designed to protect
customer data ensuring isps follow
appropriate protocols for identifying
and tracking suspicious activity in
their networks um the reality is when
the these things uh turn on and they
happen it's not always the case um
it's there's very little risk to the to
the hacker for if they were going to go
take your your credentials from your
modem that there's not much that they
can do at all to help deal with it so we
can go off the deep end if we're not
deep enough we can go further um and I'm
going to have to see what happens here
um I'm going move that aside for a
second and I'm to go turn this off
[Music]
again see if we can
[Music]
not going to work at
all1 all right well um basically I'm
going to go and semi- narrate this
because there's no audio that's going to
come through on this either that's okay
though uh basically uh somebody uh
called basically saying that he was
going to basically kill his wife in this
particular case and then they asked how
they kill her and basically said I shot
her and uh basically SWAT was sent out
to this person's house and uh he was
essentially uh handcuffed and at
gunpo um and you can see that this is
not a this is a reoccurring thing this
is not just a one-time thing um I'm not
going to go too much into it um I will
state that the next clip um is what they
consider their worst case scenario uh
somebody makes a bogus claim not this
one the next one after this that
basically says that um you know there's
a swatting incident and the guy gets
shot and he he died from it is it's not
something that you know it's not it's
there is life and death in some cases
that actually matters uh this particular
gentleman uh called him bomb bomb squad
threats against schools he made a
dedicated channel in Discord to do
it 935 yeah find you know to find disarm
the bombs it's and then basically he
laughs and everybody ex you know goes
out of the school and he has access to
the close caption systems because the
the stuff's not secure and uh it's
it's it's actually a really big
issue um I'm not going to talk really
anything about the actual swatting side
of the house um just know that the VoIP
on your modems are not secure either um
they're actually very
easy uh to essentially clone a MTA Mac
address and have it come through yeah
and as I was going to say here um you
can this this particular case that
gentleman got shot by the police and he
was unable to survive they all it is a
really big
problem um because we don't have audio
that's
fine wow I am really flying through this
oh well that's fine we got more question
question for Q&A okay so uh perspective
role playing uh from the customer
perspective uh protect and respect our
privacy um you should provide us with
quantity not limited Service uh you
should stop charging us more when they
failed from a hacker's perspective uh
you might expect this because we want to
know how it works that was way too easy
did you do that on purpose it's your
fault the network is not configured
properly um it's also your fault the
manufactur equipment wasn't configured
properly and you always have a problem
uh there is no such thing as a method of
a completely secure device uh from the
ISP perspective they're just going to
lie they're going to cut Corners to save
money uh a limited bandwidth equals bad
that's always more about profit uh they
say that you can't do things on the
internet well guess what most of the
time people do and they can and your
information is tyly being sold to the
highest bter that is slowly changing
thanks to the CCPA and the gdpr uh side
of the house
and uh with that if you don't like it
well guess what you don't have a choice
there's only one
provider um and I totally threw through
this because I got basically Q&A and
that's all I got left so unfortunately
this was supposed to be an hour long and
I only had 30 minutes of uh material so
I guess at this point I'm going to do
Q&A and we'll go from there was it at
least
useful yeah okay um I also am going to
say uh feel free to stop by the ISP
hacking Village if you want to play with
this stuff and try to learn more on your
own um again I'm sorry this was only a
30 minute
talk I needed at least another uh 30
slides
oops EXC yes go ahead as
as um it can use
most of the most of the devices don't
care so they do have a private and they
do have you know a public uh you know
SNMP string uh most of these devices
will reply one way or the other um I do
I will tell you for the most part if
you're playing with the Enterprise you
want to set something setting it is
different than reading it if you if you
want to set it you're going to need the
the private side of the house uh that
said uh the private side of the house is
actually inside the configuration file
anyways so you just download the file
and it'll just tell you what the
password is so it really does not matter
[Music]
yes I'm sorry I can't hear
you
theed side
and um sometimes it all depends on how
it's set up but for the most part it's
always accessible on the hfc side of the
house uh which is how they talk to the
devices from the head out this is the
one I'm going to go this is the one
everybody
anything
else all right now call that is
[Applause]
good