mailing list archives
Re: Kewlhair Security Advisory --DSL ROUTERS
From: dknight () CSUCHICO EDU (Bret Piatt)
Date: Mon, 13 Mar 2000 07:47:47 -0800
You might want to do some further testing as I've found I'm able
to <A HREF="http://router.ip.address/<protected">http://router.ip.address/<protected</A> url> without authenticating.
It seems some of the <protected url> don't check to see if you are
authenticated it just assumes you won't know the <protected url>
path if you aren't and the only way it assumes to get there is
through the menus that will require authentication. I've
recommended to all my customers to go with a Cisco 1417 that you
can swap out for both the modem (in non-pppoe mode) and router
that SBC is installing. SBC is also looking at moving to the
Cisco products or offering them as an alternative so when you
look to get your DSL in the first place ask if they've made them
Bret Piatt - bpiatt () flash net/dknight () csuchico edu
Systems Engineer [CCNA/CCDA/MCP]
PacifiCom - (530) 342-8999
----- Original Message -----
From: "Andrew R. Siverly" <asiverly () KEWLHAIR COM>
To: <BUGTRAQ () SECURITYFOCUS COM>
Sent: Saturday, March 11, 2000 2:14 AM
Subject: Kewlhair Security Advisory --DSL ROUTERS
-----BEGIN PGP SIGNED MESSAGE-----
Kewlhair Security Advisory
Advisory Name: Router Passwords
Advisory Released: 03/09/00
Summary: An attacker can seize control of an SBC customer's router.
SBC is currently deploying the Cayman-DSL router to its DSL
customer's.(SBC communications being the parent company for
Southwestern Bell, Ameritech, Pacific Bell, Nevada Bell, Cellular
One, and a few more.) With this deployment SBC is neglecting to set
passwords on the router. Kewlhair has found over 300 of these
non-pass worded routers.
Telco engineers often fail to set passwords on DSL modems installed
Customer sites. The vulnerability affects many different DSL modems.
The Cayman product is especially vulnerable because it defaults to
having no Password at all.
As the Telco's does often not educate the customers, their modems are
left vulnerable to intrusion and denial of service events.
An individual with malicious intent could easy scan for these devices
on a DSL providers network, connect to them, and disable them without
significant effort. In addition, an intruder could disable access to
the device itself by installing a password (which only they would
A significant vulnerability is that these devices often can be set
Static routing tables so packets could be sent through an environment
where a malicious third party could monitor the traffic.
[ user () xxxx /user]# telnet xxx.xxx.xxx..xxx..
Connected to xxx.xxx.xxx.xxx.
Escape character is '^]'.
Terminal shell v1.0
Cayman-DSL Model 3220-H, DMT-ADSL (Alcatel) plus 4-port hub
Running GatorSurf version 5.3.0 (build R2)
( completed login: administrator level)
Someone writes a script that logs into every one of these routers
sets the passwords, then changes the ip or kills the interface so it
no longer works properly. Then causing and SBC engineer to come to
the home or place of business to fix this problem.
(I bet that would cost some bucks)
Mandate that the Telco engineers change the default passwords on the
devices at time of install, and provide literature to the consumer
advising them of the risks of DSL (or cable) connections to the
Set your password on your Cayman router.
How do I password protect the Cayman router?
Through the browser:
1. Browse into the Cayman router.
2. Click on the " Expert Mode" link.
3. A second of row of links will appear.
4. Then select the " Passwords" link.
Through a Telnet session:
1. First establish a telnet session to the unit or connect serially
to the console port at 9600 Baud.
2. At the prompt, type " configure" ( NOTE-all commands are typed
without quotes) and enter.
3. At this point you will be at the " top" prompt. Then type "
system" and enter.
4. Now you will be at the " system" prompt. Here you type," set
password" admin and enter.
5. You will then be prompted for the new password and then be
prompted to repeat the password. Once you have done this, you will be
back at the system prompt.
6. Here you will need to repeat the process, this time for the user
password, by doing the following steps:
7. Type, " set password user" and enter. Again you will then be
prompted for the
new password an then be prompted to repeat the password. Once this
is done, you will be at the " system" prompt again.
Here type," quit" , and you will be prompted, " Save modified
configuration data [y|n] ?" Type, " yes" and the router is now
NOTE- We recommend that the admin and user password be the same to
avoid confusion. This approach allows only the admin password to view
or change the settings.
asiverly () kewlhair com
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.2 for non-commercial use <http://www.pgp.com>
-----END PGP SIGNATURE-----