Researcher Uncovers Flaws in Cox Modems, Potentially Impacting Millions

Now-patched authorization bypass issues impacting Cox modems that could have been abused as a commencing place to achieve unauthorized access to the gadgets and operate malicious commands.

“This sequence of vulnerabilities shown a way in which a entirely exterior attacker with no prerequisites could’ve executed commands and modified the configurations of hundreds of thousands of modems, accessed any organization customer’s PII, and gained primarily the same permissions of an ISP guidance team,” security researcher Sam Curry explained in a new report posted today.

Following dependable disclosure on March 4, 2024, the authorization bypass issues ended up tackled by the U.S. broadband service provider within just 24 several hours. There is no evidence that these shortcomings have been exploited in the wild.

“I was definitely stunned by the seemingly limitless entry that ISPs had guiding the scenes to shopper gadgets,” Curry informed The Hacker Information via email.

“It will make sense in retrospect that an ISP need to be capable to remotely manage these units, but there is an whole inside infrastructure designed by businesses like Xfinity that bridges consumer products to externally uncovered APIs. If an attacker uncovered vulnerabilities in these methods, they could possibly compromise hundreds of millions of products.”

Curry et al have formerly disclosed various vulnerabilities influencing millions of autos from 16 various companies that could be exploited to unlock, begin, and observe autos. Subsequent exploration also unearthed security flaws in just factors.com that could have been utilised by an attacker to access buyer details and even attain permissions to issue, regulate, and transfer rewards factors.

The starting off issue of the most up-to-date investigate goes back again to the reality that Cox help agents have the capability to remotely regulate and update the device options, this kind of as transforming the Wi-Fi password and viewing connected products, making use of the TR-069 protocol.

Curry’s examination of the underlying mechanism discovered about 700 uncovered API endpoints, some of which could be exploited to achieve administrative operation and operate unauthorized instructions by weaponizing the permission issues and replaying the HTTP requests consistently.

This incorporates a “profilesearch” endpoint that could be exploited to lookup for a client and retrieve their organization account particulars working with only their title by replaying the ask for a few of periods, fetch the MAC addresses of the related components on their account, and even access and modify organization consumer accounts.

Even much more troublingly, the research located that it really is possible to overwrite a customer’s machine options assuming they are in possession of a cryptographic mystery which is expected when dealing with components modification requests, employing it to ultimately reset and reboot the system.

“This intended that an attacker could have accessed this API to overwrite configuration configurations, access the router, and execute instructions on the unit,”

In a hypothetical attack situation, a risk actor could have abused these APIs to lookup a Cox consumer, get their comprehensive account aspects, query their hardware MAC tackle to retrieve Wi-Fi passwords and connected equipment, and operate arbitrary instructions to choose over the accounts.

“This issue was probably introduced due to the complexities around handling client products like routers and modems,” Curry explained.

“Creating a Relaxation API that can universally discuss to probably hundreds of different designs of modems and routers is truly complicated. If they had found the have to have for this initially, they could’ve designed in a improved authorization mechanism that wouldn’t count on a single interior protocol getting entry to so quite a few devices. They have a super challenging dilemma to fix.”

Observed this posting interesting? Comply with us on Twitter  and LinkedIn to read through a lot more special articles we write-up.

Some parts of this article are sourced from:
thehackernews.com