A few weeks ago, SecNews, in collaboration with P0wnbox , revealed that more than 2000 Greek Internet service users are vulnerable to data leakage.
In our SecNews investigation, we had indicated how an external attacker could extract passwords and e-mails of unsuspecting users. However, it appears that there are much more serious weaknesses in a large number of ADSL routers provided by Greek Internet Service Providers (ISPs).
The above is confirmed, in the most official way, by a study by the Department of Digital Systems of the University of Piraeus. According to the research carried out by the Systems Security Laboratory under Assoc. Prof. Christos Xenakis, it was found, among other things, that the ADSL Routers provided by telecommunications providers have a number of security weaknesses, without the slightest care being taken to “strengthen” them (hardening). In addition, they clearly recorded how the weaknesses found could potentially be used by malicious hackers and indicated the countermeasures that should be taken at the user and provider.
Among the providers whose ADSL routers were found to have vulnerabilities, are those ofthe company WIND, as we can see from the Screenshot feature. According to the study, the vulnerabilities identified have been PARTIALLY by the provider at the time of writing this article.
You can read the exceptionally complete study by the University of Piraeus , which is the work of Associate Professor Christos Xenakis and researchers Anastasios Stasinopoulos and Christopher Dantoyan below:
[gview file=”ADSL.Exploiting.pdf” save=”0″]
Following the publication of the study, SecNews had the honor of receiving an EXCLUSIVE interview with Associate Professor Mr. Christos Xenakis.
Mr. Christos Xenakis answered SecNews' questions clearly, providing details regarding both the operation of the Laboratory and the methodology they followed regarding their research.
Question: We would like you to tell us a few words about your department (relevant research interests, publications, etc.).
Answer:The scientific subject of Information and Communication Systems Security has, in recent years, emerged as an important branch of the sciences of Information Technology, Telecommunications and Digital Systems in general. The scientific, research and practical/applied interest in this subject is caused, on the one hand, by the widespread dissemination of information technologies in all areas of daily life, and on the other hand, by the increasing incidents of information insecurity that are the subject of management of these technologies.
At the Department of Digital Systems of the University of Piraeus, the subject of Information and Systems Security is taught at both undergraduate and postgraduate levels in a large number of courses, the largest of all the corresponding Departments of Greek Universities. Proof of the above is the successful operation, since 2009, of the specialized Postgraduate Program entitled Digital Systems Security as well as the Systems Security Laboratory, which serves educational and research needs in the following subjects:
- Digital systems security
- Information systems security
- Network security
- Critical infrastructure security
- Information security
The Systems Security Laboratory is staffed by 3 Professors,
– Socrates Katsikas, Professor,
– Kostas Lambrinoudakis, Associate Professor,
– Christos Xenakis, Associate Professor,
6 postdoctoral fellows, 15 doctoral candidates and 60 postgraduate students
Also, over the last five years, the members of the laboratory have published on the subject of Information and Systems Security:
- 13 Greek and foreign language books
- 16 chapters in collective volumes
- 34 articles in scientific journals
- 50 articles in scientific conferences
Question: Regarding the study you published, can what you mentioned be used by hackers against individuals or even ADSL lines of companies or public utility organizations?
Answer: Anyone using this specific ADSL router (ZTE ZXV10 H108L ADSL router) to access the internet is at immediate risk, not so much from external attackers (as remote access was recently disabled by the provider), but from internal attackers, who can easily bypass the device's authentication mechanism and perform malicious actions.
During our research, we developed an automated tool in python, called “ZTExploit” (https://github.com/stasinopoulos/ZTExploit) through which one can perform checks on their ZTE ZXV10 H108L ADSL router, in order to determine for themselves whether they are exposed to this specific attack or not, in order to take the appropriate countermeasures and ensure the correct, secure and smooth operation of their network.
The methodology we followed to find the security gap is as follows: by exploiting a vulnerability found in the “Diagnosis” function of the ADSL Router “ZTE ZXV10 H108L”, we were able to execute commands on the device (without this having been foreseen by the manufacturer), resulting in the ability to gain unauthorized access to the device via the FTP protocol.
Once access was gained, we were able to read all the files inside the router. In one of these files, the password for a hidden “root” account was found in plain text (unencrypted), which unlocked additional features on the router (e.g. enabling additional services such as Telnet, etc.).
Question: What can an external attacker achieve using the methodology you identified?
Answer: An external attacker using the methodology we developed could launch a large-scale attack.
Specifically, after first collecting several IP addresses of the specific ISP through an automated attack, he was then able to gain unauthorized remote access (via the open port 8083), using the password of the hidden “root” account. At this point, the malicious user has the following options to complete his attack:
- It could perform a DNS hijacking. That is, the attacker could replace the IP address of the ADSL router's DNS server with the IP address of a fake DNS server, which is under the attacker's control. That is, it could perform an effective phishing attack, which would be very difficult to detect by an average user.
- The attacker could insert a snifferto monitor the user's Internet traffic. He could also use the router to perform a distributed denial of service attack, using a large number of ADSL routers in the attacker's possession.
- Finally, by exploiting a stored XSS found in the router interface, the attacker is able to force the user to execute malicious java applets without their consent. This would allow the attacker to gain access to the user's personal computer as well as other devices/computers located on the ADSL router's local network.
Note: It is worth mentioning that remote access (via port 8083) has now been disabled by the provider. However, the vulnerabilities (and therefore the attack) unfortunately still exist but only locally now.
Question: Are there ways or countermeasures that telecommunications service providers should take to protect themselves from this vulnerability?
Answer: As the administration panel interface of ADSL routers is usually implemented with web technologies (e.g. HTML, Javascript, Perl-CGI), ADSL routers inherit the security problems that other web applications have due to programming errors.
We believe that ADSL router interface developers should adhere to some well-known security measures in order to enhance their security:
- HTTP communication between the user and the ADSL router must be secured with the SSL protocol, in order to provide confidentiality to the messages.
- There should be validation and filtering of data coming from insecure sources, such as data entered by the user, in order to protect the application from code injection attacks (XSS, CSRF, etc.).
- Additionally, encrypted session negotiations must be used to avoid session hijacking attacks.
- Sensitive information on the ADSL router (e.g. passwords) should be stored in an encrypted database and not in plain text files.
- Finally, frequent, systematic and continuous security checks should be performed on devices that are in the production process, both at the application level (firmware) and at the device level (hardware).
Question: What is your opinion on hackers? How do they contribute to research and increasing the security of information infrastructures?
Answer: Hackers have the specialized knowledge to be able to assess the security level of an information system. The purpose of this assessment is to find weaknesses and vulnerabilities in the information system before malicious users, in order to cover the security gaps. The logic is similar to the idea of the phrase: “If you want peace, prepare for war”. Accordingly, hackers shield information infrastructures, so that when they are attacked, their security is not violated. It is worth noting that a hacker, in addition to the necessary knowledge, also possesses the appropriate characteristics required to achieve his goal, such as methodicality, patience and perseverance.
However, there are cases where some hackers use their knowledge for malicious purposes. The motivations behind such malicious acts are either economic or socio-political. It is clear, therefore, that it is a matter of education for hackers to assume their responsibilities and realize that they must use their knowledge for the general good of society.
SecNews's opinion:
Once again, we note the particularly high level of Greek researchers and academics, which gives them the opportunity to distinguish themselves in their field of activity (in this case, in the security of information systems). We were particularly impressed by the ethos and modesty of these researchers and academics. The important thing is that although people who are recognized in their field are at the same time particularly modest, working quietly and methodically, caring only for the essence and for the work produced, with only personal sacrifices. In Greece, in the deep economic crisis, it seems that only the ethos of some academics but also the constant engagement can offer a way out and hope for the future. As long as you do not discredit, as usual, the “uneducated” and “uneducated” political leaders, who usually deprive the University community of support and resources.
The editorial team congratulates the Department of Digital Systems of the University of Piraeus and specifically Christos Xenakis, Anastasios Stasinopoulos and Christoforos Dantoyan.
Furthermore, we would like to personally thank Associate Professor Mr. Christos Xenakis for granting us the EXCLUSIVE and highly analytical interview.
