Adventures & Findings in ISP Hacking
summary
Local ISP control plane is reachable from the customer WAN by adding addresses on 192.168/10/172.16 space and reveals routers, switches and services (SNMP, NTP, telnet, web) with default or plaintext admin creds and dumped configs, allowing reverse DNS to map physical sites and SPI-flash MAC cloning for account impersonation. A GPON modem yields UART access, a 128 MB NAND is read over serial in 15.5 hours, MD5 password hashes and a magic SysRq root shell appear, ping/web command injection gives root execution, disclosure leads to fixes and five CVEs issued—overall control plane exposed.
AI-written summary · about
chapters (6)
- 0:00Introduction and speaker intro
- 1:04First ISP vulnerability discovery
- 8:46Sonic ISP device analysis
- 13:43Root access via UART and firmware dump
- 20:22Control plane access and disclosure
- 23:51Takeaways and impact summary
related talks
41mDon’t Trash It, Hack It: Reverse Engineering Secrets & Re-purposing ISP Routers
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
39mWho put the backdoor in my modem?
38mModems (and telecoms) are also not as secure - 6 0-days to 4 million modems within a week
45mOutside the box: pwning IoT devices through their applications
30mNetwork Technocracy: A Tale of Monitoring, Spoofing, Intercepting and Social Engineering
38m"Breaking Extreme Networks WingOS: How to own millions of..."
44mExposing Critical Threats In Millions Of Connected Devices