Who put the backdoor in my modem?
summary
Finds a clear-text backdoor flag inside router .bin configuration files that flips a normal account into a backdoor account, with the web UI serving different pages by priority; recovers persistent ISP firmware defaults (example: gbg112245) and passwords derived from MAC last octets. Performs memory dumps showing hidden redirect code and builds a simple shell scanner that finds hundreds of devices exposed to the Internet, logs accessible credentials, and demonstrates creating dynamic DNS entries using compromised routers (no botnet creation).
AI-written summary · about
chapters (37)
- 0:00Introduction
- 1:29About me
- 2:00Background
- 2:40Backdoor
- 3:04Backdoors
- 7:02Hardware
- 7:40Stickers
- 8:39Brazil
- 9:19Vendors
- 10:17Google
- 10:45Zoom
- 11:20Not this company
- 12:48It is related with this
- 13:27This is another one
- 14:00Observer Telecom
- 14:48Internet Service Provider
- 16:31TPLink
- 17:35Password
- 18:16Iroko
- 19:00El Cajon
- 19:17MAC address
- 20:03Cotech
- 20:49Back door
- 23:33Memory
- 25:04Passwords
- 25:47Pages
- 26:30Username Password
- 27:39Device Exposure
- 28:25Device Testing
- 29:02IP Address
- 29:30Dynamic DNS
- 30:03Observer Telecom website
- 30:28Observer Telecom logo
- 30:44Emails
- 31:15How to fix
- 32:11Considerations
- 33:13My question
related talks
25mAdventures & Findings in ISP Hacking
41mDon’t Trash It, Hack It: Reverse Engineering Secrets & Re-purposing ISP Routers
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
25mAttacking Mobile Broadband Modems Like a Criminal Would
45mOutside the box: pwning IoT devices through their applications
01h 06mComputrace Backdoor Revisited
38mModems (and telecoms) are also not as secure - 6 0-days to 4 million modems within a week
01h 06mBackdoors in Back Doors