bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Wednesday: Meta annoys AR developers, security hole at internet providers

Summary

Alongside Meta ending third-party AR effects and the Polaris Dawn launch, heise’s news round-up of 28 August 2024 reported an attack on internet providers. An unpatched hole in the network software Versa Director (CVE-2024-39717) was used to gain a foothold in at least four ISPs. There the attackers intercepted customer credentials in plain text before they were stored hashed; Lumen attributed the attack to the Chinese group Volt Typhoon.

Ideas

  • Attackers first broke into customer routers and then into the providers themselves.
  • Passwords were captured before hash protection could take effect.
  • A known hole that had not been closed everywhere was enough as a way in.
  • State-sponsored groups target infrastructure, not individuals.

Insights

  • Hashing does not protect if attackers read passwords before they are hashed.
  • Network management software is a high-value target because it touches many customers at once.

Facts

  • At least three ISPs in the USA and one outside were affected.
  • Meta closed its AR platform Spark to third parties on 14 January 2025.

References

Critique

  • As a round-up, the text deals with the security incident only briefly and without technical details on the hole.

Recommendations

  • Where possible, use second factors for provider access so that intercepted passwords alone are not enough.
  • Prioritise updates for management software that manages many customers or sites.

Read the original article

Search the Web Archive

hß · 2014

TR-069 remote maintenance hole in DSL routers: German internet providers call their networks secure

After Shahar Tal’s DEF CON talk about holes in TR-069 remote maintenance servers, heise asked German providers in 2014 how they were protected. Telekom, Vodafone, 1&1 and others considered their networks secure because their routers reject self-signed certificates or only contact preset servers. Tal had shown that a hijacked Auto Configuration Server can redirect or read out thousands of routers.

hß · 2007

DoS hole in Cisco IOS endangers internet providers’ routers [Update]

In 2007 a DoS hole in Cisco’s IOS allowed routers to be forced to restart via the command “show ip bgp regexp” with certain regular expressions. Many providers offered such commands publicly via telnet route servers or looking glass websites; repeated restarts could cause other networks to ignore the provider’s routes. As a workaround, providers filtered the expressions or blocked the command, and Cisco recommended the “Deterministic Regular Expression Engine”.

hß · 2007

Critical hole in Norton AntiVirus and Internet Security

In 2007 Symantec reported critical holes in Norton AntiVirus 2006, Norton Internet Security and SystemWorks through which a prepared website could take over a Windows PC. The cause was two ActiveX controls in NAVCOMUI.DLL that processed certain objects incorrectly. The updates were already being distributed via LiveUpdate, and the enterprise products were not affected.