researcher accidentally finds 0-day affecting his entire internet service provider

This is truly one of the craziest scenarios I've ever seen. An API endpoint left wide open lets you hack anyone's router.

Thanks for letting me make this video Sam!

🛒 GREAT BOOKS FOR THE LOWEST LEVEL🛒

🔥🔥🔥 SOCIALS 🔥🔥🔥

[pele]

"If you think professionals are expensive, try hiring amateurs."

[wolfieboy]

'How did you bypass auth'
'Simple, do the request again'

[benheidemann]

For me, the 0-100 moment was from “oh, the swagger docs are in production” to “oh, I can call an API without being authenticated”

[AntVenom]

Just a heads up, towards the end of the video (27:19) you said you "think Cox fixed the issue within a month or two." Using the day/month/year calendar, that makes sense based on what this post has written, but I think this post had the date in a month/day/year format, suggesting the bug was hot fixed within a day of it being reported, not a month.

I can only imagine how many heart attacks this researcher nearly had from beginning to end of this story.

[evocorporation]

Cox once put corporate domains from an email whitelist (to allow them to send emails en masse) onto a blacklist, ensuring hundreds of firms cannot send emails to Cox users, then pretended those corporations are at fault. Those corporations are blocked to this day

[JeffreyMichaud]

I work for a Large ISP, we can push settings, pull settings, get train rates, see connected devices, i can bridge ports to WAN so I could expose anything plugged directly into our gateway directly to the public network, if you changed the passwords on the device I can force reset them, or even factory reset the whole device. If you care about your privacy and safety use your own router

[brawldude]

Bro went out and accidentally discovered another vulnerability after he got hacked via a different method 💀

[andreasguillot]

kudos to Cox for eventually opening a conversation with Sam.
the poor office worker must have been very confused. "this doomsday apocalypse guy claims to have found a way to hack all of us"

[Chickenbreadlp]

This reminds me of another story I read about a German ISP years ago, must've been at least 5 years ago.
The ISP in question (I believe it was Vodafone Germany, Unity Media or Kabel Deutschland; definetly one of these three) wasn't providing customers with the credentials necessary to use any router on their network (at the time they didn't had any legal obligation to do so, so they forced customers to use the rental routers).
So one of their customers didn't want that rental unit and instead wanted to use their own router, so they started digging in the rental router from their ISP to get it to spit out the network credentials. While doing so they found out that bypassing the rental router and getting direct access to the ISPs network also gave them direct access to a similar maintanance API, completely without any authentication requirements (after all, you wouldn't normally have completely free access to this part of the network). So it was fairly trivial for them to change any router from that ISPs network, just by using his own router.
Not only did the ISP fix that vulnerability quickly, it also sparked a big legal debate on whether or not it was legal for that ISP to demand usage of rental routers. The outcome was no and now everyone can use any router, even on the cable networks (which is now all Vodafone Germany)

[Jessie-blrm]

"they fixed the issue in a matter of a month or two, which is really really solid"

Was listening to the vid on the side when I heard this and stopped what I was doing to do a double-take.


This vid wasn't scripted so I might be a bit pedantic here but I did want to make one comment. It seem that it was fully *resolved* in a month or two, but the vulnerability itself was shut down less than 24h after it was reported.

That's honestly really cool they had that fast of a turnaround given how large Cox is. I've worked at enterprise companies in the past that brush security issues under the rug, so this is refreshing to see.

[Monotof]

The scary thing is that all the described stuff is really easy and very basic stuff. Its not something highly sophisticated or really obscure, the exploit just uses the most basic building blocks anyone who ever did anything in networking is familiar with.

[thfsilvab]

When I bought my own router, my ISP insisted on configuring it to be remotely accessed, I allowed them to configure it just because I was already pissed and disabled it right after, no no no, no ramdom person access here

[luisfarias]

bro could have easily just “lost” the router and paid for the missing equipment

[imrandom]

Thats why I'd never ever use any hardware provided by an ISP and obviously have all remote managing protocols disabled on the router I bought myself. Just the idea of anyone having access to my hardward would drive me crazy.

[MrRecorder]

That article reads a bit... like someone focused on the wrong thing:

"I wonder how they hacked my modem"...
[ 5 minutes later ] ...
"Darn, this is the inside of a national bank vault, I do not want to be here" ...
[ 5 minutes later ] ...
"hacked the addresses of 5 FBI offices... also not quite what I was after" ...
"nuclear launch codes" ...
mmmh...
"Ah here... this is it! Mr Router-company, please fix your software. I do not want my router to be hacked again, this is just such a nuisance!".

[MrZadeak]

As a fellow software developer who uses spring for backend development i can assure you that i forgot more than once to dissable swagger for prod env)

[privacyvalued]

This is why you should always have a router under your direct control in between your ISP's router and your internal network. And turn off your ISP router's WiFi radio. Your ISP then sees exactly one device on your network - a router that doubles as a firewall. Defense in depth starts with precise control over your home network.

[rhigrets]

Wow, makes you wonder how many smaller ISPs have similar vulnerabilities.

[devrim-oguz]

Would’ve been fun to rename all the FBI wireless networks to “You’ve been hacked” and watch the chaos that ensued 😂

[klti]

TR-069 is a loaded gun pre-pointed at every customers foot. All it needs is an ISP fucking up a little. But there is no way publicly traded ISPs will be cheap about software and security, right?