Chair of Network Architectures and Services Department of Informatics Technical University of Munich Security of CPE Management Protocols Patrick Sattler, B. Sc. Advisor: Oliver Gasser, M. Sc. April 20, 2017 Chair of Network Architectures and Services Department of Informatics Technical University of Munich
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Contents Motivation Network Management Protocols TR-069 Architecture and Specification Threat Model Known Attacks and Incidents Bibliography P . Sattler – Security of CPE Management Protocols 2
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Motivation • Easy remote configuration • ISPs use these protocols for CPEs • Little research on its security • Recent discovered vulnerabilities • DTAG incident P . Sattler – Security of CPE Management Protocols 3
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Network Management Protocols Main Functionalities • Configuration Management • Performance Management • Fault Management • Security Management • Accounting Management P . Sattler – Security of CPE Management Protocols 4
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Network Management Protocols • Simple Network Management Protocol • v1 published in 1988 (RFC 1067) • De-facto standard for LAN network management • Only v3 provides optional secure communication and authentication • Transport protocol: UDP • Common Management Information Protocol (CMIP) • Alternative to SNMP • Standardized in 1991; Predecessor of TR-069 • TR-069 — CPE WAN Management Protocol (CWMP) • Specified in TR-069 [1] by the Broadband Forum • De-facto standard for ISPs network management • Transport protocol: TCP • SSL/TLS is optional, authentication is required • RPC with SOAP over HTTP P . Sattler – Security of CPE Management Protocols 5
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Network Management Protocols • NETCONF • Standard proposed by IETF in 2006 (RFC 4741) • RPC with XML (YANG) over TLS/SSH • Secure communication is required • Any connection oriented protocol allowed • RESTCONF • Successor of NETCONF • Uses RESTful paradigms • RPC with JSON (YANG) over HTTP over TLS P . Sattler – Security of CPE Management Protocols 6
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Why focus on TR-069? • 2nd most open port: TCP/7547 (TR-069 default port) [2] • 46M IP addresses at last scan (April 5th, 2017) • Few research available [3] P . Sattler – Security of CPE Management Protocols 7
Chair of Network Architectures and Services Department of Informatics Technical University of Munich TR-069 Protocol Stack RPC SOAP HTTP SSL/TLS SSL/TLS TCP/IP Figure 1: TR-069 Protocol Stack P . Sattler – Security of CPE Management Protocols 8
Chair of Network Architectures and Services Department of Informatics Technical University of Munich TR-069 Architecture • Auto-Configuration Server (ACS) → the Controller • Normally one per provider • Gets configuration and commands from other infrastructure • CPEs → the managed devices • Either preconfigured ACS URLs or ACS discovery • CPE initiates all sessions to ACS • ACS can trigger session initiation (Connection Request) P . Sattler – Security of CPE Management Protocols 9
Chair of Network Architectures and Services Department of Informatics Technical University of Munich TR-069 Architecture Different Databases e.g. Policy, Billing, ... CPE Management Manged LAN devices ACS CPE Call Center P . Sattler – Security of CPE Management Protocols 10
Chair of Network Architectures and Services Department of Informatics Technical University of Munich TR-069 Functionalities • Discover all available device functions (RPC calls) • Get and Set configuration data ( e.g., provisioning) • Get devices status data • Perform measurement and diagnosis • Download and update Soft-Firmware P . Sattler – Security of CPE Management Protocols 11
Chair of Network Architectures and Services Department of Informatics Technical University of Munich TR-069 Session CPE ACS establish TCP Connection optional SSL handshake Inform Request HTTP POST Inform Response HTTP Response Empty Request HTTP POST Get/Set Values Request HTTP Response Get/Set Values Response HTTP POST Empty Response HTTP Response Connection Teardown Figure 3: A session example for TR-069 P . Sattler – Security of CPE Management Protocols 12
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Threat Model • SSL/TLS • Usage of SSL/TLS is only suggested • TLS 1.2 is suggested for TR-069 1.4 • SSL 3.0 and TLS 1.0 support is required • SSL/TLS downgrade required (SCSV was standardized only in 2015) • Without TLS: • No confidentiality, authenticity, and data integrity • Every message can be eavesdropped, forged, modified, and re- played P . Sattler – Security of CPE Management Protocols 13
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Threat Model • Mandatory to support old protocol versions (all back to 1.0 from 2006) • No checksum control for downloads (also firmware updates!) • Download server could be compromised • DNS hijacking to point to the attacker’s server • ACS is single point of failure P . Sattler – Security of CPE Management Protocols 14
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Known Attacks ACS vulnerabilities • Exploit ACS = ISP fleet takeover • Tal et al. [3] graded ACS vendors age as from the 90s • Analyzed OpenACS ( Java ) and GenieACS ( node.js ) • RCE on both after 3 day analysis • Authentication bypass, SQL injection, RCE, and DoS vulnerability on ACS from undisclosed vendor • Proof of concept on real providers ACS with 500k connected de- vices P . Sattler – Security of CPE Management Protocols 15
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Known Attacks CPE vulnerabilities • Attack SOHO router from LAN to change ACS • Tal et al. [5] presented three vulnerabilities at 31c3 (2014) • TR-069 runs a HTTP Server on 7547 for Connection Requests • 52% use RomPager as HTTP Server • 97% of them have version 4.07 (from 2002) • Zynos from ZyXEL includes RomPager 4.07 P . Sattler – Security of CPE Management Protocols 16
Chair of Network Architectures and Services Department of Informatics Technical University of Munich RomPager 4.07 Vulnerabilities • Overflowing HTTP digest authentication username • Overwrite function pointer (RCE) • Memory mapping is to diverse for large scale attacks • Three concurrent requests overwrite the HTTP handler structure • RCE vulnerability • Works only on port 80 (not relevant for TR-069) • Misfortune Cookie [6] P . Sattler – Security of CPE Management Protocols 17
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Misfortune Cookie • Zynos has no dynamic memory allocation • RomPager allocates an array with length 10 for cookies • Cookies are named C0, C1, . . . , C9 • Searches for an initial capital “C” • Rest of the name is index of array • Enables writing relative from a fixed point (RCE) • Worked on any model from any brand • Fixed version was provided in 2005 (9 years earlier than the re- search!) P . Sattler – Security of CPE Management Protocols 18
Chair of Network Architectures and Services Department of Informatics Technical University of Munich DTAG incident • November 28 - 29: outage of 900k Speedport routers [7] • Mirai botnet targeted a vulnerability in TR-064 [8] • Uses the same TCP port as TR-069 • Command injection vulnerability in NTP field • Routers from Irish provider were vulnerable • Some assumed a bug in the attacker’s code [9] P . Sattler – Security of CPE Management Protocols 19
Chair of Network Architectures and Services Department of Informatics Technical University of Munich DTAG incident • Weinmann found a DoS vulnerability to be responsible [7] • DTAGs short term solution was blocking port 7547 • Speedport routers were not vulnerable against NTP vulnerability • Weinmann found also other vulnerabilities in TR-069 (not disclosed) • DTAG claims that TR-069 is secure amongst others because of a device dependent password [10] • Still they parsed requests from other sources than the configured ACS P . Sattler – Security of CPE Management Protocols 20
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Conclusion • ISPs and Router manufactures do not take security seriously [11] • Routers vulnerable to Misfortune Cookie still in 2016 [12] • TR-069 should be more protected (with firewalls, ACLs, or VLANs) • ISPs need to take responsibility • More research into TR-069s security needed P . Sattler – Security of CPE Management Protocols 21
Recommend
More recommend
