1 00:00:00,540 --> 00:00:02,070 - So our next talk is called, 2 00:00:02,070 --> 00:00:06,660 Hacking ISPs with Point-to-Pwn Protocol over Ethernet, 3 00:00:06,660 --> 00:00:09,513 PPPoE with Gal. 4 00:00:10,410 --> 00:00:12,390 It's his second time at DEFCON. 5 00:00:12,390 --> 00:00:14,520 I guess we didn't scare him the first time. 6 00:00:14,520 --> 00:00:17,850 But please give him a big cheer and let's start. 7 00:00:17,850 --> 00:00:18,861 All right. 8 00:00:18,861 --> 00:00:22,049 (audience applauding) 9 00:00:22,049 --> 00:00:23,966 - Thank you, thank you. 10 00:00:25,260 --> 00:00:26,093 All right. 11 00:00:26,093 --> 00:00:26,940 So hi everybody, 12 00:00:26,940 --> 00:00:30,960 and welcome to my talk on hacking ISP with PPPoE 13 00:00:32,340 --> 00:00:33,990 or as the title says, 14 00:00:33,990 --> 00:00:36,483 point-to-pwn protocol over ethernet. 15 00:00:37,800 --> 00:00:40,800 And first I'd like to thank DEFCON 16 00:00:40,800 --> 00:00:43,590 for having me here again this year 17 00:00:43,590 --> 00:00:46,140 and this time in person, so I'm excited. 18 00:00:46,140 --> 00:00:50,250 And before I begin, let me share a quick story with you. 19 00:00:50,250 --> 00:00:51,270 So on this research, 20 00:00:51,270 --> 00:00:54,870 I've been working on and off for the last two years, 21 00:00:54,870 --> 00:00:57,780 and as of course, it was during the pandemic 22 00:00:57,780 --> 00:01:01,500 and like everybody else, I had to work from home. 23 00:01:01,500 --> 00:01:04,230 However, this research 24 00:01:04,230 --> 00:01:08,040 involved this device on my kitchen table 25 00:01:08,040 --> 00:01:09,810 for almost a year. 26 00:01:09,810 --> 00:01:12,270 And let me give you just a quick example 27 00:01:12,270 --> 00:01:13,500 how it sounds like. 28 00:01:13,500 --> 00:01:18,500 I'm also gonna pray the audio gods that it's gonna work. 29 00:01:22,530 --> 00:01:23,363 Wait. 30 00:01:25,470 --> 00:01:26,520 No audio. 31 00:01:26,520 --> 00:01:30,139 Oh damn, wait, so I gotta fallback for that. 32 00:01:30,139 --> 00:01:34,920 I'm just gonna play it from my phone. 33 00:01:34,920 --> 00:01:36,867 So this is how the device sounds like. 34 00:01:36,867 --> 00:01:39,700 (device roaring) 35 00:01:41,971 --> 00:01:46,200 So, yeah, so before I begin, 36 00:01:46,200 --> 00:01:49,980 I would specially like to thank my wife Ortel, 37 00:01:49,980 --> 00:01:51,663 that sits here with us today, 38 00:01:52,530 --> 00:01:55,530 for sharing a single bedroom apartment 39 00:01:55,530 --> 00:01:58,110 with me and that device. 40 00:01:58,110 --> 00:01:59,160 Yeah. (audience laughs) 41 00:01:59,160 --> 00:02:00,810 Thank you, honey. (audience applauds) 42 00:02:00,810 --> 00:02:01,833 Yeah, yeah. 43 00:02:04,050 --> 00:02:05,850 Tough year, the pandemic. 44 00:02:05,850 --> 00:02:08,553 All right, okay, so enough about that. 45 00:02:10,411 --> 00:02:12,300 Okay, so let's begin. 46 00:02:12,300 --> 00:02:14,970 My name is Gal and I've been causing ruckus 47 00:02:14,970 --> 00:02:18,030 on embedded devices for quite some time. 48 00:02:18,030 --> 00:02:22,770 And as I said, this is a two years long research 49 00:02:22,770 --> 00:02:25,620 and I actually started working at it 50 00:02:25,620 --> 00:02:28,290 when I used to work at Aleph Research 51 00:02:28,290 --> 00:02:31,410 and I ended it in Cyber Ark Labs, 52 00:02:31,410 --> 00:02:34,053 where I work today as a research manager. 53 00:02:35,100 --> 00:02:38,610 And today we're gonna talk about three subjects. 54 00:02:38,610 --> 00:02:41,220 First, I'll introduce the idea and motivation 55 00:02:41,220 --> 00:02:44,673 behind hacking internet service providers, ISPs. 56 00:02:45,930 --> 00:02:46,763 After that, 57 00:02:46,763 --> 00:02:47,880 we'll do a crash course 58 00:02:47,880 --> 00:02:50,190 in Layer-2 communication protocols, 59 00:02:50,190 --> 00:02:52,863 and I present some cool vulnerabilities I found. 60 00:02:54,120 --> 00:02:54,953 And lastly, 61 00:02:54,953 --> 00:02:57,330 I'll share how I was able to research 62 00:02:57,330 --> 00:02:59,130 this kind of equipment. 63 00:02:59,130 --> 00:03:00,270 And hopefully, 64 00:03:00,270 --> 00:03:03,333 I might convince you that at the end of the day, 65 00:03:04,440 --> 00:03:06,480 big ISP network equipment, 66 00:03:06,480 --> 00:03:11,480 it's not that different from small home router research. 67 00:03:12,930 --> 00:03:16,713 Okay, so let's begin with pwning internet service providers. 68 00:03:18,510 --> 00:03:22,143 So, we all know how a classic remote attack is executed. 69 00:03:23,319 --> 00:03:26,310 Usually, attacker looks for a victim on the internet, 70 00:03:26,310 --> 00:03:28,530 maps the attack surface 71 00:03:28,530 --> 00:03:31,770 by discovering what protocol the target uses, 72 00:03:31,770 --> 00:03:34,590 and then try to use Oday or end day 73 00:03:34,590 --> 00:03:36,963 and hopefully get RC on the target. 74 00:03:37,950 --> 00:03:40,519 Ironically, many of these classic attacks 75 00:03:40,519 --> 00:03:43,563 (indistinct) is taking place on home routers. 76 00:03:44,940 --> 00:03:47,940 So the idea is that ISP network equipment, 77 00:03:47,940 --> 00:03:49,443 it's not that different. 78 00:03:50,430 --> 00:03:51,630 Instead of the internet, 79 00:03:51,630 --> 00:03:56,043 we got our ISP network accessible from our local modem, 80 00:03:57,060 --> 00:03:58,830 and instead of the internet server, 81 00:03:58,830 --> 00:04:02,703 we got the ISP equipment that provides us services. 82 00:04:04,290 --> 00:04:07,440 So all we have to do is to map the attack surface, 83 00:04:07,440 --> 00:04:10,635 find an Oday and hopefully get an RC 84 00:04:10,635 --> 00:04:13,113 on the ISP network equipment. 85 00:04:14,400 --> 00:04:16,140 But why attacking ISP? 86 00:04:16,140 --> 00:04:20,550 Well, if I was the proud owner of Evil Com Ltd, 87 00:04:20,550 --> 00:04:23,343 I might be able to do some of the following stuff. 88 00:04:24,240 --> 00:04:26,250 For start, the obvious denial of service 89 00:04:26,250 --> 00:04:27,750 and other ransom activities, 90 00:04:27,750 --> 00:04:29,460 like shutting down network 91 00:04:29,460 --> 00:04:31,623 and asking for money to stop doing it. 92 00:04:32,610 --> 00:04:36,450 But I can also execute DNS hijack for the entire network, 93 00:04:36,450 --> 00:04:39,510 aka become man in the middle for all subscribers 94 00:04:39,510 --> 00:04:43,833 by redirect their DNS to my own evil DNS server. 95 00:04:45,030 --> 00:04:47,250 And another interesting idea is to target 96 00:04:47,250 --> 00:04:50,640 a specific subscriber by their actual identity, 97 00:04:50,640 --> 00:04:53,640 aka the actual name and other information 98 00:04:53,640 --> 00:04:54,993 the ISP stores on them. 99 00:04:56,490 --> 00:04:59,550 I also might be able to, 100 00:04:59,550 --> 00:05:02,190 might be connected to the internet backbone 101 00:05:02,190 --> 00:05:03,750 for IP allocation. 102 00:05:03,750 --> 00:05:06,750 So I might be able to execute this crazy scale 103 00:05:06,750 --> 00:05:08,943 distributed denial of service. 104 00:05:10,260 --> 00:05:11,093 And lastly, 105 00:05:11,093 --> 00:05:13,020 I can execute all sorts of attacks 106 00:05:13,020 --> 00:05:16,263 by abusing common protocol and technologies used by the ISP. 107 00:05:19,230 --> 00:05:22,380 Okay, so to understand what we are about to attack, 108 00:05:22,380 --> 00:05:26,430 let's understand how basic ISP network operates. 109 00:05:26,430 --> 00:05:28,920 Keep in mind that this is a simplified example 110 00:05:28,920 --> 00:05:30,810 for DSL based network, 111 00:05:30,810 --> 00:05:34,119 but other tunneling protocols, such as PPPoE, 112 00:05:34,119 --> 00:05:38,710 LTTP, GBONE they all follow more or less the same concept. 113 00:05:40,740 --> 00:05:45,570 So when you get your router from your ISP, it has two roles. 114 00:05:45,570 --> 00:05:47,700 One is to provide network services 115 00:05:47,700 --> 00:05:50,910 such as ethernet and wifi to your home premise. 116 00:05:50,910 --> 00:05:53,913 And the other role is DSL modem functionality. 117 00:05:54,960 --> 00:05:58,350 The DSL modem basically uses the good old telephone line 118 00:05:58,350 --> 00:06:01,950 to connect you to your ISP and then to the internet. 119 00:06:01,950 --> 00:06:04,920 Your modem is hooked up to a phone line 120 00:06:04,920 --> 00:06:08,160 and the telephone company connect the other end of the line 121 00:06:08,160 --> 00:06:10,356 to something called DSLAM. 122 00:06:10,356 --> 00:06:12,630 DSLAM is basically a multiplexer 123 00:06:12,630 --> 00:06:15,210 that extracts digital information 124 00:06:15,210 --> 00:06:17,250 from analog signals 125 00:06:17,250 --> 00:06:21,363 by sent from multiple modems over the telephone lines. 126 00:06:23,160 --> 00:06:25,200 Okay, the DSLAM is then connected 127 00:06:25,200 --> 00:06:28,980 to a broadband remote extra server or BRAS, 128 00:06:28,980 --> 00:06:30,750 which is basically a big router 129 00:06:30,750 --> 00:06:33,796 that routes traffic to and from the DSLAM 130 00:06:33,796 --> 00:06:35,683 to the ISP network. 131 00:06:37,790 --> 00:06:40,320 So we can abstractly think that our modem 132 00:06:40,320 --> 00:06:42,360 is connected with a Layer-2 cable 133 00:06:42,360 --> 00:06:44,673 directly into the BRAS itself. 134 00:06:46,530 --> 00:06:47,363 And we say, oh, 135 00:06:47,363 --> 00:06:49,230 we can also bridge the modem traffic 136 00:06:49,230 --> 00:06:51,540 to our own evil machine. 137 00:06:51,540 --> 00:06:55,170 So now we can think abstractly that our malicious machine 138 00:06:55,170 --> 00:06:58,320 is connected with a very long ethernet cable 139 00:06:58,320 --> 00:06:59,613 directly to the BRAS. 140 00:07:01,410 --> 00:07:04,860 So if the BRAS is the ISPs frontline router, 141 00:07:04,860 --> 00:07:08,310 and we are connected to it with the network connectivity, 142 00:07:08,310 --> 00:07:10,920 then hacking this BRAS is the equivalent 143 00:07:10,920 --> 00:07:14,313 of hacking the ISP's home router. 144 00:07:17,700 --> 00:07:19,800 All right and this is where home router 145 00:07:19,800 --> 00:07:21,480 takes the power back. 146 00:07:21,480 --> 00:07:23,820 They can attack the BRAS in the same way 147 00:07:23,820 --> 00:07:26,253 hackers can attack them from the internet. 148 00:07:29,160 --> 00:07:30,420 Once we control the BRAS, 149 00:07:30,420 --> 00:07:33,600 attackers can execute some of the attacks 150 00:07:33,600 --> 00:07:34,980 I mentioned before, 151 00:07:34,980 --> 00:07:38,343 or attack other ISP network equipment. 152 00:07:40,470 --> 00:07:42,690 All right, so for this research, 153 00:07:42,690 --> 00:07:46,860 I decided to target Redback Network's SmartEdge equipment. 154 00:07:46,860 --> 00:07:48,330 Back in the 2000s, 155 00:07:48,330 --> 00:07:51,960 Redback were a big player in ISP equipment. 156 00:07:51,960 --> 00:07:53,820 They were actually involved in defining 157 00:07:53,820 --> 00:07:56,760 some of the protocols I'll show you today. 158 00:07:56,760 --> 00:08:00,180 In 2007, they were acquired by Ericsson 159 00:08:00,180 --> 00:08:02,430 that continues to manufacture new products 160 00:08:02,430 --> 00:08:03,843 under the Redback brand. 161 00:08:05,430 --> 00:08:07,290 Some of these devices are pretty big 162 00:08:07,290 --> 00:08:10,860 and can support up to half a million subscribers. 163 00:08:10,860 --> 00:08:11,693 For example, 164 00:08:11,693 --> 00:08:13,540 the one that you see at the bottom right. 165 00:08:14,580 --> 00:08:18,990 And they all use custom NetBSD operation system 166 00:08:18,990 --> 00:08:22,323 called SEOS, SmartEdge OS, 167 00:08:23,430 --> 00:08:26,823 and also use a PowerPC architecture. 168 00:08:28,830 --> 00:08:31,470 Okay, so now that we have a target 169 00:08:31,470 --> 00:08:33,870 and we see it's worth hacking to it, 170 00:08:33,870 --> 00:08:36,720 let's understand what kind of protocol can be used 171 00:08:36,720 --> 00:08:37,743 to attack ISPs. 172 00:08:40,440 --> 00:08:41,273 All right. 173 00:08:41,273 --> 00:08:44,130 So let's start with point to point protocol over ethernet 174 00:08:44,130 --> 00:08:48,333 or PPPoE, which is a Layer-2 encapsulation protocol. 175 00:08:50,280 --> 00:08:53,283 This is a common protocol to connect to ISPs. 176 00:08:54,960 --> 00:08:59,883 And in our case, the PPPoE server is the ISP's BRAS. 177 00:09:01,050 --> 00:09:05,283 And the PPP client is our DSL modem or malicious machine. 178 00:09:07,230 --> 00:09:09,570 And remember that we just saw that abstractly, 179 00:09:09,570 --> 00:09:13,020 the client is connected with an ethernet cable to the BRAS. 180 00:09:13,020 --> 00:09:14,970 So as the name of the protocol suggests, 181 00:09:14,970 --> 00:09:16,530 by using PPPoE, 182 00:09:16,530 --> 00:09:20,940 we can encapsulate PPP sessions over ethernet frame. 183 00:09:20,940 --> 00:09:23,043 Okay, great, but what is PPP? 184 00:09:24,540 --> 00:09:28,412 All right, so PPP stands for point to point protocol. 185 00:09:28,412 --> 00:09:31,200 It is also alert to protocol, 186 00:09:31,200 --> 00:09:34,110 which is mainly used to tunnel ISP packets 187 00:09:34,110 --> 00:09:37,830 to and from the mode and by doing it, by doing so, 188 00:09:37,830 --> 00:09:39,663 enabling the internet connectivity. 189 00:09:41,580 --> 00:09:44,280 So PPP negotiation is where the client 190 00:09:44,280 --> 00:09:45,600 authenticate to the server 191 00:09:45,600 --> 00:09:47,913 and gets its configuration parameters. 192 00:09:49,590 --> 00:09:50,940 And if all goes smoothly, 193 00:09:50,940 --> 00:09:54,660 a PPP tunneling interface is created on the client's side. 194 00:09:54,660 --> 00:09:55,493 At this point, 195 00:09:55,493 --> 00:09:57,810 the client received DNS configuration 196 00:09:57,810 --> 00:10:00,963 and usually an internet facing IP address. 197 00:10:03,000 --> 00:10:05,070 So at the end of negotiation, 198 00:10:05,070 --> 00:10:07,650 our router or machine should end up 199 00:10:07,650 --> 00:10:10,293 with an interface similar to this one. 200 00:10:12,240 --> 00:10:15,000 All right, also at any time, 201 00:10:15,000 --> 00:10:18,603 both the clients or the server can terminate the session. 202 00:10:20,430 --> 00:10:21,450 And that's it. 203 00:10:21,450 --> 00:10:26,160 Now that we understand the general flow of the protocol, 204 00:10:26,160 --> 00:10:28,470 I'd like to focus on PPP 205 00:10:28,470 --> 00:10:32,673 and especially on the session negotiation part of PPP. 206 00:10:35,610 --> 00:10:40,293 So PPP is a layered protocol that has three components. 207 00:10:41,940 --> 00:10:44,580 First, there's an encapsulation component 208 00:10:44,580 --> 00:10:48,090 that is used to transmit datagrams 209 00:10:48,090 --> 00:10:50,730 over a specific physical layer. 210 00:10:50,730 --> 00:10:53,820 I'll soon go over on the specific format 211 00:10:53,820 --> 00:10:54,920 and how it looks like. 212 00:10:57,330 --> 00:11:00,090 The encapsulation is used to transmit 213 00:11:00,090 --> 00:11:04,020 something called link control protocol, LCP. 214 00:11:04,020 --> 00:11:07,830 This protocol establish, configure and test link, 215 00:11:07,830 --> 00:11:12,513 as well as negotiate settings options and use of features. 216 00:11:14,070 --> 00:11:17,070 And lastly, after the connection is established, 217 00:11:17,070 --> 00:11:18,720 different protocol can be used 218 00:11:18,720 --> 00:11:23,220 to negotiate and facilitate a Layer-3 network clear. 219 00:11:23,220 --> 00:11:26,880 In our case, to tunnel IPV-4. 220 00:11:26,880 --> 00:11:31,323 And we use for that the IP control protocol, or IPCP. 221 00:11:34,680 --> 00:11:39,390 Since PPP is relatively big and have many protocol layers, 222 00:11:39,390 --> 00:11:43,923 I decided to focus on LCP and this is why I did that. 223 00:11:45,240 --> 00:11:49,293 Well, this is the first protocol used in PPP. 224 00:11:51,210 --> 00:11:54,340 It's used to set and receive different configurations 225 00:11:55,800 --> 00:11:57,603 and no authentication is needed. 226 00:12:00,780 --> 00:12:03,360 Okay, so, to really understand PPP, 227 00:12:03,360 --> 00:12:06,003 let's understand the encapsulation format. 228 00:12:07,560 --> 00:12:11,853 So first we got an ethernet frame with a PPPoE payload. 229 00:12:13,200 --> 00:12:16,653 The PPP encapsulate at PPP payload. 230 00:12:18,540 --> 00:12:19,620 And in this example, 231 00:12:19,620 --> 00:12:24,363 the encapsulated PPP packet is LCP type of packet. 232 00:12:26,250 --> 00:12:29,463 Now, let's understand how LCP packet looks like. 233 00:12:31,380 --> 00:12:34,530 LCP packet contains an option payload 234 00:12:34,530 --> 00:12:36,360 to pass different parameters. 235 00:12:36,360 --> 00:12:38,850 For example, authentication protocol, 236 00:12:38,850 --> 00:12:42,930 magic number, maximum receive units, et cetera. 237 00:12:42,930 --> 00:12:47,930 And each option has a code number, length and data. 238 00:12:51,750 --> 00:12:55,290 For example, here we see that LCP packet 239 00:12:55,290 --> 00:12:59,670 that contains parameter for maximum receive units, 240 00:12:59,670 --> 00:13:02,523 authentication protocol, and a magic number. 241 00:13:03,570 --> 00:13:06,450 And yeah, this is a different option values 242 00:13:06,450 --> 00:13:07,503 for all these fields. 243 00:13:08,880 --> 00:13:12,660 All right, and there are all sorts of other parameters 244 00:13:12,660 --> 00:13:14,370 defined in the protocol. 245 00:13:14,370 --> 00:13:16,680 But the one I found most interesting 246 00:13:16,680 --> 00:13:18,513 was actually the last one. 247 00:13:19,620 --> 00:13:24,620 Code number 19, endpoint discrimination option. 248 00:13:24,690 --> 00:13:28,530 I don't have enough time to get in what this option does 249 00:13:28,530 --> 00:13:31,743 and actually soon you'll see it doesn't really matter, 250 00:13:35,236 --> 00:13:37,860 but I discovered that although the RFC 251 00:13:37,860 --> 00:13:40,080 defines that the parameter length 252 00:13:40,080 --> 00:13:41,763 should not exceed 20, 253 00:13:43,620 --> 00:13:45,120 in the SmartEdge devices, 254 00:13:45,120 --> 00:13:48,570 it actually handles packets with bigger length. 255 00:13:48,570 --> 00:13:51,843 And it also has no validation on the data field. 256 00:13:53,700 --> 00:13:57,000 Also, I noticed that when the PPP log 257 00:13:57,000 --> 00:14:00,120 is enabled in the SmartEdge device, 258 00:14:00,120 --> 00:14:02,940 I get log entries similar to this. 259 00:14:02,940 --> 00:14:06,840 Here we see the different LCP parameters 260 00:14:06,840 --> 00:14:07,983 written to the log. 261 00:14:09,450 --> 00:14:12,750 For example, this is the authentication protocol used, 262 00:14:12,750 --> 00:14:14,610 and this is the magic number, 263 00:14:14,610 --> 00:14:18,000 and this is the AEA 264 00:14:18,000 --> 00:14:20,703 as part of the endpoint discrimination field. 265 00:14:22,020 --> 00:14:27,020 So I'm writing a log entry with any data I wish, 266 00:14:27,270 --> 00:14:30,570 and with a bigger lens than accepted. 267 00:14:30,570 --> 00:14:32,913 Yeah, I think you all know what's coming next. 268 00:14:33,840 --> 00:14:38,643 Yeah, vanilla stack overflow in the SmartEdge log entry. 269 00:14:39,900 --> 00:14:42,033 And this is a great time for a demo time. 270 00:14:44,760 --> 00:14:48,540 So for this demo, I will be using four terminals. 271 00:14:48,540 --> 00:14:51,660 The bottom blue terminal is only a monitor terminal 272 00:14:51,660 --> 00:14:54,453 connected to the SmartEdge device. 273 00:14:55,380 --> 00:14:56,820 Yeah, that's the monitor 274 00:14:56,820 --> 00:15:00,840 and the red and the green terminals on the left 275 00:15:00,840 --> 00:15:04,110 will act as the STD in an STD out listeners 276 00:15:04,110 --> 00:15:06,330 for the reverse shell. 277 00:15:06,330 --> 00:15:07,653 And on the black terminal, 278 00:15:07,653 --> 00:15:12,543 I will execute my attack connected as a DSL subscriber. 279 00:15:14,490 --> 00:15:17,010 Okay, so now I'm running Netcat 280 00:15:17,010 --> 00:15:20,793 to listen to STD in and STD out onto ports. 281 00:15:22,841 --> 00:15:26,403 Yeah, here, I'm using the first one and the second. 282 00:15:27,930 --> 00:15:28,763 All right, 283 00:15:28,763 --> 00:15:33,190 and now I will execute my attack by typing 284 00:15:34,380 --> 00:15:38,250 bin SH to two telnet clients. 285 00:15:38,250 --> 00:15:41,190 So here I'm telling I'm typing the STD in 286 00:15:41,190 --> 00:15:44,010 to port 1337 287 00:15:44,010 --> 00:15:49,010 and then type bin SH and STD out to the other port. 288 00:15:51,690 --> 00:15:54,993 Okay, fire away. 289 00:15:57,150 --> 00:16:01,860 So now I'm sending the first two PPPoE session 290 00:16:01,860 --> 00:16:04,650 creating a PPP session by sending two packets. 291 00:16:04,650 --> 00:16:08,340 And this is the LCP payload, malicious payload. 292 00:16:08,340 --> 00:16:10,350 And you can see on the monitor screen 293 00:16:10,350 --> 00:16:11,850 that I got a core dump, 294 00:16:11,850 --> 00:16:14,193 meaning that I managed to smash the stack. 295 00:16:16,230 --> 00:16:20,820 And now I'm using my STD in Netcat to send commands. 296 00:16:20,820 --> 00:16:22,590 Here, I'm using LS. 297 00:16:22,590 --> 00:16:25,110 And of course, I'm gonna echo my user 298 00:16:25,110 --> 00:16:27,120 and see that I am root. 299 00:16:27,120 --> 00:16:30,030 And yeah, let's do it again just to, 300 00:16:30,030 --> 00:16:33,303 thank you. (audience applauds) 301 00:16:34,920 --> 00:16:35,753 Thank you. 302 00:16:35,753 --> 00:16:38,490 I can also grab some other configuration 303 00:16:38,490 --> 00:16:42,930 like the DNS and I can write and read the DNS configuration 304 00:16:42,930 --> 00:16:45,390 and the admin for the device itself. 305 00:16:45,390 --> 00:16:47,070 But yeah, once I got root, 306 00:16:47,070 --> 00:16:49,233 I pretty much, it pretty much ends. 307 00:16:50,640 --> 00:16:55,380 Okay, so now that we've seen a full working RCE, 308 00:16:55,380 --> 00:16:59,943 let's talk about how to research this kind of equipment. 309 00:17:01,680 --> 00:17:04,680 So the most interesting conclusion I got from this research 310 00:17:04,680 --> 00:17:07,350 is that ISP network equipment 311 00:17:07,350 --> 00:17:09,960 is not that different from home routers 312 00:17:09,960 --> 00:17:12,300 when it come to vulnerability research. 313 00:17:12,300 --> 00:17:13,950 Let's talk about the differences. 314 00:17:15,870 --> 00:17:18,930 So home routers are of course cheaper, 315 00:17:18,930 --> 00:17:21,060 usually around 300 bucks, 316 00:17:21,060 --> 00:17:24,213 while BRAS entry level is a bit higher. 317 00:17:26,310 --> 00:17:30,810 Both of them usually never gets updates from the ISP, 318 00:17:30,810 --> 00:17:32,400 which is great for hackers, 319 00:17:32,400 --> 00:17:34,863 but really bad for everybody else. 320 00:17:37,050 --> 00:17:41,040 And as you already heard, BRAS are way noisier. 321 00:17:41,040 --> 00:17:45,180 So if you plan to store them at, on your kitchen table, 322 00:17:45,180 --> 00:17:47,523 you should expect to annoy people around you. 323 00:17:49,560 --> 00:17:52,170 And probably the hardest part is that setup 324 00:17:52,170 --> 00:17:53,910 and configuration part. 325 00:17:53,910 --> 00:17:57,210 Since ISP equipment usually takes a specific expertise 326 00:17:57,210 --> 00:17:58,293 to install. 327 00:17:59,640 --> 00:18:01,170 So if you got enough, 328 00:18:01,170 --> 00:18:04,413 so if you got some extra dollars and you're stubborn enough, 329 00:18:05,250 --> 00:18:08,613 you could also pwn an ISP network equipment. 330 00:18:10,140 --> 00:18:12,690 So based on my experience with this research, 331 00:18:12,690 --> 00:18:16,500 I'm thrilled to present my seven easy steps 332 00:18:16,500 --> 00:18:19,173 to research and pwn ISP equipment. 333 00:18:21,450 --> 00:18:23,193 First firmware emulation, 334 00:18:24,180 --> 00:18:27,333 then setting up debug and development environment, 335 00:18:28,230 --> 00:18:29,703 jailbreak, if needed, 336 00:18:30,720 --> 00:18:33,423 get or buy an actual device, 337 00:18:34,470 --> 00:18:37,083 search and hopefully find vulnerabilities, 338 00:18:38,100 --> 00:18:39,100 write an exploit 339 00:18:40,140 --> 00:18:43,233 and finally celebrate with your favorite beverage. 340 00:18:46,050 --> 00:18:49,410 So first step for every embedded device research, 341 00:18:49,410 --> 00:18:51,010 is usually getting the firmware. 342 00:18:52,440 --> 00:18:55,200 I was lucky enough to find one online 343 00:18:55,200 --> 00:18:57,180 and after a quick bean walk, 344 00:18:57,180 --> 00:19:01,320 I realized SmartEdge uses a NetBSD OS 345 00:19:01,320 --> 00:19:03,213 and a power PC architecture. 346 00:19:05,280 --> 00:19:07,830 Luckily up until 2006, 347 00:19:07,830 --> 00:19:10,410 Apple were using power PC processors 348 00:19:10,410 --> 00:19:12,520 with their BSD based kernel 349 00:19:14,040 --> 00:19:16,650 and this nice fella called Kenigh 350 00:19:16,650 --> 00:19:18,540 posted a wonderful Reddit blog 351 00:19:18,540 --> 00:19:21,570 on how to emulate a very similar system 352 00:19:21,570 --> 00:19:23,673 to the one SmartEdge are using. 353 00:19:25,710 --> 00:19:28,320 And that way I was able to emulate the user space 354 00:19:28,320 --> 00:19:29,973 of the SmartEdge firmware. 355 00:19:31,470 --> 00:19:33,993 Right, now for debug and development. 356 00:19:35,580 --> 00:19:39,480 I realized that cross compilation to a different OS 357 00:19:39,480 --> 00:19:43,290 and a different architecture is pretty much a nightmare. 358 00:19:43,290 --> 00:19:45,600 So, I decided to use my QME machine 359 00:19:45,600 --> 00:19:48,273 to just compile statically tools. 360 00:19:50,700 --> 00:19:54,300 I also use this SSH TCP dump trick 361 00:19:54,300 --> 00:19:57,480 to sneak packets from my emulated device 362 00:19:57,480 --> 00:19:59,970 into my wire shark host. 363 00:19:59,970 --> 00:20:02,010 Well, that was super useful 364 00:20:02,010 --> 00:20:04,660 to understand the different protocols I'm presenting, 365 00:20:06,240 --> 00:20:09,633 but I also had an issue with debugging. 366 00:20:10,920 --> 00:20:15,420 My GDB multi arch on my Ubuntu machine 367 00:20:15,420 --> 00:20:19,923 refuses to connect to a PowerPC NetBSD system. 368 00:20:21,357 --> 00:20:24,210 So instead of spending time solving this issue, 369 00:20:24,210 --> 00:20:26,430 I just decided to run the GDB client 370 00:20:26,430 --> 00:20:28,470 from my emulated environment. 371 00:20:28,470 --> 00:20:32,880 And yeah, this is actually was very useful later on 372 00:20:32,880 --> 00:20:36,000 when I remotely debug an actual device. 373 00:20:36,000 --> 00:20:37,503 So it just saved me some time. 374 00:20:39,750 --> 00:20:42,810 Okay, so next step was to understand 375 00:20:42,810 --> 00:20:44,970 if a jailbreak is needed 376 00:20:44,970 --> 00:20:47,043 for debugging an actual device. 377 00:20:49,110 --> 00:20:50,400 So as you can expect, 378 00:20:50,400 --> 00:20:55,400 SmartEdge are using this exec underscore CLI binary 379 00:20:56,130 --> 00:20:58,173 to handle all console commands. 380 00:20:59,370 --> 00:21:03,240 So logging from telnet SSH, serial ports, 381 00:21:03,240 --> 00:21:06,213 they all end up with this jail terminal, 382 00:21:08,220 --> 00:21:13,220 but XXCLI must run some code of some kind of other binaries. 383 00:21:15,120 --> 00:21:20,120 For example, when you use the telnet command in that shell, 384 00:21:21,660 --> 00:21:25,803 it executes this SE underscore telnet binary. 385 00:21:27,210 --> 00:21:28,043 By the way, 386 00:21:28,043 --> 00:21:29,490 this is the same telnet client 387 00:21:29,490 --> 00:21:32,973 I was using for my exploitation earlier at the POC. 388 00:21:35,220 --> 00:21:37,800 Luckily, I found that this telnet client 389 00:21:37,800 --> 00:21:40,630 has an internal telnet command 390 00:21:41,910 --> 00:21:45,123 for just popping up a jailfree sub shell. 391 00:21:47,340 --> 00:21:48,173 So, yeah. 392 00:21:48,173 --> 00:21:50,340 So another thing, that please note 393 00:21:50,340 --> 00:21:52,200 that this is a telnet client. 394 00:21:52,200 --> 00:21:56,640 So to run the telnet internal command 395 00:21:56,640 --> 00:21:59,580 to pop the jailfree shell, 396 00:21:59,580 --> 00:22:03,903 I use this trick where I do telnet to my local host, 397 00:22:05,250 --> 00:22:08,853 and here you can see the invoke subshell command. 398 00:22:09,960 --> 00:22:13,380 So all I have to do is just use the exclamation point 399 00:22:13,380 --> 00:22:16,383 command and pop myself a jailfree CLI. 400 00:22:18,200 --> 00:22:19,530 (Gal laughs) 401 00:22:19,530 --> 00:22:21,600 Now that I know that if I'll get my hands 402 00:22:21,600 --> 00:22:25,890 on an actual device, I can execute any code I desire. 403 00:22:25,890 --> 00:22:26,723 For example, 404 00:22:26,723 --> 00:22:29,730 this GDB server that Redback was kind enough 405 00:22:29,730 --> 00:22:31,080 to leave in their firmware. 406 00:22:33,630 --> 00:22:38,630 Right, so next I decided to buy an actual device. 407 00:22:38,940 --> 00:22:39,773 Theoretically, 408 00:22:39,773 --> 00:22:42,780 I could continue my research on emulated device 409 00:22:42,780 --> 00:22:45,033 and maybe even find vulnerabilities, 410 00:22:45,900 --> 00:22:48,813 but I was missing the actual device configuration. 411 00:22:50,490 --> 00:22:55,230 I also had to do some serious LDpredo voodoo magic 412 00:22:55,230 --> 00:22:57,090 to get the emulation working, 413 00:22:57,090 --> 00:23:00,600 which made it limited to specific binaries. 414 00:23:00,600 --> 00:23:03,483 And it was pretty unstable in general. 415 00:23:05,640 --> 00:23:07,860 And also if I have an actual device, 416 00:23:07,860 --> 00:23:10,410 I could develop a full working exploit, 417 00:23:10,410 --> 00:23:11,810 like the one I demonstrated. 418 00:23:14,550 --> 00:23:17,580 So I went to eBay and bought the cheapest device 419 00:23:17,580 --> 00:23:20,857 I could find, which is the SmartEdge 100, 420 00:23:22,260 --> 00:23:23,920 it cost around two grand 421 00:23:25,440 --> 00:23:30,243 and Aleph Research was kind enough to fund this purchase. 422 00:23:32,040 --> 00:23:33,630 By the way, at that point, 423 00:23:33,630 --> 00:23:36,993 I left a Aleph Research and moved to Cyber Ark Labs. 424 00:23:42,330 --> 00:23:43,170 Yeah, all right. 425 00:23:43,170 --> 00:23:46,140 So I finally got an actual device, 426 00:23:46,140 --> 00:23:49,740 but I soon realized that I got little knowledge 427 00:23:49,740 --> 00:23:52,350 in setting up ISP equipment, 428 00:23:52,350 --> 00:23:57,303 and I had to acquire some kind of ISP technician skills. 429 00:23:58,890 --> 00:24:01,680 So I started by reading this 100-page 430 00:24:01,680 --> 00:24:03,750 of basic hardware guide 431 00:24:03,750 --> 00:24:06,273 to understand how to physically connect stuff. 432 00:24:07,590 --> 00:24:12,330 I then had to read this 360-page of basic configuration 433 00:24:12,330 --> 00:24:14,790 to understand what configuration I need to do 434 00:24:14,790 --> 00:24:18,063 in order to create an ISP alike setup. 435 00:24:19,200 --> 00:24:21,510 And lastly, to work with the CLI, 436 00:24:21,510 --> 00:24:25,443 I had to use this 900-page manual. 437 00:24:26,580 --> 00:24:28,230 And this is how I pretty much felt 438 00:24:28,230 --> 00:24:30,330 from all this useless information 439 00:24:30,330 --> 00:24:32,073 that I'm gonna use only once. 440 00:24:33,990 --> 00:24:35,100 Yeah, okay. 441 00:24:35,100 --> 00:24:38,370 So to apply all this information, 442 00:24:38,370 --> 00:24:41,673 let's first go over the device chassis. 443 00:24:43,800 --> 00:24:45,630 Most of the port on the device 444 00:24:45,630 --> 00:24:49,620 are either ethernet or optical ports. 445 00:24:49,620 --> 00:24:52,710 To these ports, the ISP connect other network equipment, 446 00:24:52,710 --> 00:24:55,473 such as switches, routers, and DSLAM. 447 00:24:57,390 --> 00:24:59,040 And most importantly, 448 00:24:59,040 --> 00:25:02,220 the subscribers are connected through these ports. 449 00:25:02,220 --> 00:25:05,553 So my attack should be executed from one of these ports. 450 00:25:08,040 --> 00:25:11,013 The other ports are used for managing the device. 451 00:25:12,330 --> 00:25:15,460 So we got two ethernet management ports 452 00:25:16,380 --> 00:25:18,753 and a single serial port. 453 00:25:20,880 --> 00:25:24,963 So there's two ways to configure and manage the device. 454 00:25:26,730 --> 00:25:29,460 The most convenient is of course the ethernet port 455 00:25:29,460 --> 00:25:32,790 by using telnet or SSH, 456 00:25:32,790 --> 00:25:37,470 but these ports can also be used for other monitoring, 457 00:25:37,470 --> 00:25:40,350 such as log monitoring, packet monitoring, 458 00:25:40,350 --> 00:25:43,293 and even remote debugging with GDB. 459 00:25:45,150 --> 00:25:47,640 But the serial port is still very useful, 460 00:25:47,640 --> 00:25:49,263 since it's foolproof, 461 00:25:50,130 --> 00:25:52,530 meaning that even if I completely messed up 462 00:25:52,530 --> 00:25:54,000 the device configuration, 463 00:25:54,000 --> 00:25:57,300 I could always reverse it with the serial port 464 00:25:57,300 --> 00:25:58,590 and believe me, 465 00:25:58,590 --> 00:26:01,713 I have messed the device configuration like a million times. 466 00:26:03,450 --> 00:26:04,830 All right, so finally, 467 00:26:04,830 --> 00:26:07,020 I was able to configure the device 468 00:26:07,020 --> 00:26:10,030 with around 200 configuration commands 469 00:26:11,220 --> 00:26:15,270 and I was ready for a full ISP like installation. 470 00:26:15,270 --> 00:26:18,390 My setup included an Ubuntu machine, 471 00:26:18,390 --> 00:26:21,483 three network cards and a single port, 472 00:26:22,680 --> 00:26:24,063 a single serial port. 473 00:26:25,380 --> 00:26:28,200 So I started by connecting a serial port 474 00:26:28,200 --> 00:26:30,303 to the foolproof console. 475 00:26:32,400 --> 00:26:34,710 I then used one network device 476 00:26:34,710 --> 00:26:36,760 to connect to the management device port, 477 00:26:38,280 --> 00:26:40,410 and then connect another network interface 478 00:26:40,410 --> 00:26:44,073 to simulate an actual subscriber connected to the BRAS. 479 00:26:46,860 --> 00:26:49,410 This is where I execute my vulnerabilities, 480 00:26:49,410 --> 00:26:50,310 through this port. 481 00:26:52,140 --> 00:26:53,100 And lastly, 482 00:26:53,100 --> 00:26:55,590 I installed the device in our server room 483 00:26:55,590 --> 00:26:58,110 and connected my Ubuntu machine to the internet, 484 00:26:58,110 --> 00:27:01,023 so I won't have to work from my kitchen table no more. 485 00:27:02,340 --> 00:27:07,340 Okay, so now that I own a SmartEdge device 486 00:27:07,680 --> 00:27:10,173 and I understand how to configure it, 487 00:27:11,010 --> 00:27:12,873 and I got myself a server rack, 488 00:27:14,430 --> 00:27:18,693 I finally became the proud owner of Evil Communication Ltd. 489 00:27:20,130 --> 00:27:23,220 So you guys are more the welcome to become my victims, 490 00:27:23,220 --> 00:27:26,103 to become my clients, of course, free of charge. 491 00:27:30,510 --> 00:27:33,990 All right, but beside becoming an ISP, 492 00:27:33,990 --> 00:27:36,213 I finally reached the research phase. 493 00:27:39,030 --> 00:27:41,700 So now I had three useful tools 494 00:27:41,700 --> 00:27:44,400 to help me with the research, 495 00:27:44,400 --> 00:27:48,090 the SmartEdge log at GDB server 496 00:27:48,090 --> 00:27:50,163 and a wire shark monitoring. 497 00:27:52,740 --> 00:27:55,170 And now let's talk about the daemon itself 498 00:27:55,170 --> 00:27:56,970 that handles PPPD. 499 00:27:56,970 --> 00:28:00,300 SmartEdge is running a daemon called PPPD 500 00:28:00,300 --> 00:28:03,150 that handles PPP sessions. 501 00:28:03,150 --> 00:28:07,350 With some reversing, I realized that incoming PPP packets 502 00:28:07,350 --> 00:28:11,823 are being handled by a function called packet receive. 503 00:28:14,280 --> 00:28:16,050 Packet receive calls, some, 504 00:28:16,050 --> 00:28:19,170 a function called Demooks input packet, 505 00:28:19,170 --> 00:28:21,483 for every packet it receives. 506 00:28:23,400 --> 00:28:26,730 And this function is a log stream multiplexer 507 00:28:26,730 --> 00:28:29,340 for input function. 508 00:28:29,340 --> 00:28:32,200 Basically, it means it uses function pointers 509 00:28:33,420 --> 00:28:35,790 for different log, 510 00:28:35,790 --> 00:28:40,260 depends on what sub PPP protocol is being used. 511 00:28:40,260 --> 00:28:43,500 Here we see three logs protocol functions, 512 00:28:43,500 --> 00:28:47,167 for example, the LCP, the IPCP, and LCP. 513 00:28:51,510 --> 00:28:53,298 And as you guys already know, 514 00:28:53,298 --> 00:28:56,133 I was interested in the LCP log. 515 00:28:59,040 --> 00:29:00,330 And this is where I discovered 516 00:29:00,330 --> 00:29:02,400 that the endpoint discriminator log 517 00:29:02,400 --> 00:29:05,553 uses this unsafe mem copy to the stack. 518 00:29:06,870 --> 00:29:11,580 So, if we go back to the LCP options payload example, 519 00:29:11,580 --> 00:29:15,780 this is where my mem copy copies the data I control 520 00:29:15,780 --> 00:29:20,403 with invalid length to 35 bytes of stacker rate. 521 00:29:23,250 --> 00:29:25,983 All right and finally it's exploit time. 522 00:29:28,080 --> 00:29:31,380 So exploit development was very straightforward. 523 00:29:31,380 --> 00:29:33,750 There were zero stack mitigation, 524 00:29:33,750 --> 00:29:37,893 and I chose to use a single rob gadget to exit V. 525 00:29:41,250 --> 00:29:45,090 But when I was using the reverse IP shell in my demo, 526 00:29:45,090 --> 00:29:47,223 I was making a naive assumption. 527 00:29:50,910 --> 00:29:54,390 in the demo, I assumed that the BRAS 528 00:29:54,390 --> 00:29:57,450 has some kind of IP connectivity 529 00:29:57,450 --> 00:30:01,203 and was able to create a reverse shell to the remote server. 530 00:30:02,880 --> 00:30:05,250 When the attacker can control the BRAS by, 531 00:30:05,250 --> 00:30:07,590 and then the attacker can control the BRAS 532 00:30:07,590 --> 00:30:09,633 by connecting to that remote server. 533 00:30:11,130 --> 00:30:14,580 But what if the BRAS has no IP connectivity 534 00:30:14,580 --> 00:30:17,700 or it blocks by a firewall? 535 00:30:17,700 --> 00:30:21,183 How can I get a shell on the device using only Layer-2? 536 00:30:22,980 --> 00:30:27,980 So, I decided to try and develop a Layer-2 only shell, 537 00:30:30,450 --> 00:30:32,880 meaning the entire shell will be executed 538 00:30:32,880 --> 00:30:36,750 over ethernet frame without the need for IT protocol, 539 00:30:36,750 --> 00:30:39,783 meaning the subscriber can control the device directly. 540 00:30:41,940 --> 00:30:44,310 So the first problem was that my exploit 541 00:30:44,310 --> 00:30:47,130 was limited to command shells only, 542 00:30:47,130 --> 00:30:48,280 like we saw on the POC. 543 00:30:50,160 --> 00:30:52,170 So first I had to execute it, 544 00:30:52,170 --> 00:30:56,700 my exploit to deploy a bridge head. 545 00:30:56,700 --> 00:31:00,090 Bridge head is a term for running a small exploit 546 00:31:00,090 --> 00:31:02,310 to update a bigger exploit. 547 00:31:02,310 --> 00:31:05,760 So if I was looking for a way, sorry, 548 00:31:05,760 --> 00:31:08,940 I was looking for a way to execute a shell code 549 00:31:08,940 --> 00:31:11,940 that will allow me to upload files 550 00:31:11,940 --> 00:31:14,343 using only Layer-2 communication. 551 00:31:16,290 --> 00:31:20,010 Luckily I had TCP dump installed on the device, 552 00:31:20,010 --> 00:31:23,460 and I found this very cool trick to upload a file 553 00:31:23,460 --> 00:31:25,353 from a specific Mac address. 554 00:31:27,360 --> 00:31:32,360 Here, we see that TCP writes the content of 106 frames 555 00:31:32,700 --> 00:31:35,523 to a file called L-2 shell. 556 00:31:37,830 --> 00:31:41,640 And I also used a filter to only pick up frames 557 00:31:41,640 --> 00:31:44,793 with a specific magic Mac source address. 558 00:31:47,460 --> 00:31:50,820 So now I am no longer limited to a shell command. 559 00:31:50,820 --> 00:31:53,760 I can upload any binary I want and execute it 560 00:31:53,760 --> 00:31:56,133 by running my exploit again, 561 00:31:59,160 --> 00:32:02,130 but since I'm dealing with Layer-2 connection, 562 00:32:02,130 --> 00:32:06,180 I needed some sort of raw socket functionality. 563 00:32:06,180 --> 00:32:09,270 Unfortunately, SmartEdge implemented their own 564 00:32:09,270 --> 00:32:11,460 undocumented raw socket. 565 00:32:11,460 --> 00:32:13,113 So I couldn't just use it easily, 566 00:32:14,760 --> 00:32:19,020 but fortunately slash dev slash BPF was installed. 567 00:32:19,020 --> 00:32:20,190 And ironically, 568 00:32:20,190 --> 00:32:23,520 the only binary using slash dev slash BPF 569 00:32:23,520 --> 00:32:25,713 was the TCP dump I just abused. 570 00:32:27,900 --> 00:32:31,740 So I had to configure BPF with these two flags. 571 00:32:31,740 --> 00:32:34,890 The first is telling BPF which interface to listen, 572 00:32:34,890 --> 00:32:38,433 and the other flag just received the packets immediately. 573 00:32:40,620 --> 00:32:44,190 And now BPF listen to alert to traffic. 574 00:32:44,190 --> 00:32:47,790 And if it detects a frame with a specific magic 575 00:32:47,790 --> 00:32:52,790 it extracts and run its codes, the specific commands. 576 00:32:53,520 --> 00:32:57,243 And now I truly done with exploiting the device. 577 00:32:59,760 --> 00:33:01,473 But wait, there's more. 578 00:33:03,600 --> 00:33:06,810 I would like to share another interesting vulnerability 579 00:33:06,810 --> 00:33:09,030 discovered by Omer Tsarfati, 580 00:33:09,030 --> 00:33:12,900 one of our researchers at Cyber Ark Labs. 581 00:33:12,900 --> 00:33:16,863 For this, let me explain how PPPoE session works. 582 00:33:18,540 --> 00:33:21,903 So every PPPoE packet has a code field. 583 00:33:23,760 --> 00:33:27,960 This field sets what type of message 584 00:33:27,960 --> 00:33:31,203 is being used in the PPPoE negotiation part. 585 00:33:33,270 --> 00:33:35,970 So the first phrase is not mandatory 586 00:33:35,970 --> 00:33:39,870 and it mainly needed for the client to discover 587 00:33:39,870 --> 00:33:42,720 the PPPoE server Mac address. 588 00:33:42,720 --> 00:33:47,640 It does that by sending an initiation packet 589 00:33:47,640 --> 00:33:50,163 and receive an offer from the server. 590 00:33:51,870 --> 00:33:53,970 And the next step is mandatory. 591 00:33:53,970 --> 00:33:55,080 And in this phase, 592 00:33:55,080 --> 00:33:58,710 the client requests a session number to start a session. 593 00:33:58,710 --> 00:34:02,790 So the client sends PADR, aka request 594 00:34:02,790 --> 00:34:06,603 and receive PADS, aka session from the server. 595 00:34:08,370 --> 00:34:10,590 Also, it's very important to notice 596 00:34:10,590 --> 00:34:14,040 that both sides can terminate the session at any time 597 00:34:14,040 --> 00:34:16,833 by using Pati, aka termination. 598 00:34:19,290 --> 00:34:24,290 So Omer discovered that when the client sends PADR request 599 00:34:24,480 --> 00:34:27,633 with a broadcast as a source address, 600 00:34:28,710 --> 00:34:32,910 the SmartEdge PPPoE server sends a session packet 601 00:34:32,910 --> 00:34:37,413 with a broadcast as destination server, destination address. 602 00:34:39,270 --> 00:34:43,890 Since no client expects an FFFF as a destination address, 603 00:34:43,890 --> 00:34:46,953 it sends it again and again. 604 00:34:48,000 --> 00:34:51,120 And if the server is configured with session timeout, 605 00:34:51,120 --> 00:34:53,580 it sends that there's termination packet, 606 00:34:53,580 --> 00:34:56,820 but this termination packet has a broadcast 607 00:34:56,820 --> 00:34:59,103 as destination Mac address, 608 00:35:01,800 --> 00:35:04,530 meaning the server ask all the clients 609 00:35:04,530 --> 00:35:06,483 to terminate their session. 610 00:35:09,277 --> 00:35:12,277 (audience applauds) 611 00:35:14,220 --> 00:35:15,900 Thank you, there is a but here. 612 00:35:15,900 --> 00:35:18,960 There is a but here, that this attack, 613 00:35:18,960 --> 00:35:22,920 it still depends on the switch policy 614 00:35:22,920 --> 00:35:26,550 and whether the DSL endpoints determine, 615 00:35:26,550 --> 00:35:30,987 if the ADSL endpoints terminate the session, 616 00:35:30,987 --> 00:35:33,630 if they receive such kind of a request. 617 00:35:33,630 --> 00:35:37,620 I mean, a broadcast termination with no session number, 618 00:35:37,620 --> 00:35:41,700 but anyway, it's a bug for sure, 619 00:35:41,700 --> 00:35:43,563 and a really cool idea for an attack. 620 00:35:46,170 --> 00:35:50,133 And now that we manage to pwn our SmartEdge devices, 621 00:35:51,390 --> 00:35:55,260 all it left is to drink rum with the fellas here at DEFCON, 622 00:35:55,260 --> 00:35:58,023 by the way, this is my noob shot from 2020. 623 00:36:01,320 --> 00:36:04,320 All right and as for fingerprinting. 624 00:36:04,320 --> 00:36:08,520 So I managed to detect around 500 devices 625 00:36:08,520 --> 00:36:13,520 in 55 different organizations from 20 different countries 626 00:36:14,347 --> 00:36:18,570 that were using the SmartEdge devices. 627 00:36:18,570 --> 00:36:22,320 But remember, folks, these devices are not publicly, 628 00:36:22,320 --> 00:36:24,690 did not supposed to be publicly facing. 629 00:36:24,690 --> 00:36:27,483 So I'm sure there are many more out there. 630 00:36:30,030 --> 00:36:33,630 And I reach out to Ericsson with my finding 631 00:36:33,630 --> 00:36:37,920 and we work together to reproduce and understand the issues 632 00:36:37,920 --> 00:36:39,690 and their severity. 633 00:36:39,690 --> 00:36:43,110 Ericsson suggested to handle the CV assignment. 634 00:36:43,110 --> 00:36:47,310 And they provided a CV number for the stack overflow 635 00:36:47,310 --> 00:36:49,320 with a critical CVS assess score 636 00:36:49,320 --> 00:36:53,130 and another CV for the denial of service bug. 637 00:36:53,130 --> 00:36:54,980 But I haven't updated the slides yet, 638 00:36:56,040 --> 00:36:58,263 with our medium CV assess score. 639 00:37:00,690 --> 00:37:04,680 Ericsson also announced that SmartEdge devices 640 00:37:04,680 --> 00:37:07,110 has reach end of life. 641 00:37:07,110 --> 00:37:10,830 Meaning these vulnerabilities are infinity day, 642 00:37:10,830 --> 00:37:15,830 and we also brainstormed together on possible mitigation 643 00:37:15,870 --> 00:37:19,593 and they communicated the issues to their customers. 644 00:37:22,530 --> 00:37:24,270 And as for mitigations, 645 00:37:24,270 --> 00:37:27,810 well, I strongly recommend to disable PPP logs 646 00:37:27,810 --> 00:37:30,090 on the SmartEdge devices, 647 00:37:30,090 --> 00:37:33,570 as for Omer denial of service attack, 648 00:37:33,570 --> 00:37:37,230 I believe it can be blocked with switch configuration 649 00:37:37,230 --> 00:37:40,020 to block this kind of messages, 650 00:37:40,020 --> 00:37:44,523 and also SmartEdge, well they are really old devices. 651 00:37:44,523 --> 00:37:48,330 They are from the back 2000s 652 00:37:48,330 --> 00:37:51,000 and it's highly recommend just get rid of them 653 00:37:51,000 --> 00:37:51,850 and replace them. 654 00:37:54,540 --> 00:37:56,460 All right, so to conclude, 655 00:37:56,460 --> 00:38:00,090 I hope I convinced you that ISP network devices 656 00:38:00,090 --> 00:38:03,990 are not that different from home routers 657 00:38:03,990 --> 00:38:06,003 when it comes to vulnerability research, 658 00:38:08,280 --> 00:38:11,040 that old school is still cool. 659 00:38:11,040 --> 00:38:13,530 And a 50 years old network device 660 00:38:13,530 --> 00:38:16,023 can still cause a big ruckus. 661 00:38:18,000 --> 00:38:21,900 And as always ISP usually don't pay attention to updates 662 00:38:21,900 --> 00:38:24,540 when it comes to both their endpoint 663 00:38:24,540 --> 00:38:26,373 and their backend equipment. 664 00:38:29,310 --> 00:38:34,310 Right, looking forward, a blog post will be published soon. 665 00:38:34,470 --> 00:38:37,680 And I might also look into other attack surfaces 666 00:38:37,680 --> 00:38:42,680 I've discovered while researching the SmartEdge devices. 667 00:38:43,170 --> 00:38:44,013 And lastly, 668 00:38:44,940 --> 00:38:47,400 I might have a look at other vendors 669 00:38:47,400 --> 00:38:51,330 and see if some of those technique works. 670 00:38:51,330 --> 00:38:53,043 I mean, the denial service works. 671 00:38:54,270 --> 00:38:56,700 Right, thank you for your time. 672 00:38:56,700 --> 00:38:58,279 Feel free to reach out, yeah. 673 00:38:58,279 --> 00:39:01,279 (audience applauds) 674 00:39:05,520 --> 00:39:08,520 Thanks, feel free to reach out to me on Twitter 675 00:39:08,520 --> 00:39:12,030 and go see the latest season of Solar Opposites, 676 00:39:12,030 --> 00:39:13,230 it's awesome. 677 00:39:13,230 --> 00:39:15,903 And if you got any question, feel free to ask.