<div dir="auto"><div>Para vuestra información por si alguien de la lista compra estas ONUs chinas. </div><div dir="auto"><br></div><div dir="auto">Saludos Andres Pugawko <br><br><div class="gmail_quote" dir="auto"><div dir="ltr">---------- Forwarded message ---------<br>From: Lucimara Desiderá <<a href="mailto:lucimara@cert.br">lucimara@cert.br</a>><br>Date: vie., 4 de may. de 2018 1:56 p.m.<br>Subject: [lacnog] Over a Million Dasan Routers Vulnerable to Remote Hacking<br>To: <<a href="mailto:seguridad@lacnic.net">seguridad@lacnic.net</a>>, Latin America and Caribbean Region Network Operators Group <<a href="mailto:lacnog@lacnic.net">lacnog@lacnic.net</a>><br></div><br><br><a href="https://www.securityweek.com/over-million-dasan-routers-vulnerable-remote-hacking" rel="noreferrer noreferrer" target="_blank">https://www.securityweek.com/over-million-dasan-routers-vulnerable-remote-hacking</a><br>
<br>
Over a Million Dasan Routers Vulnerable to Remote Hacking<br>
By Eduard Kovacs on May 02, 2018<br>
<br>
<br>
Researchers have disclosed the details of two unpatched vulnerabilities<br>
that expose more than one million home routers made by South Korea-based<br>
Dasan Networks to remote hacker attacks.<br>
<br>
In a blog post published on Monday, vpnMentor revealed that many<br>
Gigabit-capable Passive Optical Network (GPON) routers, which are used<br>
to provide fiber-optic Internet, are affected by critical<br>
vulnerabilities. The company told SecurityWeek that the impacted devices<br>
are made by Dasan Networks.<br>
<br>
One of the flaws, tracked as CVE-2018-10561, allows a remote attacker to<br>
bypass a router’s authentication mechanism simply by appending the<br>
string “?images/” to a URL in the device’s web interface.<br>
<br>
The second vulnerability, identified as CVE-2018-10562, allows an<br>
authenticated attacker to inject arbitrary commands.<br>
<br>
By combining the two security holes, a remote and unauthenticated<br>
attacker can take complete control of a vulnerable device and possibly<br>
the entire network, vpnMentor said. The company has published a video<br>
showing how the attack works:<br>
<br>
A Shodan search shows that there are more than one million GPON home<br>
routers exposed to the Internet, a majority located in Mexico (480,000),<br>
Kazakhstan (390,000), and Vietnam (145,000).<br>
<br>
“Depending on what the attacker wants to achieve, he can be spying on<br>
the user and any connected device (TV, phones, PC and even speakers like<br>
Amazon Echo). Also he can inject malware into the browser which means<br>
even when you leave your home network your device would be hacked now,”<br>
Ariel Hochstadt, co-founder of vpnMentor, told SecurityWeek. “If the<br>
hacker is resourceful (government etc) he can enable advanced spear<br>
phishing attacks, and even route criminal activities through exploited<br>
routers (Imagine the FBI knocks on your door telling you they saw<br>
someone in your house using your IP address and selling stolen credit<br>
card numbers on the dark web).”<br>
<br>
vpnMentor said it did try to report its findings to Dasan before making<br>
any information public, but it did not receive a response. Dasan<br>
representatives, specifically a PR agency, reached out to vpnMentor on<br>
LinkedIn after its blog post was published.<br>
<br>
While in some cases Dasan has shown interest in working with researchers<br>
who discovered vulnerabilities in its products, there are some<br>
advisories online describing potentially critical issues that the vendor<br>
has apparently ignored.<br>
<br>
Malicious actors have been known to target Dasan devices. Researchers<br>
reported recently that the Satori botnet had ensnared thousands of Dasan<br>
routers by exploiting a remote code execution vulnerability. The flaw in<br>
question was disclosed in December 2017 by Beyond Security, which<br>
claimed the vendor had ignored repeated attempts to report the issue.<br>
<br>
This is not the first time vpnMentor reports finding vulnerabilities in<br>
network devices. Last month, the company disclosed the details of an<br>
unpatched command injection vulnerability that can be exploited to take<br>
control of network-attached storage (NAS) devices from LG.<br>
_______________________________________________<br>
LACNOG mailing list<br>
<a href="mailto:LACNOG@lacnic.net" target="_blank" rel="noreferrer">LACNOG@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lacnog" rel="noreferrer noreferrer" target="_blank">https://mail.lacnic.net/mailman/listinfo/lacnog</a><br>
Cancelar suscripcion: <a href="https://mail.lacnic.net/mailman/options/lacnog" rel="noreferrer noreferrer" target="_blank">https://mail.lacnic.net/mailman/options/lacnog</a><br>
</div></div></div>