Hacker News Reader

Comment by nanis | Hacker News Reader

It doesn't seem to be feasible using this vulnerability:

> Cable Haunt is exploited in two steps. First, access to the vulnerable endpoint is gained through a client on the local network, such as a browser. (emphasis mine)

View on HN

That means loading a webpage from the internet, which then runs the exploit in javascript on your local machine. Tricking users to load the page through phishing or through ads served from shady ad networks is ‘all’ it takes

Thank you for the correction.

Sibling comments mention hacked web pages and DNS rebinding. I imagine there are also many of these routers that still have unpatched issues with SNMP, like "stringbleed". https://www.bleepingcomputer.com/news/security/several-cable...

This is almost certainly exploitable remotely with a DNS rebinding attack.

You don't need any fancy rebinding attacks. That's a bit 2001 era web hacking :)

This issue is based on WebSockets where the software on the modem:

a) Doesn't verify any of the origin headers sent, so any origin works (rebinding is designed to beat origin checks)

b) Copies an uploaded message straight onto the stack without doing any size checks

@thu2111 He's giving you an attack chain. If you rebind the dns server of the modem with a snmp/tr069 exploit you could redirect/inject into the http traffic a page that contained the javascript payload to exploit the Cable Haunt vulnerabiliy against the Spectrum Analyser endpoint. Because websockets doesn't use CORS to restrict the requesting hosts domain to the modem, you could execute code on the gateway modem from the internet with the combination of a client on the remote network running a http request from a browser combined with an alternative dns rebinding attack against the gateway and a server hosting the malicious websockets payload on a http server.

Edit: or you could get them to click on a link

It also seems to require that the attacker knows the credentials for the modem.

They are virtually always either the manufacturers default credentials or the carriers default credentials. Anyone can find the former, and all one has to do is find a pliable tech to get the latter.

Reply on news.ycombinator.com