A Tale of CenturyLink Backdoors, PCI Compliance, and Pain

From initial inspection of the GPL firmware download, it looks like port 4567 is controlled by the /bin/tr69c daemon. I also found references from tr69c to a "data_center" program. Neither the data_center or tr69c binaries were in my reference firmware source.

Research suggests tr69c is hosting the TR-069 protocol: https://en.wikipedia.org/wiki/TR-069

Also: OpenSSL 0.9.7f 22 March 2005

This is even better than my supermicro 1u systems which turned out to be running a non-disableable-in-bios unpasworded remote management interface which provided console access exposed to the network that I only found by scanning the subnet. "Intel inside" indeed.

Another way to achieve PCI compliance is to simply outsource all activities having to do with credit cards to a PCI compliant vendor and let them deal with that pain. I've seen sites that let you pay this way and it works pretty well - as well as a payment workflow that involves sending your customer to a 3rd party site and hoping they make it back can work anyway.

The whole thing with the modem is scary though.

Interesting. Centurlink could have easily blocked acccess from outside their own internal network to that IP and port but instead chose to allow the whole internet to have the possibility to play 20 questions with the web admin interface.

Maybe someone even got lucky. What about all the other customers of that ISP with that particular modem, are those still open?

I'm not convinced it would have to be secret updates. As the service that scanned your ports learned new exploits, it reported them. Scanners sometimes use heuristics to guess.