Bypassing eCos Embedded Devices Authentication (CVE-2017-1000020)

Disclaimer: Breaking into unauthorized systems and devices are completely illegal. The information provided here is solely for the purpose of sharing knowledge and all I present is my research materials so that the public can remain safe and benefit from my research.

We have heard a lot of stories about routers being vulnerable to hack attacks, routers being a part of botnet, distributing malwares or lately the story about mirai bot. Let's get into my story here...

Lately, I was working with some router setups on TOTOLINK SOHO router. I performed a router setup and updated my password for my administrator login. After some days I thought of changing some settings and was trying to log into the router but unfortunately I forgot my last password. Instead of pressing the reset button and erasing everything and starting with a fresh setup I thought of taking this issue to some extent and looking into it a bit more. I had heard some stories about public exploits being available for totolink routers. I thought of checking all of them for my benefit and for learning purpose but none of them were of my use. At some times, while I tried to access the router login page there was this one thing that would grab my attention. While trying to access the router login page, 'wizard.htm' (the router setup page) would show up for about 1/2 second or so and then would get redirected to 'login.htm' and if I try to access the 'wizard.htm' page the router would not show it and instead show up the login (login.htm) page again. Untill I clear my browser cache and start the same process again, the process would then show up the same results as before. I thought of looking into this issue and ways for possible login bypass in the authentication mechanism. Looking into the page source code in 'login.htm', showed a line with javascript file named 'language_en.js'. I looked inside it and found the internal page names like 'menu.htm', 'password.htm', 'upload.htm', 'route.htm', and all other pages with heavy information that an attacker would need. Okay, that could come handy later because accessing those pages now would return nothing but the login page again.
 

Main Login page for Totolink Router

If you have been into a bit of networking and stuffs, you probably would know about what a three way handshake is. Generally, Transmission Control Protocol (TCP) uses three way handshake to set up a TCP/IP connection over an Internet Protocol(IP) based network prior to its communication or say exchanging data. I won't be telling you an in-depth story of three way handshake and how that works for now. Let's get back into the story again...

"What if I could stop the process right at the 'wizard.htm' page or may be slow down the process and see what I could do around there?" was the question in my mind.

Okay that sounds fun! but how?

How about performing a slow Denial Of Service (DOS) attack with some play and pause with the device reply?

Wow that sounds much better!

Lets get started...

Hping3 came handy this time. If you don't know what it is then, hping3 is a network tool able to send custom TCP/IP packets and to display target replies just like ping program does with ICMP replies.

I then fired the device with SYN flood attack to execute my slow dos with the use of hping3. By the way SYN flood or FIN flood worked just fine and I never thought of trying other flooding options.

hping3 in FIN flood mode

FIN flood attack in action

So, a SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.

Now, while the flooding is still taking place go back to your browser, clear your cache (required most of the times), enter the router ip followed by the page you want. Example: ip/reboot.htm or ip/menu.htm and so on. It could take some hit and trial as per the router's capability of resisting the attack but as time passes it would finally give us the page we want to be.

Conclusion: eCos Embedded Web Servers used by Multiple Routers, while sending SYN flood or FIN flood packets fails to validate and handle the packets and does not ask for any sign of authentication resulting in Authentication Bypass.

Shodan Search Result

What could go wrong?
An attacker can take complete advantage of this bug and take over the device remotely or locally.
At the time of writing, there were 11,887 'eCos Embedded Web Servers' as reported by SHODAN but the numbers of internet users using totolink, greatek and other routers not shown by the shodan are likely higher in numbers than as shown in the result. Totolink and Greatek routers were tested and were found vulnerable.

Possibly changing the dns or changing the ip route or changing passwords or updating rogue firmwares or maybe more zombie devices teaming up with the mirai bot army could be the outcome of such vulnerability.

As always, updating the device to the latest firmware version is highly recommended in case of availability. If you find more information related to this bug then feel free to share or exchange ideas.

A search engine for Hackers – SHODAN

Wouldn’t that be cool if we could get access and control to security cameras, printers, toasters, traffic lights, gas station, nuclear power plant, monitoring stations etc.? Well, that’s exactly, what Shodan does for us. Basically, Shodan is a search engine that help users find specific devices (routers, servers, switches, computers etc.) that are connected to the internet.

This search engine was created by John Matherly and launched back in 2009. What makes Shodan different from other search engine is because of its algorithm, and definitely the way it unites the devices linked with the internet. Some define it as a reconnaissance tool, since it gives information about the open ports, service versions, server information and much more about the specified devices. A penetration tester would use this engine to find the targeted IP information which is publicly exposed. Security researchers would use it to find certain devices or information and generate report and distribute among the security community, whereas the same information could also be used by the black hat community to exploit the targeted network and cause damage to those vulnerable devices.

Most of the connected devices tend to be vulnerable in one way or the other way. A script kiddie with no prior knowledge of how things work, could use this engine and find widely open devices which uses default password or no passwords in some cases and then claim that they have hacked certain devices and act cool among friend circle. Well, isn’t that cool? (And by saying that I don’t motivate you to act illegal) Exactly, that’s what happen and what are happening. Sometimes back, security researchers have found huge number of vulnerable monitoring devices which used default username and default password or no password at all.

Back in the time, people used google dork to find out “How to hack IP camera” or so, but with Shodan you can now act as a Hollywood hacker and act cool (And again by saying this I don’t motivate you to act illegal either). Huge number of devices are widely exploited and used by cyber folks and kids. IP cameras are just a simple example. Not only IP cameras, but the devices I mentioned on the very first sentence are online, can be seen at Shodan, which are widely vulnerable and could easily be exploited with malicious intended folks from the dark.

It is always a best practice to change your default usernames and passwords, close the unused ports, and update your devices to the latest firmware and to the latest kernel release, patch the vulnerability which are made public, do not open any port unless you really need it and at least follow security related news to know what’s going on in the security community.

At last, remember this adage, “Bridge when you can and route when you must.” You might need it someday folks.