Major Time-Warner Modem/Router security flaw
Apparently the manufacturer of Time-Warner cable’s default modem/router combo, SMC, is run by a pack of incompetent morons. Yes, I am using such strong words because they are needed to express the depth of the stupidity in how this router is setup.
First off, the default setup for these routers (model SMC8014WG-SI) is WEP encryption. Anyone who knows anything about wireless networks will tell you that WEP is pretty much useless. They can be cracked within minutes. However, it gets even better. There’s a normal user account that can only access certain options, supposedly. However, the administrative functions are apparently only restricted from non-admin users by HIDING THEM WITH JAVASCRIPT! Hence the double facepalm above. Words fail me at this point, so let me just quote the guy who found this, Dave, from his blog.
After poking around using the customer account, I found that access to the admin features of the router has been disabled via Javascript. You heard me correct, the web admin for the router simply uses a script to hide certain menu options when the user does not have admin privileges. By simply disabling Javascript in the browser, I was able to access all the features of the router. With that access, I am now able to change the wifi settings, port-forwarding, etc.
It just gets better from here. The extra features that I now had access to included a little item called “Back Up Configuration File”. When I clicked it, a text dump of the router’s configurations was saved to my desktop. Upon examination of this file, I found the admin login & password in plaintext. Another issue which was alarming was the fact that by default, the web admin is accessible from ANYWHERE on the internet. By running a simple port scan of Time Warner IP addresses, I easily found dozens of these routers, open to attack. Of course I got in touch with Time Warner’s security department and warned them about the security issue but their response was simply “we are aware of it but we cannot do anything about it”.
Seriously, the sheer level of incompetence involved here is staggering. Did they have noone at SMC who is even remotely security-minded enough to not do something this blatantly dumb? *sighs* Again, I apologize for the severity of my language, but I am just shocked something like this actually got out into the market like this.
The Consumerist followed up with Jeff Simmermon, the Director of Digital Communications at Time Warner Cable (who also commented on the above blog post) about what Time Warner Cable’s status was in terms of dealing with this issue. He stated that the issue effects “roughly 67,000 out of over 140,000 customers.” He also stated that they rolled out and remotely deployed a (assumedly temporary) patch on October 20th while they, “QA and roll out a long-term solution.”
At the end of the Consumerist article, the author, Chris Walters, states, “I’ve never heard of SMC before, but from now on I’ll always remember it as the router company that is banned from my house.” Amen to that, Chris.
“Time Warner Cable Modem/Router Major Security Hole” (My California Adventures) via “Developer Finds Security Hole In SMC Router Provided By Time Warner Cable” (The Consumerist)
[double facepalm pic from Know Your Meme]
Tags: facepalm, incompetence, security
October 26th, 2009 at 3:27 pm
SMC Networks was recently made aware of a potential vulnerability in the firmware deployed in certain versions of its cable modems deployed on the Time Warner Cable network in North America. In specific and limited instances, the firmware could potentially be exploited by hackers intending to compromise the security of a user’s Internet connection and network.
SMC Networks has moved quickly to develop new firmware that fixes the potential vulnerability and eliminates the possibility of a customer illegally accessing other users’ computers or Time Warner Cable’s network. The new firmware has already been delivered to Time Warner Cable who are pushing the update to their end users’ equipment. This update is being deployed by Time Warner Cable and will require that no action be taken by the end users.
SMC Networks and Time Warner Cable take its customers’ network security concerns very seriously and apologizes for any inconvenience that has been caused by this vulnerability. It is of the utmost importance to SMC to deliver to markets products that are secure, safe and reliable.
October 27th, 2009 at 8:17 am
Thank you Adam, it’s good to hear that SMC is on top of this, and I hope it has learned its lesson from this that depending on Javascript for security/access restriction is a bad idea. ;)