Researchers have discovered previously unreported problems in SNMP on embedded devices where devices such as secondary market home routers and a popular enterprise-grade load balancer are leaking authentication details in plain text.
The data could be extracted by gaining access to the read-only public SNMP community string, which enables outside access to device information. While only vulnerabilities in three brands were disclosed today, a Shodan search turns up potentially hundreds of thousands of devices that are exposing SNMP to the Internet that could be equally vulnerable.
The Brocade ServerIron ADX 1016-2-PREM, TrafficWork Version 12.5.00T403 application load balancer stores user names and password hashes with its SNMP MIB tables, Rapid7 senior security consultant Deral Heiland said, adding this is likely the most serious of the problems disclosed today.
“It is used by a number of companies out there to front end various applications on the corporate network,” Heiland said, adding that a Shodan search for the device turned up 9,000 facing the Internet. “It’s a lot lower number than the home routers and modems, but that’s 9,000 corporations that could potentially, if the passwords were weak enough, be opened up to remote attacks.”
Heiland and fellow researcher Matthew Kienow also disclosed similar issues in the Ambit U10C019 and Ubee DDW3611 cable modems, as well as the Netopia 3347 series of DSL modems. The cable modems leak not only user names and passwords, but also WEP keys, WPA PSK and SSID information. The DSL modems, meanwhile, also leak WEP keys, WPA PSK and SSIDs.
Metasploit modules for all three vulnerabilities were today published that will extract data from each device.
“This type of data is unexpected to be stored in MIB tables for SNMP. It’s atypical,” Heiland said, who pointed out that the two modems in question are end-of-life, yet are being resold on secondary markets such as Ebay. “The problem is that the vulnerabilities are also in existing hardware and in current devices. I believe that 100 percent.”
Heiland said, however, that the vendors are not setting these devices up with SNMP enabled and Internet-facing configurations; its service providers who are turning the service on, likely for remote management.
“But still, I don’t know why it’s important to have pre-shared keys and passwords available over this,” Heiland said. “That’s where the flaw is. It’s an implementation and deployment issue. When you set up SNMP, you don’t want to leave public community strings in place.”
For example, with the Brocade load balancer, SNMP is enabled by default and the community string “public” is configured by default, Rapid7 said. This is an open door for a hacker to steal password hashes that can be cracked offline unless the protocol is disabled or the public community string is changed.
The same goes for the Netopia DSL modem, manufactured by Motorola; both SNMP is enabled with the public community string. DSL providers however, Heiland said, turn it on for remote management.
SNMP, meanwhile, is not enabled by default on the Ambit and Ubee cable modems; cable providers are likely enabling it on the uplink side of the modems in order to manage the devices remotely as well.
Motorola, Heiland said, acknowledged Rapid7’s disclosure to them but said since the modems are end of life, it’s not an issue, ignoring the Shodan data that says 229,409 Ambit devices are exposed to the Internet, and 224,544 Netopia devices; 187,000 in the United States.
Heiland said similar vulnerabilities in other devices have been disclosed to the vendors in question, and should be made public relatively soon.
