Modems (and telecoms) are also not as secure - 6 0-days to 4 million modems within a week
summary
Finds an exploit chain that uses a serial console and CFE firmware dump (reduced from ~30 days to 1.3 days), IDA Pro analysis and web command injection to escalate from one modem to ISP gear, pivoting through exposed management IP ranges and a DVR to enumerate admin creds via a MAC-1 password derivation. Result: six distinct vulnerabilities (claimed 6 zero-days) combine to fully compromise an ISP fleet, demonstrated on Chunghwa Telecom’s network and capable of affecting 4 million modems within a week, with live LED and remote control proof.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 1:11War and critical infrastructure
- 4:39Telecoms as attack targets
- 5:42Modem infrastructure basics
- 7:06Why modems attract attackers
- 9:12Targeting Chunghwa Telecom modems
- 10:14Zero-days and telecom kill chain
- 11:19Hypothesis and attack vectors
- 12:44Modem attack surfaces
- 14:12Remote management vulnerabilities
- 15:37Serial console access
- 17:24Firmware extraction methods
- 18:51Firmware analysis techniques
- 19:57Command injection flaws
- 21:01Public IP access risks
- 22:49Exploiting ISP DVR devices
- 24:22Mass modem takeover weaponization
- 25:44Guest account authentication bypass
- 27:53Impacts of full modem control
- 28:56Live remote exploit demo
- 29:39Country-wide network compromise
- 30:01Modems versus IoT security
- 31:06Vulnerability research challenges
- 32:51National vulnerability disclosure programs
- 33:32Geopolitical risks of telecom flaws
- 34:40ISP network resilience
- 35:00Telecom security defense strategies
- 36:26Closing remarks
- 36:46Q&A
related talks
44mExposing Critical Threats In Millions Of Connected Devices
25mAttacking Mobile Broadband Modems Like a Criminal Would
49mAll the 4G Modules Could be Hacked
25mAdventures & Findings in ISP Hacking
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
45mExploiting Qualcomm WLAN and Modem Over The Air
49mxIoT Hacking Demonstrations & Strategies to Disappoint Bad Actors