--On Tuesday, June 26, 2007 17:51:58 +0000 b.hines@xxxxxxxxxxx wrote:
What I've discovered is that some devices run telnet, and it requires no login at all. Haven't tried doing anything with it yet, but a DoS was possible in earlier versions of the software. I suspect that's still the case.Nice, that and an unchanged default password...
It also runs ftp, with a login of "admin" or "administrator" and a null password. So you can remove, alter and upload files at will. I suspect that could be used for plenty of nefarious purposes.
Then there's the web interface; no login, admin access remotely to setup, placing a call, etc., etc., and if they use a password, just load http://target/a_security.htm and it will happily present you with the passwords in plain text.
I suspect the ftp interface would be the most fruitful, because you could upload new web pages with embedded scripts that load malware, redirect to a fake site, exploit weaknesses in the browser, etc., etc.
All in all, a pretty poorly designed (from a security perspective) device. -- Paul Schmehl (pauls@xxxxxxxxxxxx) Senior Information Security Analyst The University of Texas at Dallas http://www.utdallas.edu/ir/security/
Attachment:
p7sx5FOnKPsOr.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/