Modems worldwide vulnerable to reboot attacks

Researchers have discovered that more than 135m modems worldwide are potentially vulnerable to unauthenticated reboot attacks. The flaw has been discovered in the Arris (formerly Motorola) SURFboard SB6141, which is particularly popular in the US. Arris does not provide password authentication set up on the modem’s user interface. As a result, any local attacker can access the administration web interface without a username or password. This allows the attacker to disable the user’s modem for up to three minutes, or as much as an hour if the perpetrator chooses the option to Factory Reset the modem. This in turn, wipes the modem’s configurations and settings. The flaws are patchable but given that consumers cannot upgrade cable modems they have to wait for their ISP to take the remedial action.

More than 135 Million modems around the world are vulnerable to a flaw that can be exploited remotely to knock them offline by cutting off the Internet access.





The simple and easily exploitable vulnerability has been uncovered in one of the most popular and widely-used cable modem, the Arris SURFboard SB6141, used in Millions of US households.





David Longenecker Security researcher discovered a loophole that made these modems vulnerable to unauthenticated reboot attacks. He also released his "exploit" after Arris (formerly Motorola) stopped responding to him despite a responsible disclosure.





The Bug is quite silly: No Username and Password Protection.





Arris does not provide any password authentication set up on the modem's user interface, thus allowing any local attacker to access the administration web interface at 192.168.100.1 without the need to enter a username and password.





Restart Cable Modem' from the 'Configuration page' of the administrative interface at Denial of Service (DoS) attack. This issue allows a local attacker to '' from the 'Configuration page' of the administrative interface at https://192.168.100.1/ , as shown. This is nothing but a(DoS) attack.





Bingo! By clicking 'Restart Cable Modem' manually will disable victim's modem for 2 to 3 minutes and every device on that network will lose access to the Internet.





However, three minutes of no Internet connectivity is bearable, but the same administrative panel provides an option to Factory Reset the modem as well i.e. wipe out modem's configuration and settings.

UPCOMING WEBINAR 🔐 Mastering API Security: Understanding Your True Attack Surface Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar! Join the Session



If an attacker clicks this option, your modem will go offline for 30 minutes as re-configuration process takes as long as an hour to complete. Though, sometimes you need to call your Internet Service Provider (ISP) to reactivate the modem.





How to Perform DOS Attack Remotely?





David revealed that an attacker can also reset your modem remotely, as the application doesn't verify whether the reboot or reset the modem command comes from the UI interface or an external source.





This remote attack is known as a Cross-Site Request Forgery (CSRF) attack that allows an attacker to use social engineering techniques to trick users into clicking on a specially crafted web page or email.





For example: A web page including <img src="https://malicious_url/"> tag could call any of the following URLs:

https://192.168.100.1/reset.htm (for restart)

https://192.168.100.1/cmConfigData.htm?BUTTON_INPUT1=Reset+All+Defaults (for factory reset)

"Did you know that a web browser does not care whether an 'image' file is really an image?," Longenecker explains. "Causing a modem to reboot is as simple as including an 'image' in any other web page you might happen to open."

"Of course, it is not a real image, but the web browser does not know that until it requests the file from the modem IP address – which of course causes the modem to reboot."





Are the flaws easy to Patch?





However, these flaws are easily patchable that only requires Arris to create a firmware update such that:



The UI requires authentication (username and password) before allowing someone to reboot or reset the modem. The UI validates that a request originated from the application and not from an external source.





However, the bad news is that there's no practical fix for the flaws. Since cable modems are not consumer-upgradable, even if Arris releases a fix, you would need to wait for your ISPs to apply the fix and push the update to you.





Arris has recently addressed the flaws with a firmware update.



