widely deployed embedded OS in ~2005 Claimed 300 million devices in 2006 Produced by Wind River Systems, now owned by Intel http://www.eetimes.com/discussion/other/4025539/Embedded-systems-survey-Operating-systems-up-for-grabs
• PowerPC, ARM, MIPS, x86, i960, SPARC • All “applications” run as kernel threads • Little memory protection between apps • Everything runs with the highest privileges • …but not necessarily the highest priority.
port 17185 • Lightly mentioned in 2002, 2004, 2005 • CVE-2005-3715 & CVE-2005-3804 • No information on the protocol • Works on all architectures “Allows attackers to access the phone OS, obtain sensitive information, and cause a denial of service”
entire Internet • Use wdbrpc_bootline as a scanner • Use tcpdump to capture replies • Use a VPS with a friendly provider • Scan, scan, scan! • Parse the results
system symbols 0x04 - don't autoboot 0x08 - quick autoboot (no countdown) 0x20 - disable login security 0x40 - use bootp to get boot parameters 0x80 - use tftp to get boot image 0x100 - use proxy arp
process for Telnet & FTP • The password is hashed, hashes compared • Tons of static backdoor accounts* • Password is stored hashed… * Check for calls to loginUserAdd()
in Google • Used an additive byte sum as the “secret” • Only 210,000 possible output hashes • Only ~8,000 are easy to type • Most passwords within ~4000 • Range is 8-40 characters, \x00 -> \xFF
the iceberg • Metasploit code will drive research • Expect to see these for a long, long time Timeline • Public advisories on August 2nd • Rapid7 NeXpose checks on August 2nd • Metasploit scanners on August 2nd • Exploit modules pushed in early September • Master password list also in September