2

Is it possible to attack bridged DSL modem? Assuming no existing backdoors but possibly insecure and unpatched firmware. Assuming no access to a secure internal bridged-to network.

My understanding is that in such configuration DSL modem is unreachable from the WAN, so any exploitation would require access to LAN and/or physical access. Still, I would like to hear what community has to say.

1 Answer 1

0

Is it possible to attack bridged DSL modem?

Yes, it's possible to attack the modem if we're talking about a software bridge.

In that case, the software which copies packets from the incoming network interface buffer to the outgoing buffer of the other network interface can have flaws. For example, it might be susceptible to buffer overflows. If so, it could be possible for specially crafted packets to exploit that buffer overflow, which might lead to remote code execution on the modem. There might also be bugs in the network interface driver that might allow for remote code execution.

I wouldn't think it was very likely, however, especially if your modem is running on a well known software brand. The networking stack is well understood and time-tested; I'd doubt there are very many exploitable bugs left in the core code of, say, the linux networking stack.

My understanding is that in such configuration DSL modem is unreachable from the WAN

Bridged mode means that your modem logically doesn't act like a router, but rather like a switch. It connects two physically separate networks together by transparently forwarding traffic from one segment to the other. This means that in bridged mode the DSL modem doesn't need IP addresses, just like a switch doesn't need IP addresses, and if it doesn't have an IP address, then attacks at or above the IP layer become pretty much impossible. But "unreachable" is misleading:

  1. At the very least, traffic still flows through it, opening up the device to the attacks described above.

  2. If you're using a serial console or a special, designated port for modem administration, the modem might really be "invisible" to every layer above the physical link layer. But assuming that you're using a normal web interface to configure it, chances are your modem will still have an IP address assigned (which is possible even in bridge scenarios) - otherwise your webbrowser couldn't connect to the admin interface. And depending on how well the device firewall is configured, the admin interface may even be accessible from the WAN in bridged mode, since logically there is only one network.

Also note that while you do add a layer of extra protection to the modem, you've opened up your whole internal LAN to the WAN. Every machine on your LAN is now visible on the WAN.

5
  • The networking stack is well understood and time-tested For a DSL modem? I wouldn't be so sure about that...
    – forest
    Mar 21, 2018 at 10:41
  • Well, in case of the Linux networking stack, it has been deployed in the wild for almost thirty years now. So I'd call that battle-tested. Of course, DSL modems are unlikely to get updated/patched when new exploits are found, so that's a problem... Mar 22, 2018 at 16:48
  • I don't mean the Linux networking stack but the DSL protocol (since even a Linux router will use a DSL card that runs its own operating system, usually something like VxWorks).
    – forest
    Mar 22, 2018 at 18:12
  • OK, makes sense. I still think the same reasoning should apply, though - VxWorks sees a lot of real-world deployment in critical systems. I mean, it went to Mars! I did a quick search for VxWorks CVEs to see if there were any recent exploits that affected the networking core, but didn't find anything recent that would be relevant to the question. Mar 22, 2018 at 19:33
  • I don't think the issue is with the core VxWorks networking stack, but with DSL modules (note necessarily written by Wind River Systems). Try fuzzing DSL some time!
    – forest
    Mar 22, 2018 at 20:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .