@Anonymous wrote:
It sounds to me that you really have had the sleeves rolled up on this one so it may be advantageous for your argument to make available (privately) to Plusnet the full results of your penetration testing, as I assume you’ve been using Metasploit or RouterSploit to prove your assumptions.
You may also want to write an exploit (in Python) for the device where your are given root. You could then forward this to Plusnet / BT as indisputable evidence of the devices insecurity and may well have a beneficial effect in future hardware releases or even firmware upgrades.
I don't think you've quite grasped how basic these flaws are. You don't need to do a penetration test to prove that you can man-in-the-middle an unsecured http connection [for example].
As I said right up top, I am not a computer security expert. This is BASIC stuff.
This is like saying I'm not an expert in nutrition but I know that chowing down 14 hamburgers and 15 cokes a day is bad for you. You don't need to be an expert in nutrition to know that.
WPS has a list of unpatched exploits built into the protocol as long as your arm and you can read about them on freaking Wikipedia.
There will always be bugs, errors in coding that allow for exploits, and when they are found they need to be reported fixed and those fixes securely sent out to peoples devices.
But that is not what we are talking about here.
By analogy this is like talking about home security and you are asking me to submit my new method for picking the lock.
I'm telling you that the house has no door in the frame and there are giant holes in the wall.
We haven't got to picking the locks yet the problems are more fundamental and more basic than that.
It's common for criminals to seek out private information so that they can do spear phishing attacks, where they specifically target individuals and pretend to be somebody they're not [like say an ISP] and get those people to hand over their bank details [or whatever].
Doing this it helps to have as much 'secret' information as possible so that you can plausibly pretend to be whoever you are impersonating [like say an ISP]. The information on the unencrypted landing page for the router prior to login is not only useful for launching further attacks on the router and home network. But it includes information that can be used for future spear phishing attacks on the user [most notably the broadband username... which will also give you a good idea as to plusnet email addresses...]
I don't need to do pen testing to be able to point this out to Plusnet and say "hey, maybe you don't want to have this information visible on your landing page before you log in!" ...
I mean do I actually have to launch a spear phishing attack* to prove that this is viable or can we all just use experience and say, "oh yeah that's totally information that would be useful to criminals, we should do a better job protecting that."?
If this router were handed to any competent pen-tester they would undoubtedly find countless bugs/out of date software/etc. And any good dev team for this kind of product should employ red team/blue team testing to do just that. [as well as a bug bounty program].
But we're currently at the first stage of "hey, have you guys heard of this thing called encryption?".
Let’s try putting a door in the frame before we start working on what kind of lock it has.
*To be clear, I'm not going to do this.
If seeing is beleiving... Then what happens when what you're seing is an Illusion?
