Exploring the UNKNOWN: Scanning the Internet via SNMP!
Hacking is not only about coming up with interesting solutions to problems, but also about exploring the unknown. It was this drive for knowledge
philosophy that lead to surveying a significant sample of the Internet which allowed us to make some VERY interesting observations and get an idea of the current state of remote SNMP hacking.
Why SNMP?
2.5 million random IP addresses were surveyed via SNMP. Why SNMP you might be asking? Well, there are several reasons. First of all SNMP is a UDP-based protocol which allows us to perform scanning at a much shorter time than via TCP-based protocols. Another advantage of UDP-based protocols is that the source IP address can be spoofed easily. In the case of SNMP, it means that an attacker could change configuration settings from a spoofed IP address provided that a valid write community string is identified or cracked. Needless to say changing config settings via SNMP can lead to a full compromise. Finally, we have been very involved researching embedded devices lately, and since a significant amount of Internet devices are hackable via SNMP, such protocol was an obvious candidate.
When SNMP read access is all we need for successful pwnage
Gaining SNMP write access is of course usually considered to be a more serious issue than gaining SNMP read access only. However, even if a cracker only gained read access to a device/server via a SNMP community string, sometimes it would possible to extract sensitive information such as usernames and passwords which would eventually lead to a compromise of the targeted systems. In order to accomplish this, all that is needed by the attacker is knowledge of an interesting OID to query. My point is that SNMP read access could be enough to fully own a device!
Examples of juicy leaks via SNMP read access
For instance, Windows servers return the full list of usernames by snmwalking the OID 1.3.6.1.4.1.77.1.2.25. Or how about the BT Voyager 2000 router leaking the ISP credentials including the password? Oh, wait, I almost forgot to mention HP JetDirect printers leaking the admin password via SNMP read access (using OIDs .iso.3.6.1.4.1.11.2.3.9.4.2.1.3.9.1.1.0 and .1.3.6.1.4.1.11.2.3.9.1.1.13.0). And of course the recently disclosed Dynamic DNS credentials disclosure on ZyXEL Prestige routers via the OID 1.3.6.1.4.1.890.1.2.1.2.6.0 (see section 2.2 in the paper for more details). You get the point: lots of devices leak way too much information via SNMP read access.
The juicy survey stats!
From a total number of 2.5 million random IP addresses, 5320 IP addresses responded to the submitted SNMP requests. Although this is only %0.2128 of all the IP addresses, we need to keep in mind that most Internet systems with SNMP support correspond to embedded devices, which only make a small portion of the Internet. One query was sent to each random IP using the community string public, which is often used as the default read community string. The OID queried on each request is 1.3.6.1.2.1.1.1.0 which is the system description (usually returns brand and model). The destination port used was 161/UDP. Although some systems used different default port numbers for SNMP daemons, 161 is definitely the most common one.
In order to protect the innocent, we hid the first two octets of the IP addresses included in our results CSV file:
cat ./2dot5million-random-ips.csv | while read line
do
echo -en '*.*.'>>./2dot5million-random-ips.hidden.csv;
echo $line | cut -d "." -f 3- >> ./2dot5million-random-ips.hidden.csv
doneThe most common systems found were the following:
- ARRIS Touchstone Telephony Modems - these VoIP modems alone made more than 35% of all found devices discovered!
- Cisco routers
- Apple AirPort and Base Station
- ZyXEL Prestige routers
- Netopia routers
- Windows 2000 servers
Obviously, what kind of SNMP-enabled devices are the most popular on the Internet is very interesting information from a research point of view. For instance, if researching remote SNMP vulnerabilities, it would make sense to focus on a type of device that is widely-spread through the Internet. I’ll leave you guys to make your own observations by reading the results CSV file.
Comments
Hmm, this method is indeed quality scanning. I’ll surely be reading about quite often now. Great post pdp, read access is becoming a little thin now in all cases, not just SNMP ;)
Hi,
This is an interesting information. Why not check for the default passwords in routers worldwide (like enable passwords in routers)..It will be more interesting!!!
For the devices did the firmware/service package version matter at all?
You got replies in just 5320 out of 2.5 million IPs. That’s great. Did you actually find anything sensitive in this list? Anything that could be owned via SNMP read access? Any write access?
I wonder how many of those 5320 hits have worse things to worry about than SNMP due to misconfigurations?
That’s great that you mentioned a couple juicy leaks via SNMP, but did your scan actually come up with any, or was that simply theoretical “could happen?”
Yousif: Thank you for your feedback Yousif, however, this is ap, rather than pdp :) As you know we’re a few in the group (http://www.gnucitizen.org/about/), although pdp is the most active researcher.
@Nlbin: we could do that, but that would mean crossing the line which we do NOT do :-)
@questionallthings: I’m not sure if I understand your question, but I can tell you that knowing specific firmware type and version would allow attackers research public exploits that work for such firmware type/version combination.
LonerVamp, obviously we cannot go ahead and start exploiting or testing these devices! saying that, everything is theoretical. But the point of the experiment was very different. Our goal was to sample publicly available SNMP device as we find that people ignore SNMP, don’t ask, don’t know why. Given the fact that most embedded devices we have encountered so far, have some seriously screwed up SNMP implementations, we find this research very interesting. Therefore, we wanted to share it with the rest of the security community as it may come handy. That’s all!
Hi
I have a 660H-61 Router.
I have three questions to your pdf doc.
1.) All your discovered holes are only a security problem if the webinterface or snmp open on the wan, and if i had no attackers in the lan! Is that right?
2.) in the snmp (read/write) test my router is not vulnerable (according to your document). What is the reason? snmp disabled or what?
4.) If in the Firewall rules no SNMP rule, is the port also open to the wan?
3.) How can i snmp disable? in telnet i haven’t found a option!
Thanks very much!
sniffz
Unfortunately, a large majority of those Arris Touchstone modems are probably not under the control of the people who use them. They are probably controlled by a service provider or ISP. It is not generally possible to put anything between your cable modem and the internet, so it is often impossible for the user to protect these devices against SNMP attacks.
Can it be adapted for SCADA?
@sniffz: our SNMP experiment covers devices with SNMP daemons visible from the Internet (WAN interface).
1) However, since you own a ZyXEL router you should know that we found that many ISPs ship these routers with SNMP enabled on the *WAN*. Once you discover a ZyXEL router with SNMP reachable from the Internet you’ll find out that many adjacent ZyXEL routers that belong to the same netblock suffer the same problem!
2) Please specify the section/page of the paper. Most likely it means that SNMP is *not* enabled with read and write access by default.
3) It *is* if SNMP is enabled and configured to be visible from the WAN interface (you can check this via the web and telnet interface)
4) We recommend you to disable SNMP which is explained in your router’s manual (you should be able to do it via Telnet).
@rezn: I guess that makes finding a vulnerability on these devices even more serious! This is another example of ISPs shipping devices with insecure default configurations.
@ady: adapting the research for SCADA could be done of course. Maybe you want to do it and share the results?
@Adrian Pastor
1. Ok, my Zyxel 660H-61 haven’t any SNMP Firewall rule.
2. It’s section 2.2. And my Router is not listen as vulnerable.
3. I havent’t any snmp configuration page in the webinterface. In telnet i saw the same picture, you have in the pdf. But there i can’t disable SNMP!
4. I haven’t found any option to disable snmp!
Thanks!
have you scanned specific range or totally randomness ?
I am a programmer that needs to be able to reset via snmp Netopia routers.
How is this accomplished? Do you know?
@sniffz: if your model is NOT listed as vulnerable does NOT mean is NOT. Pasted from page 2 in the paper:
”
Other ZyXEL models not mentioned in this paper might also be vulnerable to the same issues discussed. Additionally, not all ZyXEL models mentioned in this paper have been tested for the same vulnerabilities due to time constraints and lack of full unrestricted access (i.e.: full administrative access was not possible during a penetration test).
”
I recommend you reading the manual for your model in order to find out how to change the default SNMP community strings, or restrict SNMP access from trusted IP addresses only: http://www.zyxel.com/DownloadL.....T).pdf
@sniffz: sorry, they link in the previous comment broke. Try this one instead: http://snipurl.com/217ow
@nex: the scan was done on completely random IP addresses.
I think you just admitted to breaking the Computer Misuse Act 1990.
Please explain yourself!
ok! thank’s for the information.
@CMA1990: what do you mean? No vulnerability was probed/exploited whatsoever. This is NO different to Google bots visiting websites or any other company that surveys Internet servers for research reasons.
I Judge Dredd condemn you under article:
1(1) of computer misuse act 1990
A person is guilty of an offence if:
a) He causes a computer to perform any function with intent to secure access to any program or data held in a computer;
b) the access he intends to secure is unauthorized; and
c) he knows at the time when he causes the computer to perform the function that this is the case.
you’ve used known default passwords to access other information without authorization, thus securing vital/security related information.
this is equivalent to using default admin passwords on an insecure website, and retrieving sensitive information or performing defacement.
JD>”How do you plead”;
GNUC>”Innocent!!!!”
JD>”How did I know you’d say that, I find you Guilty under all 3″
– Judge Dredd
Dear Judge Dredd, you’ve accessed this GNUCITIZEN post without authorization. Please explain, or will take legal actions against your unethical, intrusive behavior.
Here is how your actions reflect on the computer misuse act:
1) He causes a computer to perform any function with intent to secure access to any program or data held in a computer;
- you’ve tried to compromise our systems by submitting meta characters such as “, < , > and ‘, things that can potentially lead to SQL Injection and backend compromise.
2) the access he intends to secure is unauthorized; and
- we have never gave you any sort of authorization. We never give such privilege to trolls. We have never give you authorization to post meta characters on this post or to access the GNUCITIZEN domain.
3) he knows at the time when he causes the computer to perform the function that this is the case.
- your intentions are more then clear.
:)
Sure, I see snmp services being advertised all the time. I also use google to search then out. Communities are used for auth, trying the default is no different from trying the default at a telnet password prompt. CMA sunshine.
caught red handed in real life?
view the following article
http://isc.sans.org/diary.html?storyid=4175
10x Judge for keeping us up-to-date. Much appreciated.
The hits reported as Windows 2000 are also Windows XP. Windows XP claims Windows 2000 but reports version 5.1 build 2600 on the same line. There was also one Windows 2003 that reported as Windows 2000 version 5.2 . It looks like a handful (likely larger since this is only a sampling) of unwise Windows XP users installated SNMP, and then opened that in Windows Firewall, or otherwise didn’t implement Windows Firewall.
@Digicat: You’re right. The WinXP agents claims to be “Windows 2000″ but still leak the fact that they’re XP by revealing the “5.1″ version rather than “5.0″. And you’re also right when you say that there was one Win 2K3 box (5.2):
“Hardware: x86 Family 6 Model 15 Stepping 6 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Uniprocessor Free)”
However, it’s still correct to say that most Windows boxes found were Windows 2000 (5.0).
Funny enough there was also a Win98 box?!! I wonder if it’s a honey pot: “Microsoft Corp. Windows 98.”
I’ve been working on SNMP security for some time now its definitely an interesting subject with lots of potential.
Side-note: I can’t seem find the link to the paper?
–
Yash Kadakia
CTO, Security Brigade
http://www.securitybrigade.com
Penetration Testing, PCI DSS Compliance, Security Consulting etc.
@Yash: the paper can be found here: http://www.procheckup.com/Hack.....teways.pdf
SNMP security is indeed an interesting subject!
What is a good snmp scanner?
for linux.
@defcon: there are many SNMP scanners for Linux out there implemented in Perl i.e.: http://www.ernw.de/download/snmpattack.pl.
You can even write a “home-made” one in bash by wrapping around the ’snmpget’ (from the net-snmp package) command and requesting the ’system description’ OID.