Telekom Knew About the Speedport Vulnerability
This translation was generated automatically.
One detail about yesterday’s widespread outage among Telekom DSL customers is often missing from mainstream coverage.
Everything suggests this was a variation of the TR-069 vulnerability disclosed by Check Point in 2014. At the time, German providers, including Telekom, declared their networks secure.
The fundamental issue with the TR-069/064 remote-management interface has been public for at least two years. It potentially affects not only the Speedport routers hit yesterday, but all kinds of routers.
Yesterday’s outage therefore seems very much self-inflicted by Telekom, and could easily have been prevented, because:
Internet traffic was forwarded to routers on port 7547, the port used for this purpose. I can’t think of a legitimate reason for that.
The underlying problem was known, and the countermeasures in Telekom’s own network were inadequate. If attacks on this port have been known for years, and legitimate access should come only from Telekom’s support network, the port should have been blocked from internet access years ago.
Telekom spokespersons’ statements obscure the company’s own negligence.
Telekom cybersecurity chief @Ttschersich on attacks against remote-management interfaces worldwide. Telekom’s network was not affected. ^lr image — Deutsche Telekom AG, November 28, 2016
For a long time, remote management (“Easy Support” at Telekom) couldn’t be disabled on rented Speedports. The documentation now says you can. Update: rental-router contracts still prohibit it.
An effective workaround could have been used on Sunday: boot the router without the DSL cable and disable remote management. But that would have increased future support costs or prevented further security updates, because the automatic updater could no longer be triggered. The remote-management interface is a major risk, and open access to it from the internet should have been abandoned at least two years ago.
[Details of the attack at ISC]