|
| From: | L0PHT | | Date: | 10.05.2000 | | Subject: | NetStructure 7110 console backdoor |
@Stake Inc.
L0pht Research Labs
www.atstake.com www.L0pht.com
Security Advisory
Advisory Name: NetStructure 7110 console backdoor
Release Date: May 8th, 2000
Application: Intel NetStructure 7110 (previously the Ipivot
Commerce Accelerator 1000)
Severity: Box can be compromised through configuration serial
port. (potentially remote)
Status: Vendor contacted, advisory publicly released.
Full Advisory: http://www.l0pht.com/advisories/ipivot7110.html
Author: oblivion@atstake.com
Thanks: dildog@atstake.com
mudge@atstake.com
Overview:
---------
The NetStructure 7110 can be compromised via the admin console
even after the admin password has been changed. An undocumented command
list exists known as 'wizard' mode. Through this mode there is a
password that overides the admin password and allows full access to the
internal components of the NetStructure 7110. This password can be
used from within the admin command line interface or to overide the
admin password at an initial login prompt.
This undocumented shell password is derived from the primary
ethernet MAC address of the NetStructure 7110. During the boot process
and before every login, the serial number (the primary ethernet MAC
address), is presented to the user on the console port. Running the MAC
address into our Ipivot password generator will supply the user with a
default shell password. The mechanism to change this shell password is
undocumented as well. The shell password gains the console operator root
privleges on the Ipivot with access to gdb, tcpdump, among other
utilities and xmodem to upload other tools.
Description:
------------
The NetStructure 7110, was originally a product of Ipivot, and
named the Ipivot Commerce Accelerator 1000. The oversight affects
NetStructure 7110 as shipped in April 2000.
-The administrator password is overridden by an undocumented shell
password.
-The shell password is derived from the primary ethernet MAC address
of the NetStructure 7110.
-In most of the command interface for the NetStructure 7110, interrupts
are ignored. However, the password prompt section does not block
interrupts. When an interrupt is received in this section, the
initial login banner is re-displayed. This banner contains the
ethernet address of the machine. This banner is also displayed after
power-cycling or when exiting a valid session.
-The method to change the shell password is undocumented.
-Additionally, The shell password is recoverable from the 'admin'
account. The running configuration file does not contain an
explicit entry for the shell password. Thus, initial runs of the
'show config' do not display any elements referencing the shell
password. However, by attempting to change the shell password via
the 'shpass' command, the entry is created. This happens even if
the attempt to change the password failed. Subsequent calls to
'show config' will now show the shell password. The steps to
recreate this follow:
1. enter wizard mode by typing 'wizard'
2. attempt to change the shell password via the 'shpass'
command.
3. show the new config via the 'show config' command
This leaves all Ipivot/NetStructure 7110's with an undocumented backdoor
which can be accessed through the console port, gaining the unauthorized
user root privledges on the box, above those privledges granted to the
admin password holder. A few data points make this problem particularly
disturbing:
. The Ipivot is the device converting https (encrypted)
to http (unencrypted).
. Network sniffing utilities are installed on the Ipivot
by default.
. The secret material that the password is derived from
(the ethernet address) can be forced to be displayed at
the login prompt.
. The console port is recommended to be hooked up to a
modem in order to perform remote management.
Solution:
---------
1. Change the admin password after the first login.
2. Next, Type 'wizard'. You are now in an undocumented command mode.
3. Type 'shpass' and change the shell password. Warning: Do not set the
shell password to the same as the cli password.
4. Type 'config save'.
NOTE: The wizard mode has been known in the computer security community
for many months.
Vendor Response:
----------------
As a result of this advisory Intel has:
1. Setup a security-info mail account which one can notify
Intel of security issues on their product, where one
previously did not exist.
2. Provided patches for all customers at the following URL:
http://216.188.41.136 or through an 800 number for customers
with maintenance agreements.
Although we were surprised that Intel had no central mechanism to
handle security reports on their product lines, we applaud them
in creating such a service and encourage other manufacturers to
follow suit.
Intel's email response:
>
> _______________________________________________________________________
>
> 7110 Vendor Response
>
> Intel Corporation takes all comments and publications about the
> security of our equipment seriously. The solutions offerred in
> the security alert highlight many of the security recommendations
> already present in the user documentation. In addition, Intel has
> proactively produced an 'update' which will do the following:
>
> Overview
>
> This update disables login access to the 7110's service shell account.
>
> Applicability
>
> The NetStructure 7110 software updates and documentation are available
> at the following location http://216.188.41.136. In addition,
> information requests can be sent to security-info@ned.intel.com.
>
Proof of concept tool:
----------------------
We will make the proof of concept tools available 5-15-2000 to independently
verify and address the problem.
PalmOS prc and unix source available at:
http://www.l0pht.com/advisories/ipivot.tar.gz
PS: Special thanks to cameo for her inital musings over the ipivot 1000
and the wizard mode.
|
