As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
">Friday Squid Blogging: Catching Humboldt SquidThere’s a travel scam warning going around the internet right now: You should keep your baggage tags on your bags until you get home, then shred them, because scammers are using luggage tags to file fraudulent claims for missing baggage with the airline.
First, the scam is possible. I had a bag destroyed by baggage handlers on a recent flight, and all the information I needed to file a claim was on my luggage tag. I have no idea if I will successfully get any money from the airline, or what form it will be in, or how it will be tied to my name, but at least the first step is possible...
">Baggage Tag ScamTL;DR: Discovered an unpatched zero-day in TP-Link routers (AX10/AX1500) that allows remote code execution. Reported to TP-Link on May 11th, 2024 - still unpatched. 4,247 vulnerable devices found online.
Used automated taint analysis to find a stack-based buffer overflow in TP-Link's CWMP (TR-069) implementation. The vulnerability exists in function sub_1e294 that processes SOAP SetParameterValues messages.
Key Technical Details:
pc = 0x42424242 (full control)// Vulnerable code pattern char* result_2 = strstr(s, "cwmp:SetParameterValues"); // Size calculated from user input - BAD PRACTICE strncpy(stack_buffer, user_data, calculated_size); // OVERFLOW! Exploitation requires setting a malicious CWMP server URL in router config, then device connects and gets pwned.
Affected Models:
Firmware Versions: 1.3.2, 1.3.8, 1.3.9, 1.3.10 (all vulnerable)
Internet Exposure: 4,247 unique IPs confirmed vulnerable via Fofa search
Router security is often terrible - default passwords, weak configs, other vulns. Getting config access isn't that hard, and setting up a rogue CWMP server is trivial. Once you change the TR-069 server URL, the router connects to your malicious server and you get root.
