Beware! More Than 135 Million Modems Are Vulnerable To DoS Attack
Short Bytes: A newly discovered flaw in the Arris modems has risked more than 135 million modems to DoS attacks. The flaw allows a hacker to trick the user into clicking a malicious link that could result in the total disruption of the internet service on the network.
A new vulnerability has been found in the modems being used in the millions of US households. It is said to be affecting more than 135 million modems that could result in the disruption in the internet service.
This flaw lets an attacker cut off the entire network from the internet until the user calls the ISP to resume the services. This vulnerability allows the attacker to remotely access the device, reset it, and cause a denial-of-service attack by wiping out the ISP’s settings.
This problem has developed due to the improper way of handling authentication and cross-site request in the widely-used model the Arris Surfboard SB6141.
The flaw is very easy to exploit even for a newbie and anyone on the affected network can be tricked into clicking a malicious email or web page.
Security researcher David Longenecker found and reported this flaw and released the exploit after Arris stopped replying to his emails. It’s very surprising to note that this flaw dates way back to 2008, even before Arris acquired Motorola’s networking unit.
This flaw is easily patchable and needs a firmware update from Arris. Since the cable modems are not consumer-upgradable, this patch can be only applied if the ISPs push the update to the consumers.
Arris has issued a statement saying that it has addressed the issue by releasing a firmware update:
“We are in the process of working with our Service Provider customers to make this release available to subscribers,” said Arris. “There is no risk of access to any user data and we are unaware of any exploits.”
–David Longenecker at Security for real people
