Spark Smart Modem vulnerable?

Forums › Spark New Zealand (including Skinny and BigPipe) › Spark Smart Modem vulnerable?

1 | 2 | 3 | 4

107 posts

Master Geek
+1 received by user: 11

#2765003 22-Aug-2021 18:06

Gordy7:

@steve2222

For my Smart Modem up-time I use: WLan, Access Points page.

It doesn't show actual fibre data up time but does give you an indication when the modem/router was rebooted or repowered.

Or you could check the log and see if there's a reboot entry.

Gordy7

gordy7
2016 posts

Uber Geek
+1 received by user: 508

ID Verified

Lifetime subscriber

#2765011 22-Aug-2021 18:23

firewire:

Gordy7:

@steve2222

For my Smart Modem up-time I use: WLan, Access Points page.

It doesn't show actual fibre data up time but does give you an indication when the modem/router was rebooted or repowered.

Or you could check the log and see if there's a reboot entry.

If you're not on a Spark network the log does not have a correct time stamp.

Gordy

My first ever AM radio network connection was with a 1MHz AM crystal(OA91) radio receiver.

Talkiet

4823 posts

Uber Geek
+1 received by user: 3947

Trusted

#2765040 22-Aug-2021 19:26

That is a different filename and MD5 than the file I was given internally. It LOOKS like it's legit given the source but I'd advise not using it until I have checked. Ping me midday tomorrow if I haven't come back by then.

(MD5s)

From the linked site (V6.00.18_build02) - 7D17CBD8B1AB6D770343D5FC4D5B6FCA

My internal file (V6.10.18_build02) - 95697E4004C31917A73495408B063D79

Cheers - N

Please note all comments are from my own brain and don't necessarily represent the position or opinions of my employer, previous employers, colleagues, friends or pets.

Gordy7

gordy7
2016 posts

Uber Geek
+1 received by user: 508

ID Verified

Lifetime subscriber

#2765475 23-Aug-2021 15:15

@Talkiet

Talkiet:

That is a different filename and MD5 than the file I was given internally. It LOOKS like it's legit given the source but I'd advise not using it until I have checked. Ping me midday tomorrow if I haven't come back by then.

(MD5s)

From the linked site (V6.00.18_build02) - 7D17CBD8B1AB6D770343D5FC4D5B6FCA

My internal file (V6.10.18_build02) - 95697E4004C31917A73495408B063D79

Cheers - N

Looking forward to an official Spark download site for the Smart Modem firmware update... Thanks. Gordy.

Gordy

My first ever AM radio network connection was with a 1MHz AM crystal(OA91) radio receiver.

Talkiet

4823 posts

Uber Geek
+1 received by user: 3947

Trusted

#2765495 23-Aug-2021 16:04

Sorry, waiting for a legit host to use rather than post it on a random URL.

I have found out that you should refrain from flashing the Skinny FW onto the Spark supplied modems... In normal operation this is all automated through our ACS so not a problem but with manual updates, is worth noting.

I promise I am following up daily with the right team to find a place for this but we've got a lot on our plate right now with everyone wanting to use ALL THE INTERNETS, ALL THE TIME. :-)

I can say that continued monitoring has shown that the Spark/Skinny/BP modems are not vulnerable to the published attack to the urgency for the patching of subcomponents of it is not as urgent as we feared it might be - but we'll get the new version available to people soon. (Note that it should have pushed to all on-net devices already)

Cheers - N

Please note all comments are from my own brain and don't necessarily represent the position or opinions of my employer, previous employers, colleagues, friends or pets.

Gordy7

gordy7
2016 posts

Uber Geek
+1 received by user: 508

ID Verified

Lifetime subscriber

#2765544 23-Aug-2021 16:10

Thanks for your update.

Will the Spark FW be ok for a Skinny Modem?

Gordy

My first ever AM radio network connection was with a 1MHz AM crystal(OA91) radio receiver.

Dell

Shop now for Dell laptops and other devices (affiliate link).

Talkiet

4823 posts

Uber Geek
+1 received by user: 3947

Trusted

#2765547 23-Aug-2021 16:12

Gordy7:

Thanks for your update.

Will the Spark FW be ok for a Skinny Modem?

I believe it will, but will confirm when I have a file to post. If not then I'll also post the image for Skinny

Cheers - N

Please note all comments are from my own brain and don't necessarily represent the position or opinions of my employer, previous employers, colleagues, friends or pets.

Talkiet

4823 posts

Uber Geek
+1 received by user: 3947

Trusted

#2766320 25-Aug-2021 09:00

Sorry it took so long (but as pointed out the modems are not vulnerable to the attack as the most important vulnerability didn't exist in our device) - but here is the Spark firmware image for the VRV9517 that you can apply if your modem is not on the Spark network.

https://www.spark.co.nz/help/internet/security/spark-smart-modem-firmware-update

If you have a Skinny modem that you are using on a non-Skinny connection, you will need to call in to their Skinny helpdesk. I have been advised that they will make the FW available specifically to those customers that request it, even if you are not a current Skinny customer.

Cheers - N

Please note all comments are from my own brain and don't necessarily represent the position or opinions of my employer, previous employers, colleagues, friends or pets.

Gordy7

gordy7
2016 posts

Uber Geek
+1 received by user: 508

ID Verified

Lifetime subscriber

#2768400 29-Aug-2021 15:56

Looks like no luck getting firmware 6.00.18 build02 from Skinny to suit their Smart Modem....

Response from Skinny techsupport@skinny.co.nz

We do not have a file for you to download, these updates are done automatically every Monday when the modem is connected on the Skinny network, and even though we are a subsidiary of spark they do not make the process for Skinny so I am sorry to say I cannot help you with this request.

My email enquiry:

Thanks for your email.
As I recently left Skinny the latest firmware will no longer be pushed out to my Skinny Smart Modem.
My Skinny Modem has 6.00.17 build04.
Spark has made available 6.00.18 build02 as a user download file to protect their Smart Modem from a vulnerability issue.
Spark has advised that Skinny will make the newer firmware available to users of the Skinny Smart Modem on request even if the Modem user is not currently a Skinny customer.
Hence my request for a download file for firmware 6.00.18 build02 to suit the Skinny Smart Modem.

Thanks
Regards

Gordy

My first ever AM radio network connection was with a 1MHz AM crystal(OA91) radio receiver.

Gordy7

gordy7
2016 posts

Uber Geek
+1 received by user: 508

ID Verified

Lifetime subscriber

#2768404 29-Aug-2021 16:06

Out of curiosity I just did a Windows File Compare for the firmware 6.00.18 build02 from Spark and from Github(Bigpipe/Spark/Skinny).... no differences found.

So I might just update my Skinny Smart Modem with the Spark firmware.

Edit: Successfully updated my Skinny Smart Modem with Spark firmware 6.00.18 build02.

All my settings and the Skinny logo were retained. I did not try a hard reset.

Gordy

My first ever AM radio network connection was with a 1MHz AM crystal(OA91) radio receiver.

joajoa

5 posts

Wannabe Geek
+1 received by user: 1

#2768452 29-Aug-2021 17:36

I use skinny modem with stuff fibre.

AliExpress

Shop now on AliExpress (affiliate link).

Gordy7

gordy7
2016 posts

Uber Geek
+1 received by user: 508

ID Verified

Lifetime subscriber

#2768735 30-Aug-2021 11:53

joajoa:

I use skinny modem with stuff fibre.

I have my Skinny Modem on Slingshot.

Although Neil indicated there was not problem with the Modem vulnerability on the Spark network, now that I am on Slingshot I wanted the latest firmware just to be safe.

Thanks joajoa for the Github(Bigpipe/Spark/Skinny) firmware link...

Gordy

My first ever AM radio network connection was with a 1MHz AM crystal(OA91) radio receiver.

Talkiet

4823 posts

Uber Geek
+1 received by user: 3947

Trusted

#2768748 30-Aug-2021 12:09

The relevant parties have been informed of the less than idea support experience there, especially after I was advised there was a process.

I should also be clear that while we put in place network level mitigations for the known attack, the main reason for that was to verify if any customers had been infected (we would have been able to see traffic to the C2 address). We observed zero unexpected traffic to that address and further followup with the vendor showed that a critical CVE required for the current E2E exploit was NOT present in the firmware we have deployed to date on the Spark or Skinny routers.

This means that even if you take an "unpatched" router to another network, it is not vulnerable to the currently known remote attack vector through 2 levels of mitigation. 1) The remote web access service is disabled by default and 2) The CVE that leaks the auth token isn't present on the Spark or Skinny firmwares.

I'm still following up getting the FW for Skinny either available, or an official statement that the Spark FW is good for it (and yes a matching MD5 seems like a good indication!) - but until then you shouldn't worry about using the routers on another network.

Cheers - N

[edit - I see you did a windows file compare - not MD5 - should be similar results... Also, are you able to send me the direct link of the skinny file you downloaded please]

Please note all comments are from my own brain and don't necessarily represent the position or opinions of my employer, previous employers, colleagues, friends or pets.

Gordy7

gordy7
2016 posts

Uber Geek
+1 received by user: 508

ID Verified

Lifetime subscriber

#2768786 30-Aug-2021 13:30

Thanks for the update Neil.

Here are the links from joajoa's post earlier in this thread.

https://gist.github.com/svbnet/9efc44917b08fdbe5105f9f707cfa918

https://www.bigpipe.co.nz/assets/firmware/skinny/VRV9517_v6.00.18_build02_256_close.w

Thanks also for the confidence given for the Smart Modem when used on a non Spark network.

Gordy

My first ever AM radio network connection was with a 1MHz AM crystal(OA91) radio receiver.

Talkiet

4823 posts

Uber Geek
+1 received by user: 3947

Trusted

#2769299 31-Aug-2021 11:45

Right, finally have been able to confirm that the Spark firmware can be loaded on Skinny sourced modems. (obviously with a matching MD5 they could - but I had to get the confirmation from the right person!)

Cheers - N

Please note all comments are from my own brain and don't necessarily represent the position or opinions of my employer, previous employers, colleagues, friends or pets.

1 | 2 | 3 | 4