Re: Speedtouch 510 DOS

[Kenny Gryp]

> Speedtouch 510 ADSL Modem/FW/Router
>
> We have been attempting to run NMAP and NESSUS scans using a new ADSL
> cable link. Using the ADSL modem mentioned above, we found that a
> standard NMAP/NESSUS scan of an IP range would force the router to
> reboot itself after 20 seconds. Thinking this was faulty hardware we
> replaced it with another brand new Speedtouch...to find the same
> problem occurred. Having talked to Thomson, they simply dismissed it
> as faulty hardware....but twice?
>
> Anyone else found this problem, or can they confirm?

A nmap scan with os detection can make the Alcatel Speedtouch Home
ADSL Modem reboot. This was found in 2002, but no workaround exists as
far as i know.

Xforce Database: http://xforce.iss.net/xforce/xfdb/7893
Post on bugtraq:
http://archives.neohapsis.com/archives/bugtraq/2002-01/0150.html

The router has a different name and looks different, but the routers
have similar specifications, so maybe it's the same router in another
box.

Kenny Gryp
--
http://gryp.dakin.be - gryp@dakin.be

[Thomas Chopitea]

I do have a Speedtoucht 510 ADSL Modem, but had never encountered this
"problem" before.
Maybe it is because technology here is less advances than in other countries
and the modem you tried had a newer software, at an early version.
If it is of any relevance, I have not tried on scanning a big IP range (of
course, using nmap or nessus)


----- Original Message -----
From: "Kevin Milne" <kevin.milne@email.com>
To: <bugtraq@securityfocus.com>
Sent: Tuesday, November 25, 2003 5:40 AM
Subject: Speedtouch 510 DOS


> Speedtouch 510 ADSL Modem/FW/Router
>
> We have been attempting to run NMAP and NESSUS scans using a new ADSL
cable link. Using the ADSL modem mentioned above, we found that a standard
NMAP/NESSUS scan of an IP range would force the router to reboot itself
after 20 seconds. Thinking this was faulty hardware we replaced it with
another brand new Speedtouch...to find the same problem occurred. Having
talked to Thomson, they simply dismissed it as faulty hardware....but twice?
>
> Anyone else found this problem, or can they confirm?
>
>
> --
> __________________________________________________ _________
> Sign-up for Ads Free at Mail.com
> http://promo.mail.com/adsfreejump.htm
>
>
> __________ NOD32 1.563 (20031125) Information __________
>
> This message was checked by NOD32 Antivirus System.
> http://www.nod32.com
>
>

[Astharot]

----- Original Message -----
From: "Kevin Milne" <kevin.milne@email.com>
To: <bugtraq@securityfocus.com>
Sent: Tuesday, November 25, 2003 5:40 AM
Subject: Speedtouch 510 DOS


> Speedtouch 510 ADSL Modem/FW/Router
>
> We have been attempting to run NMAP and NESSUS scans using a new ADSL
> cable link. Using the ADSL modem mentioned above, we found that a standard
> NMAP/NESSUS scan of an IP range would force the router to reboot itself
> after 20 seconds. Thinking this was faulty hardware we replaced it with
> another brand new Speedtouch...to find the same problem occurred. Having
> talked to Thomson, they simply dismissed it as faulty hardware....but twice?
>
> Anyone else found this problem, or can they confirm?

I have an Alcatel Speedtouch Home with Firmware update to 510 and I haven't this
problem.

Cheers
Astharot
--
Zone-H Administrator - http://www.zone-h.org - astharot @ zone-h.org
GPGKey http://astharot.gife.org

Italian Linux Society (ILS) Member - http://linux.it/ILS - gerardo @ linux.it

glider .O.
..O
OOO the hacker emblem

[Bart van Leeuwen]

The problem as you mention it is something that I have seen as well.
For all I have been able to find, it has to do with the load on the
ethernet port and very likely, with the occurance of collisions on the
ethernet segment it is connected to.

Currently, my modem is connected to a dedicated router with a crosslink,
and I have no problem whatsoever. However, as soon as I use a hub to
connect multiple machines to it, and create substantial load on the
segment so that collisions start occurign regularely, the behavior as
you describe occurs. This is regardless of if the modem has to 'route' the
traffic or not, local traffic will do the trick as well, as long as the
modem gets to see it on its ethernet port.

I have 2 such modems, and tried with 2 borrowed ones, and in all cases the
behavior is identical.

I have not been able to recreate this behavior with an outside attack.

On another note, it seems to be able to overflow the NAT table of the
modem by bombarding it with incomming connections for a port for which an
inbound mapping has been made (no surprise that it is possible, but the
ease with which it is possible is amazing), which will affect every other
inbound nat definition, and will make the browser based user interface
fail.

Id you have to use this modem anyway, use it with a dedicated link to a
machine that is gonna do ppoe and all the nat stuff..

regards, Bart.