Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
   Glossary   Glossary
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Pages: 1 ... 8 9 [10] 11 12 ... 16

Author Topic: BT Home Hub 3.0 - Type B  (Read 206383 times)

SecTSys

  • Member
  • **
  • Posts: 84
  • I only work with HTCPCP
    • Putney Computers Facebook page
Re: BT Home Hub 3.0 - Type B
« Reply #135 on: November 15, 2012, 11:48:02 PM »

I agree with you there Kitz - it would make sense for them to open up the routers more rather than lock them down, -

It is a well known fact that 99.8% of the software available on opensource and GPL is Virus free and very very secure. - simply because the access to the coding is there and people can see what is happening and what is being done.
If there is a small something that BT could do at the very least is allow us to see a list of firmwares released and provide a link to a copy of said firmware.

Even if it is completely locked down at least the provision of the firmware will allow people here and on psydoc for example to look at the possible exploits and methods of securing the router whilst allow a user more flexibility, plus with them unlocking the router by default to allow other ISPs onto the BT HH3, it would mean that we would be happier knowing that the only exploits we would need to do is out of self satisfaction rather than neccesity. It also means - as zach even agreed that one of the UKs more secure routers that is available on the market. will be selling more readily making their profits a little happier, and when our routers break down because of our modding we won't need to ask them for a new router - instead we would be able to re-install the firmware and attempt a recovery of the device ourselves.

Now doesn't that make better business sense too.
Logged
Visit the Live Gaming Website STSLG Website
Visit my YouTube gaming channel at STS Live Gaming

btsimonh

  • Member
  • **
  • Posts: 20
Re: BT Home Hub 3.0 - Type B
« Reply #136 on: November 16, 2012, 07:43:32 PM »

The best option now would be for BT to release the open source and allow those who want to to use other firmware on the device if they wish by providing a firmware update mechanism.
Of course the trouble is that the router suppliers have done a deal with the ISPs that the routers are locked down, else the router suppliers lose out on sales of more open units at full price.  However, the number of routers sold as fully-featured open routers is probably small, especially from the manufacurers involved here, so maybe the likes of BT can be swayed.
It's not as though the installing of OpenWRt on a BT router reduces the security of their original firmware.... it actually absolves them of security responsibility.  It does not lose BT revenue, and probably does not lose Haiwei revenue; so what is the thing with locking these down so tight?

btsimonh
Logged

burakkucat

  • Respected
  • Senior Kitizen
  • *
  • Posts: 38300
  • Over the Rainbow Bridge
    • The ELRepo Project
Re: BT Home Hub 3.0 - Type B
« Reply #137 on: November 16, 2012, 08:44:51 PM »

There is the small matter of the Beattie Busy-Body (a.k.a. the BTAgent) that exists in the firmware of all modem/routers supplied by the BT Group plc.

As of yet, there is no public explanation as to what it does . . . so, acting the Devil's Advocate  >:D , I suggest that the BT Group does not wish to give up its ability to 'snoop' on EUs activities.  :-X  >:(
« Last Edit: November 16, 2012, 08:47:28 PM by burakkucat »
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

SecTSys

  • Member
  • **
  • Posts: 84
  • I only work with HTCPCP
    • Putney Computers Facebook page
Re: BT Home Hub 3.0 - Type B
« Reply #138 on: November 17, 2012, 03:39:21 AM »

wow ok just found this - looks like people have been trying to reverse engineer the BTAgent!!! (you may want to move this to a new topic if you wish to i don't mind)

http://huaweihg612hacking.wordpress.com/2011/08/01/what-does-the-btagent-do/ (page 1)
http://huaweihg612hacking.wordpress.com/2011/08/13/what-does-the-btagent-do-part-2/ (page 2)
http://huaweihg612hacking.wordpress.com/2011/08/14/what-does-the-btagent-do-part-3/ (page 3)
http://huaweihg612hacking.wordpress.com/2011/08/23/what-does-the-bt-agent-do-part-4/ (page 4)

(Though technically for the huawei hg612 still somewhat relevent to the subject of conversation.)

https://docs.google.com/folder/d/0B6wW18mYskvBODZjMTk1YmUtZDA0ZC00Y2NlLWEwYWItMjEyNmRjNTk0MWU5/edit?pli=1

Link to all the source codes derived from said project - and Asbokid is already aware of it it seems - having read the comments! lol)  ;)
« Last Edit: November 17, 2012, 03:51:47 AM by SecTSys »
Logged
Visit the Live Gaming Website STSLG Website
Visit my YouTube gaming channel at STS Live Gaming

btsimonh

  • Member
  • **
  • Posts: 20
Re: BT Home Hub 3.0 - Type B
« Reply #139 on: November 17, 2012, 08:30:03 AM »

There is the small matter of the Beattie Busy-Body (a.k.a. the BTAgent) that exists in the firmware of all modem/routers supplied by the BT Group plc.

As of yet, there is no public explanation as to what it does . . . so, acting the Devil's Advocate  >:D , I suggest that the BT Group does not wish to give up its ability to 'snoop' on EUs activities.  :-X  >:(

and on this router the haiwei agent too (would that be a chinese secret agent :) )

I completely understand that BT need to keep the agent source private, and the need for remote management, and that the provision of opt-in use of your hub by others to extend the BT wireless reach, but for the small minority who want to use the device with another ISP or who want to do more advanced things with the router, the ability to develop/install firmware of their choice should not be blocked.

I'm sure BT are not really concerned about the minority who want to hack the hardware from the local LAN, their problem is that they don;t need another 'BT Homehubs are insecure' scandal.  If the public (and the IT news industry) understood that the ability to access a hub at root level from the local LAN in a controlled way is NOT a security risk, then this would not be a new scandal, but unfortunately it's likely to be reported as 'another BT homhub security hole'.

Funny thing is that if the hub was Open to root access and modding, then we'd not be in a position where we have to find 'exploits', and so no scandals would be apparent.
Let's hope for BT's sake this exploit is not exploitable from the WAN :).

Logged

broadstairs

  • Kitizen
  • ****
  • Posts: 3703
Re: BT Home Hub 3.0 - Type B
« Reply #140 on: November 17, 2012, 08:58:48 AM »

This whole subject of the Agents is what worries me. I can see no reason for remote management of anything which is on my property without my full knowledge and agreement of what can be done and to my mind there is no reasonable excuse for having these tools available to a behemoth like BT.

I know from reading the stuff on that blog that the BTAgent has RSA security but no one knows who holds the private key and as far as I know BT do not publicise the existence of the agent or its use to the end user. Lets face it RSA keys are hackable and not with huge difficulty.

This to me is a significant problem and why IF I ever get FTTC I will replace the BT device with one totally under my own control. I know from a local security point of view I can secure my local network by using my own router connected to the BT kit but that would no prevent anything being done without my knowledge to the BT router which might compromise my data being transmitted across the net. I'm sure that there are folks with criminal intent right now attempting to hack these BT routers and the like for nefarious purposes, whether they succeed or not is not the point though.

Stuart
Logged
ISP:Vodafone Router:Vodafone Wi-Fi hub FTTP

SecTSys

  • Member
  • **
  • Posts: 84
  • I only work with HTCPCP
    • Putney Computers Facebook page
Re: BT Home Hub 3.0 - Type B
« Reply #141 on: November 17, 2012, 01:05:19 PM »

A Chinese Agent, A russian Agent and a BT Agent and they are sat talking in a bar, the Chinese Agent says - Our people can hack your people,

The russian Agent says, We know, but our people can wake up in your country any time we command it and set of a number of small nuclear weapons.

The BT Agent looks at the Barman and says - Lightly salted please...




« Last Edit: November 17, 2012, 01:19:11 PM by SecTSys »
Logged
Visit the Live Gaming Website STSLG Website
Visit my YouTube gaming channel at STS Live Gaming

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 33913
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: BT Home Hub 3.0 - Type B
« Reply #142 on: November 17, 2012, 04:17:43 PM »

There is the small matter of the Beattie Busy-Body (a.k.a. the BTAgent) that exists in the firmware of all modem/routers supplied by the BT Group plc.

As of yet, there is no public explanation as to what it does . . . so, acting the Devil's Advocate  >:D , I suggest that the BT Group does not wish to give up its ability to 'snoop' on EUs activities.  :-X  >:(

I havent looked into this nor had chance to read the info at the other place (Im mega busy atm and havent even caught up on here with the past few days posts yet), but one thing I do feel worthy of comment is TR-069.

I certainly dont have time to revisit the subject again, but I will say that several years ago (circa 2005?) I recall having several conversations with an ISP who were at the time considering implementing TR-069 in supplied routers.
There were several concerns that I had as an end-user such as how secure it was and if it was used to update firmware, if user config changes would be retained -  we all know such info is usually lost during a firmware upgrade.

Being the cynic I am, and not just relying on the ISP assurances, I also came home spent a few days doing my own research in order to satisfy myself that I wasn't just being fed the standard marketing hype, that some ISPs were known to do ;)
My conclusion was that although I personally would like full control over my own router.... there certainly were many benefits for both the ISP and the 'average joe-blogs type' user for using TR-069...  and most of my initial fears/worries were unfounded.
 
I would however like a function for advanced users who wanted to be in control of their own router to be able to opt out of this feature.  This is something that is largely not considered as an option especially when it comes to the likes of BT supplied routers :/

TR-069 is normally considered and most likely most well known as the protocol responsible for keeping the router firmware up to date, but there are also many other 'bolt ons' that can be added.  For example a few are:-
~ Remotely accessing router config files
~ Getting real time line stats from the router
~ Monitoring router supplied info in a similar way which the advanced user may use SNMP to monitor and access & record their line stats over a period of time.
~ Setting QoS at an ISP level for various protocols/types of traffic.


This (QoS) then leads me on to BT Fon - perhaps more commonly known as BT wi-fi -  which I should imagine is likely to be part of the BTAgent. 
BT Fon capability is installed within all of the BT supplied routers such as the Home Hubs and shares part of the EU's available bandwidth to any other BT broadband user who has opted to be part of the wi-fi community.  BT proudly claim that something like 4 million of their UK users are sharing part of their bandwidth making BT Fon one of the largest 'free' wi-fi networks available in the world.

Obviously they want they want as many of their users as possible on the BT Fon network, locking down their own supplied routers is one way of doing this.  Just how many of BT Broadband customers know that by default they are sharing their bandwidth with anyone wanting to use BT's wifi network.  Once youve installed non-BT firmware, or using your own router, then you are no longer sharing your bandwidth with the BT Fon network.


I should imagine that trying to find out exactly what the BT Agent is doing would be very hard to see for any non-BT EU as it would need to connect and authenticate with BT's ACS (servers controlling and running the TR-069 software interface at the other end).

Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 33913
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: BT Home Hub 3.0 - Type B
« Reply #143 on: November 17, 2012, 04:21:11 PM »

wow ok just found this - looks like people have been trying to reverse engineer the BTAgent!!! (you may want to move this to a new topic if you wish to i don't mind)

..//snip//..

(Though technically for the huawei hg612 still somewhat relevent to the subject of conversation.)


Tough call, and like you say a topic in its own right...  but also so very relevant to this conversation... and it would be hard splitting out which posts relate to which topic and some apply to both, so for now Im leaving it as one.
Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 33913
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: BT Home Hub 3.0 - Type B
« Reply #144 on: November 17, 2012, 04:44:35 PM »

This whole subject of the Agents is what worries me. I can see no reason for remote management of anything which is on my property without my full knowledge and agreement of what can be done and to my mind there is no reasonable excuse for having these tools available to a behemoth like BT.

I know from reading the stuff on that blog that the BTAgent has RSA security but no one knows who holds the private key and as far as I know BT do not publicise the existence of the agent or its use to the end user. Lets face it RSA keys are hackable and not with huge difficulty.

This to me is a significant problem and why IF I ever get FTTC I will replace the BT device with one totally under my own control. I know from a local security point of view I can secure my local network by using my own router connected to the BT kit but that would no prevent anything being done without my knowledge to the BT router which might compromise my data being transmitted across the net. I'm sure that there are folks with criminal intent right now attempting to hack these BT routers and the like for nefarious purposes, whether they succeed or not is not the point though.

Stuart

I think I may have already covered some of your comments in my above post, before I read yours, so I wont go over them again, but worthy of comment is the security.  I dont think there are many systems that are fully secure and their is always going to be some risk with anything..  but one thing I see mention of is who holds the key.   Im severely running short on time now so can only point you in the direction to do your own research as Im spouting out stuff from memory about 7 yrs ago so Im willing to be corrected if someone wants to add anything further.

There isnt a key as such thats held by anyone, iirc there is a default key for 1st time connection, but after that your router and the specially provisioned TR-069 server and software negotiate their own key which is only known by the software*

Im no expert on this but I should imagine any exploits would either have to be via the default key to a router which hasnt yet connected to the ACS and negotiate its own unique key... or hacking the ACS itself... or somehow tricking the ACS & router to think its a first connection...  or packet sniffing (would that work as theyd have to be on the network first to intercept router and ACS data?)


*Using the info that is only known to the software, taking this forum as an example, even if someone where to hack the server, passwords are stored in such a way that only the software understands it... and it relies on 1) the info stored on the server (stored in a way which means nothing to a human), 2) the software  and 3) password known by the user.   
Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker

SecTSys

  • Member
  • **
  • Posts: 84
  • I only work with HTCPCP
    • Putney Computers Facebook page
Re: BT Home Hub 3.0 - Type B
« Reply #145 on: November 17, 2012, 07:08:31 PM »

I would be willing to look into that with the BTAgent however i feel that there is a lot of work to do -

Difficult yes - Impossible no - as they say where there is a will there is a way - and my name is Will... so there is always a way.

I will lookinto it and if i come up with something i will start a new thread specifically aimed at the BT Agent - in the mean time,

How is Zach getting on with BT in regards to this exploit - and know that there is one i will be keeping one of my BT HH3 b's disconnected so that when the exploit is released i can plug that router in and take a look at things. :P
Logged
Visit the Live Gaming Website STSLG Website
Visit my YouTube gaming channel at STS Live Gaming

burakkucat

  • Respected
  • Senior Kitizen
  • *
  • Posts: 38300
  • Over the Rainbow Bridge
    • The ELRepo Project
Re: BT Home Hub 3.0 - Type B
« Reply #146 on: November 17, 2012, 08:47:34 PM »

 :hmm:  Hmm . . . b*cat senses that a degree of misunderstanding has been shown in the latter posts to this thread.

The TR-069 protocol and the BTAgent are entirely different entities. Those persons with access to an unlocked Huawei HG612 (i.e. one of the two Openreach provided active NTEs for its NGA GEA product using VDSL2 over a metallic pathway to the EUs' premises) will see that by default the TR-069 protocol is disabled. The Beattie group do not use it! She uses her own 'secret agent' and 'busy-body', the BTAgent, which is hard-coded into the firmware . . .  >:(

However, all is not lost for those persons who have a HG612 which has been flashed with the unlocked firmware. Steps to take:

(1) Obtain 'telnet' access to the device and login. (admin / admin)
(2) At the 'ATP>' prompt invoke a busy-box shell. (shell)
(3) Obtain a listing of the running processes. (ps)
(4) Look in column five for the 'BTAgent' process and note the id of that process from column one.
(5) Exterminate that process by issuing a 'kill -TERM pid' command, where pid is the process id noted in (4), above.
(6) Now exterminate all the offspring of the 'BTAgent' (the spawn of the Devil) by issuing a 'killall btagent' command.

Please note that you are talking directly to the device and that Linux kernel based OS' are case sensitive. Hence you should take care in steps 4 - 6 not to confuse 'BTAgent' with './btagent'.  :)

[Edited to correct the error in step (5). With thanks to Eric for drawing it to my attention.]
« Last Edit: November 18, 2012, 12:15:50 AM by burakkucat »
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

roseway

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 43780
  • Penguins CAN fly
    • DSLstats
Re: BT Home Hub 3.0 - Type B
« Reply #147 on: November 17, 2012, 10:44:06 PM »

Thanks for that bit of information. I hadn't realised that BTAgent was still running on the unlocked firmware. Just one comment: the command kill --TERM <pid> doesn't work ("unknown option -TERM") but kill -9 <pid> works fine.
Logged
  Eric

burakkucat

  • Respected
  • Senior Kitizen
  • *
  • Posts: 38300
  • Over the Rainbow Bridge
    • The ELRepo Project
Re: BT Home Hub 3.0 - Type B
« Reply #148 on: November 18, 2012, 12:21:52 AM »

Oops.  :-[  Paw slippage. I should have typed:

kill -TERM pid

i.e. one hyphen, not two.

There is one further step that the purists can take and that is to unmount the dedicated partition for the BTAgent's evil ways --

(7) Check the mounted partitions. (mount). That used by the busy-body will be quite obvious. Issue a umount /dev/whatever command to unmount it.
« Last Edit: November 18, 2012, 08:38:24 PM by burakkucat »
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

SecTSys

  • Member
  • **
  • Posts: 84
  • I only work with HTCPCP
    • Putney Computers Facebook page
Re: BT Home Hub 3.0 - Type B
« Reply #149 on: November 18, 2012, 01:34:11 AM »

lol it's all good in the modem - but It is also in the bthh3.0b router too... - now disable that one! :P

lol
just reading back through Zachs Twitter page - looking at all the info on their regarding the BT HH3.0b and the work he was doing i found a few obvious posts but one very nice looking pic that wasn't posted here before ;) there may be other posts in reference to the BT HH3.0b but i cannot determine them myself or i believe i know they are but would need clarification

Quote
Zachary Cutlip ‏@zcutlip
Remote root on a HomeHub 3.0 Type B SoHo router. ;-)

Zachary Cutlip ‏@zcutlip
Ladies and Gentlemen, we have a crash. http://img.ly/owDv

Zachary Cutlip ‏@zcutlip
Fun with a British Telecom soho router on a perfect patio afternoon. http://pic.twitter.com/ndlPVWa2

-----------------------------

Zachary Cutlip ‏@zcutlip
Config file re-encrypted/re-signed and accepted by router. Next up, start dicking around with hidden settings.

---------------------------

Zachary Cutlip ‏@zcutlip
With @devttyS0 spotting me, I successfully RE’d the decryption for British Telecom soho routers’ configs. Next step: re-encrypt/re-sign.

« Last Edit: November 18, 2012, 02:33:58 AM by SecTSys »
Logged
Visit the Live Gaming Website STSLG Website
Visit my YouTube gaming channel at STS Live Gaming
Pages: 1 ... 8 9 [10] 11 12 ... 16