Hacking Millions of Modems and Investigating Who Hacked My Modem
Chronicles an investigation into a compromised home modem that led to discovering centralized ISP vulnerabilities exposing millions of broadband devices.
Summary
Discovering a Compromised Personal Modem
After observing suspicious replayed network traffic, security researcher Sam Curry investigated his personal ISP-provided home cable modem to understand how it was breached.
Uncovering Centralized ISP Vulnerabilities
Three years of web and hardware research revealed critical architecture flaws in centralized broadband management platforms used by major Internet Service Providers.
Arbitrary Remote Command Execution at Scale
Exploiting discovered vulnerabilities allowed unauthorized access to passively monitor customer traffic, rewrite configuration parameters, and execute arbitrary commands across millions of ISP modems.
Centralization Risks in Broadband Infrastructure
The findings emphasize the dangerous systemic risks created when millions of consumer edge devices are managed through centralized, unsegmented telecommunications backends.
Related talks
Main Stage·39 min
Anna Antonenko
Demonstrates remote code execution across audio software and operating system synthesis engines by weaponizing malformed MIDI protocol messages.
Creator Stage·25 min
O. Gianatiempo · G. Aznarez
Discloses two unauthenticated remote code execution vulnerabilities in Draytek routers (CVE-2024-51138 and CVE-2024-51139) that enable full edge device takeovers.
OWASP Foundation·3 min
Marketing video examines APPSEC Cali 2017.