Re: TiVo Network Security

[merlyn () stonehenge com (Randal L. Schwartz)]

> > > > > "Crist" == Crist J Clark <cristjc () comcast net> writes:

Crist> I have not found much information about the network security of
Crist> factory installations of TiVo (this one is not "customized" in any
Crist> way, yet). What sort of risks am I running if this thing is on the
Crist> WLAN? Are there any listening services someone could break into? (I'd
Crist> just nmap it, but I'd like to know some of these answers before I
Crist> bother getting a USB WiFi unit.) What protocols are used for upload
Crist> and download? If they are not well known (FTP, HTTP, HTTPS, etc.) or
Crist> are proprietary, anyone know how easy passive eavesdropping or active
Crist> insertion or modification attacks may be?

The connections are outbound for fetching program guide and remote
programming requests (it polls every 15 minutes for remote
programming), using HTTP to a non-standard port.  The program guide is
an encrypted payload, but otherwise HTTPS is not used.

Home Media Option uses peer to peer HTTP, again with an encrypted
payload on a non-standard port.

The box doesn't have any ports open except when HMO is enabled.

If you're using this only for program guide fetching or remote
programming (no peer-to-peer HMO), you can probably get away with
simply punching a hole to talk to the tivo central on a specific port
from your box.  You can enable WEP to prevent casual sniffing: the
TiVo understands WEP with a single fixed 40 or 128 bit key.

Let me know if you have a more specific question.  I've been using
mine in wireless mode for longer that most people around. :)

-- 
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn () stonehenge com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html