IPC@Chip Security

["Siberian" <i.am.a () x-men com>]

Sentry Research Labs
www.sentry-labs.de.vu

product: IPC@Chip (Beck GmbH)
vendor informed: 21th of May
status: unanswered

Note: The demonstration tool and a german version (there is also an english
download version) of this report is available form our website.

Siberian

----------------------------------------------------------------------------
-----

IPC@CHIP Security Report v0.2
2001 by Sentry Research Labs
www.sentry-labs.de.vu

Vendor informed: Monday, 21th of May

Pre

We did a security audit on the IPC@Chip (vendor is Beck GmbH) using a DK40
Evaluation Board. During this tests we tested the system for common security
flaws, used common attack strategies and analysed behaivior of the IPC.
Hopefully all bugs will be removed in further verisons of the BIOS software.
We will keep on monitoring this product in the futur.

SDL


Warnings: 8
Flaws: 3


Warnings

TelnetD

DEFAULT passwords
The IPC is using a TelnetD with factory set DEFAULT Passwords ("tel").

Brute Force
Because the TelnetD isn't using a random delay on it's login attemps and it
isn't counting or logging any bad passwords, it's possible to brute force
the password in no time. A demonstration tool is available on our website.

Lock up
Only one user may use the TelnetD at once and there isn't any timout set by
default. So it's possible to lock access fot the real admin. Just connect to
the IPC and leave a telnet window open and untouched.

User Guess Attack
By analysing the return value given by the TelnetD on login it's possible to
find existing user accounts. A demonstration tool is available on our
webpage.

 "User unknow" = non existing user
"Password:" = existing account


Webserver

CHIP.INI
The webserver root directory is set to / by default. A attacker may download
the chip.ini file, containing all logins and paswords by typing i.e
http://ipcchipip/chip.ini.

Long Requests
If a real long request is send the server stops responsing, but the a few
moments later everything is well again. All requests send during the
downtime are lost.


FTPD

DEFAULT passwords
The IPC is using a FTPD with factory set DEFAULT Passwords ("anonymous" or
"ftp"), both a full access accounts.

TCP/IP

Sockets
By SYN flooding or mass request HTTP files the IPC may be blocked for some
time. There is a max. of  only 64 sockets,so a lame DoS aatck is really
esay.

Flaws

ChipCfg

This CGI Scipt is installed by deafult and can't be removed. It revals
network data to anyone, also possible attackers.

Typ i.e http://ipcchipip/ChipCfg.

Workaround: -

FTPD

By adding just one user to the system, the DEFAULT accounts are not disabled
completly, "anonymous" still works and grands full access.

Workaround: Add a second user.

TelnetD

By adding just one user to the system, the DEFAULT accounts are not
disabled, "tel" still works and grands full access.

Workaround: Add a second user.