Weak Encryption Scheme in Telindus 112x

[<eflorio () edmaster it>]

[-----------------------------------------------------------------------]
Product Name: TELINDUS ADSL ROUTER 112x
Severity    : Low Risk
Remote      : No
Category    : Trivial encryption scheme can reveal router system password
Exploit     : No
Vendor URL  : http://www.telindus.com
Author      : Elia Florio
Discov.-Date: December 10, 2002
Status      : Telindus was contacted in December, 2002
[-----------------------------------------------------------------------]

INTRO:
An old security problem for Telindus 112x series (and Arescom NetDSL 1000
too) is well documented here:

http://www.tigerteam.it/files/telindus-advisory.txt       (english)
http://www.tigerteam.it/files/telindus-advisory.IT.txt    (italian)

There is a new exploit to crack router password, partially-based on 
this old problem, which was fixed by Telindus introducing a new 
firmware release (6.0.x), where UDP packets over 9833 port 
(containing plain-text password) are encrypted, to ensure product 
security.

However, after some studies, I discovered that the encryption scheme is 
trivial and can be broken using some information which the router itself 
reveals (the router name) to the user. 

NOTE:
The encryption scheme was succesfully decrypted on 2 routers carried 
by different ISP : MATAV (Hungary) and Telecom (Italy), both with 6.0.x
firmware.


[---------------------------------------------------------------------]

PROOF OF CONCEPT:

Using a sniffer I capture a packet (encrypted) from a 1124 router and
compare it with another packet (unencrypted) taken from another router, 
with has the old firmware (< 6.0.x). This procedure (how-to-capture-
packet) was explained in a previous security advisory (by others) and is 
based on UDP sniffing over the 9833 port while "Telindus 9100 M. 
Application" is trying to contact the router over the LAN.

                            CYPHER-TEXT

0100  00 03 02 00 08 00 00 A2 A3 2B 63 4B 73 23 AB 99    .......¢£+cKs#«TM
0110  02 0A 22 9A 61 02 93 7B AB A3 2B 90 08 08 00 2B    .."sa."{«£+·...+
0120  6B 7B AB 9B 28 08 10 01 92 72 22 99 89 91 B1 82    k{«>(...'r"TM`±,
0130  42 29 6A A2 62 49 61 03 B3 2B 91 01 B1 71 81 71    B)j¢bIa.³+`.±q·q
0140  91 B9 DA A3 AB 29 02 53 AB 61 01 99 81 01 89 C9    `¹Ú£«).S«a.TM·.É
0150  D1 89 B1 D1 99 B1 01 91 81 81 90 09 98 00 10 01    ѱÑTM±.`···.~...
0160  E0 08 98 00 30 00 2E C0 9F 0A 88 08 B0 00 30 00    à.~.0..ÀY.^.°.0.
0170  85 38 9A 64 0A 00 18 00 10 00 02 00 20 00 10 00    ...8sd........ ..
0180  00 09 30 00 00 09 38 00 00 09 40 00 00 09 80 00    ..0...8...@....
0190  10 00 10 0A 20 00 00 08 20 00 10 00 00 10 50 00    .... ... .....P.
01A0  10 00 00 0A 30 00 10 00 00 0A 48 00 20 00 00 00    ....0.....H. ...
01B0  00 0A 88 00 02 10 28 00 02 11 10 00 00 20 40 00    ..^...(...... @.

                            PLAIN-TEXT

0100  00 03 00 01 01 00 00 05-44 53 4C 30 30 01 01 00   ........DSL00...
0110  0D 31 31 31 31 31 31 31-31 31 31 31 31 31 01 02   .1111111111111..
0120  00 32 4E 44 31 30 36 30-56 45 2D 54 4C 49 2C 20   .2ND1060VE-TLI,
0130  76 65 72 20 35 2E 33 2E-31 31 42 3B 54 68 75 20   ver 5.3.11B;Thu
0140  44 65 63 20 20 36 20 31-36 3A 33 36 3A 33 33 20   Dec  6 16:36:33
0150  32 30 30 31 01 33 00 02-00 3C 01 13 00 06 00 60   2001.3...<.....`
0160  6C 1D BD 7E 01 16 00 06-00 00 86 60 62 F7 04 08   l..~.......`b...
0170  00 02 00 01 04 15 00 02-00 FF 01 0D 00 04 00 00   ................
0180  00 00 01 0E 00 04 00 00-00 00 01 14 00 02 00 00   ................
0190  40 03 00 02 00 00 40 04-00 02 00 00 01 26 00 00   @.....@......&..
01A0  01 27 00 00 01 28 00 00-01 30 00 02 00 02 01 44   .'...(...0.....D
01B0  00 00 42 05 00 00 42 22-00 00 04 18 00 00 08 FF   ..B...B"........

Both payloads begin with "00 03 xx xx xx 00 00" bytes sequence.

In the plain packet we can read the router name and the password: the 
beginning of a text string has an important byte, which stores the string 
length:

05-44 53 4C 30 30 01 01 00
^^----------------------------------> lenght of string "DSL00"

0D 31 31 31 31 31 31 31-31 31 31 31 31 31 01 02 00
^^----------------------------------> lenght of string "1111111111111"

I suppose that "0x 0x 00" is a kind of termination sequence
for <router name> and <password> fields.

Now look at the encrypted packet: because the total length is similar
to that of the plain packet (>200 bytes), I suppose that "A2" is now a 
crypted lenght byte, so the router name field begins after this byte.

But I know the router name, because Telindus 9100 M. Application
shows it to me during the connection test with router.
In this case it was "Telindus ADSL Router",very long! I think that is 
enough to begin a crypto-analytic attack over the packet.


"Telindus ADSL Router" [20 byte = 14hex]  crypto-lenght=A2

T  e  l  i  n  d  u  s     A  D  S  L     R  o  u  t  e  r 
A3 2B 63 4B 73 23 AB 99 02 0A 22 9A 61 02 93 7B AB A3 2B 90  encrypted
54 65 6C 69 6E 64 75 73 20 41 44 53 4C 20 52 6F 75 74 65 72  plain ASCII


Looking this, I try to suppose that:

1) the encryption scheme is based on a fixed crypto system 
   ("e", "u", "t" are encrypted in same way in the text)

2) there is a special encryption for stop/mark bytes between 
   words (add -2 or -3 to final char R=93 / r=90 ????)

3) the encryption scheme is case sensitive

Trying to write a crypto table, I can notice that every letter is coded 
from the previous adding "8" to crypto-byte. For example r=93, then 
s=9B...

CRYPTO TABLE (hex codes)
-------------------------------------
CHAR    CRYPT    PLAIN
a       0B       61
b       13       62
c       1B       63
d       23       64
e       2B       65
f       33       66
g       3B       67
h       43       68
i       4B       69
j       53       6A
k       5B       6B
l       63       6C
m       6B       6D
n       73       6E
o       7B       6F
p       83       70
q       8B       71
r       93       72
s       9B       73
t       A3       74
u       AB       75
v       B3       76
w       BB       77
y       C3       78
x       CB       79
z       D3       7A
... 
1       89       31
2       91       32
3       98       33
...

I think that the encryption function is very similar to this :

ENCRYPT(x) = x*8 + int(x/20h) - (int(x/20h))*100h

For example ("q" = 71h)

ENCRYPT(71h) = 71h*8 + 71h/20h - (71h/20H)*100H = 388 + 3 - 300 = 8Bh

There are some encryption variants for blank space, capital
and the last letters of words.

Now, where is the router password in the encrypted packet?
After 20 bytes (the router name length in this case) there is "08 08 00", 
probably a field marker, then there is 2B, which is 
the crypto-lentgth of password. 

The encrypted password-string begins there.

Using the table, I can unmask the real router password:

   m  o  u  s  e  
2B 6B 7B AB 9B 28 08 10 01 
^^----------------------------------crypto length of password


Other informations can be also decrypted :

N  D  S  1  2  6  0  H  E  -  T  L  I
72 22 99 89 91 B1 82 42 29 6A A2 62 49 61 03 

v  e  r     6  .  0  .  2  7     T  u  e     J  u  l     3  0     
B3 2B 91 01 B1 71 81 71 91 B9 DA A3 AB 29 02 53 AB 61 01 99 81 01 

1  9  :  1  6  :  3  6     2  0  0  2
89 C9 D1 89 B1 D1 99 B1 01 91 81 81 90 09 98 00 10 01

[----------------------------------------------------------------------]

Copyrigth Elia Florio
Security Researcher - Italy
"ioProgrammo" (www.edmaster.it/ioprogrammo)
(eflorio () edmaster it)