Security & privacy concerns with Syrotech ONU on BSNL FTTH | TR069 | CWMP | BACKDOOR | PWD Register

[maverick27]

Hi all!

I'm concerned about certain settings and configurations on my Syrotech ONU:

1. The ONU seems to be set by some ACS (whether LCO or something else) upon reboot. There's no information on what this ACS is. This should not be happening, considering the fact that I have disabled TR069. And the settings for disabling TR069 do seem to persist after rebooting.

2. Before disabling TR069, I noticed in the config that the ACS server set in its settings was: http://devacs.edatahome.com:9090/ACS-server/ACS
Prima facie, it looks like some sort of Chinese server. The question is Why? And even after disabling TR069, is the ONU still somehow connecting with this server?

3. I looked at the config file of the router: lastgood.xml. I was appalled on finding settings with mentions of CWMP, and BACKDOOR, among other things, such as the name of Chinese provinces (Fujian etc.). All this is more concerning because the UI based interface of the ONU has no such mentions. As far as I know, CWMP is used for remote management.

4. What is PWD register inside TR069 settings? What is the purpose? Is it, in any way connected to how the ONU is being set by the ACS?



I'm also unable to enable Telnet on the ONU. The box simply gets unchecked as soon as i hit the Submit button. Hence, i cannot access the CLI.



In light of serious cyber security concerns from China, should i be worried? I have contacted Syrotech via mail, but have not received any response whatsover.

Please help. Thanks in advance!

@varkey @sloj @Nikhil Sharma @JB701 any valued inputs from you guys?

Device model: SY-GPON-1110-WADONT
Hardware Version: V1.3
Firmware Version: V2.0.19-200818

2 hosted at ImgBB

Image 2 hosted in ImgBB

ibb.co

5 hosted at ImgBB

Image 5 hosted in ImgBB

ibb.co

6 hosted at ImgBB

Image 6 hosted in ImgBB

ibb.co

7

Image 7 hosted in ImgBB

ibb.co

8 hosted at ImgBB

Image 8 hosted in ImgBB

ibb.co

9

Image 9 hosted in ImgBB

ibb.co

 

[sloj]

Just saying, you could have made a single post or updated all in one big post.

TR-142 Framework for TR-069 enabled PON Devices - PDF Free Download
Hope this helps.

That ACS page seems to be long gone, it just exists in the ONU. All the auto config is done between OLT and ONU with some form of authentication, possibly what is in image number 6. How to Configure a GPON ONT (Distributed Mode)

 

[Adithya]

These firmwares are used everywhere, even on ADSL modems. You'll find a lot of these things if you dig deeper. There's no point. Most of those are old/not relevant/no longer works.

For enabling telnet, you need to set firewall level to low.

 

[shashankb]

I looked up the Domain WHOIS for edatahome.com and its registered with China Telecom which is not surprising . I mean they are having their ONT vendor as Syrotech I guess which is exported to India also. Just update a new firmware and I think you are good to go.

If you do not want to use Syrotech , get something like Huawei which is a little more standard

 

[JSMFPPJK]

@maverick27 You sorted this out or still being set by LCO.

 

[maverick27]

@JSMFPPJK still being set by the LCO

 

---

[hemant]

that backdoor config entry was an interesting find. found this alert on Chinese list mentioning it. if enable is 0, they say it can't be exploited. but there's another exploit with ping. so the best available mitigation would be to make sure no service - not even icmp - is exposed over the WAN, given better firmware is too much to expect from these vendors. the box has iptables, so maybe writing some strong rules may be an option for those who know/have some time.

worry would be more like incidents reported in this forum recently - one report of large downloads exhausting fup, another getting a CERT forward asking to clean router/network of malware. both seem like candidates for exploits of this kind.

 

[maverick27]

@hemant i've been wondering whether that flag having value 0 actually means enable or disable? I mean, what if it's a reverse logic?

I remember receiving the CERT mail when i was on BSNL adsl connection. Not once, but maybe 2-3 times. Only then did i take steps to go beyond the default passwords and settings. This is from 2-3 years ago. At that time hacks and vulnerabilities always seemed like fairytales.

 

[maverick27]

By the way, isn't it ironic that the the state owned ISP has become the flagbearer of compromised network equipment from China; given the hullabaloo about 'trusted' networks wrt 5G deployments around the world; and given the recent push on 'Aatmnirbharta'.

China is blatantly dumping all this shit here, circumventing the restrictions by exporting through HK. That's what the sticker in the back of the Syrotech ONU read!

 

[vishalrao]

Yeah and also ironic that they are injecting popups and redirects to malware websites!