Security issues with remote configuration of internet service providers’ network equipment

professional thesis

• Title (croatian): Sigurnosni aspekti udaljenog konfiguriranja mrežne opreme kod pružatelja usluga pristupa internetu
• Author: Luka Perkov
• Mentor: Miljenko Mikuc (mentor)
• Committee member: Stjepan Groš (predsjednik povjerenstva)
• Committee member: Miljenko Mikuc (član povjerenstva)
• Committee member: Željko Hutinski (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; (Department of Telecommunications); Zagreb
• Defense date and country: 2014-02-11, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

CWMP (often called only TR-069) enables internet service provider (ISP) to remotely configure, manage, upgrade and troubleshoot CPE (Customer Premises Equipment). It is a vendor agnostic standard used to manage at least one device per customer. The protocol, used in more then half a billion devices, as well as its security challenges are presented. The security focus is not on a particular implementation but on the protocol flaws in general. Topics include identification problem, transport security and denial of service attacks. The solutions to these issues is presented where possible.

Abstract (croatian)

Pružatelji internet usluga (ISP) koriste CWMP (poznatiji pod nazivom TR-069) kako bi mogli udaljeno konfigurirati, održavati, unaprjeđivati te otkloniti probleme na mrežnoj opremi kod korisnika (CPE). CWMP je standard neovisan o proizvođaču, a koristi se na barem jednom uređaju kod korisnika. Protokol, koji se koristi na više od pola bilijuna uređaja, kao i njegovi sigurnosni problemi predstavljeni su u ovome radu. Sa sigurnosnog stajališta fokus nije na pojedinim implementacijama protokola već na njegovim nedostacima općenito. Obrađene teme su problem identifikacije, sigurnost transporta te napad uskraćivanja usluge. Za navedene sigurnosne propuste objašnjene su mjere zaštite ukoliko one postoje.

• Keywords: CWMP; TR-069; GPLv2; security
• Keywords (croatian): CWMP; TR-069; GPLv2; sigurnost
• Language: english
• URN:NBN: urn:nbn:hr:168:126503
• Study programme: Title: Specialist study programme in information security; Study programme type: university; Study level: postgraduate specialist; Academic / professional title: Specijalist informacijske sigurnosti (Specijalist informacijske sigurnosti)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2022-09-16 10:28:49