Security Holes Found in Alcatel ADSL Modems
Company downplays problem, but still consults with security experts.
Joris Evers, IDG News Service
Weak security in high-speed Asymmetric Digital Subscriber Line modems from Alcatel could allow hackers to shut down the devices, monitor data flows, and use them for cyberattacks, computer security experts say.
Affected systems are the Alcatel Speed Touch Home ADSL modem and the Alcatel 1000 ADSL Network Termination Device, researchers at the San Diego Supercomputer Center, a unit of the University of California at San Diego, say in a security advisory Tuesday. The Computer Emergency Response Team at Carnegie Mellon University also sent out an alert.
The affected modems are sold worldwide and are widely used in the United States as well as other countries.
The devices allow third-party log-on for servicing reasons, such as updating the firmware. Due to "weak authentication and access control policies," the function could be abused, CERT and SDSC say.
After gaining access a hacker could install malicious code on the modem, such as a network "sniffer" that monitors LAN traffic, SDSC says. The hacker could also use the modem in a distributed denial-of-service attack.
Alcatel is not impressed with the security alerts and says that SDSC was not able to access the modem without exploiting a security flaw unrelated to the Alcatel products.
To access the modem in three of the four cases described, the device must initially be fooled into thinking the traffic originated from the local network. To do that the attacker must use a system on the LAN side of the ADSL modem to relay traffic to the modem. That is done via the User Datagram Protocol echo service, which should be disabled.
"This is a general network security issue," says Karsten Verhaegen, business development director for ADSL modems at Alcatel. "We advise all users to install firewall software to protect themselves from issues like these."
In the fourth case described, the attacker needs to have physical access to the DSL wire.
Verhaegen further criticized the security probe.
"The Speed Touch Home and the ADSL Network Termination Device, a predecessor to the Speed Touch Home, are not designed for use in a LAN. We have a Speed Touch Pro with firewall for those professional environments," he says.
Nevertheless, another Alcatel spokesperson says the company's engineers are in contact with SDSC and CERT to determine what the problems are and, if there are problems, what to do about them.
Coauthor of the SDSC advisory is Tsutomu Shimomura, a well-known security researcher and coauthor of Takedown, on the arrest of hacker Kevin Mitnick.
Alcatel shipped 636,800 DSL modems in the fourth quarter of last year, making it market leader with a 34.9 percent share of the worldwide DSL modem market, according to researcher Dell'Oro Group.
Full Windows 7 coverage
The Best of PC World
- Great year-end deals for small business!

-
Get 24/7 live remote AT&T Tech Support 360* service along with select Lenovo* PCs (with Intel® Core™ 2 Duo processors and save up to 200!
-
HP EliteBook* 6930p Notebook with Intel® vPro™ technology and a free HP Basic Docking Station - $641 instant savings!
- *Other names and brands may be claimed as the property of others. ©2009 Intel Corporation. Intel, the Intel logo, vPro and Core trademarks of Intel Corporation in the United States and other countries. All rights reserved.
Dell Fast Track
-
Free Next Day Business Shipping on Dell's Most Popular Systems
Over 35% off Dell’s most popular systems. Delivered in 48 hours with free next business day shipping! Ends 12/22 at 3 PM CST
People who read this also read:
Best Prices on Antivirus Software
Norton Antivirus 2010 (Full Product, 1 User)Price: $17.90
Anti-virus 2010 (OEM Product, 1 User)Price: $21.60
AntiVirus 2010 (Full Product)Price: $24.95
Norton AntiVirus 2009 (Full Product)Price: $16.89
AntiVirus Plus 2010 - 3 Users (Full Product)Price: $11.95
Anti-Virus 2009 (Full Product)Price: $15.04
- Perfect Printing Solutions Find just the right All-in-One printer for you from HP. Visit the HP Resource Center.
- Lenovo Laptop Showcase Find out how Lenovo IdeaPads and Thinkpads balance performance and portability. Visit the Lenovo Resource Center for more info...
Cameras
Camcorders
Cell Phones
Components
Desktops
HDTV
Home Theater
GPS
Laptops
Monitors
MP3 Players
Networking &
Printers
Storage






