• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>International Conference on Applied Cryptography and Network Security >Watching the Weak Link into Your Home: An Inspection and Monitoring Toolkit for TR-069: Abridged Conference Version
【24h】

Watching the Weak Link into Your Home: An Inspection and Monitoring Toolkit for TR-069: Abridged Conference Version

机译：观看家庭中的薄弱环节：TR-069的检查和监视工具包：会议摘要版

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

TR-069 is a standard for the remote management of end-user devices by service providers. Despite being implemented in nearly a billion devices, almost no research has been published on the security and privacy aspects of TR-069. The first contribution of this paper is a study of the TR-069 ecosystem and techniques to inspect TR-069 communication. We find that the majority of analyzed providers do not use recommended security measures, such as TLS. Second, we present a TR-069 honeyclient to both analyze TR-069 behavior of providers and test configuration servers for security vulnerabilities. We find that popular open-source configuration servers use insecure methods to authenticate clients. TR-069 implementations based on these servers expose, for instance, their users' internet telephony credentials. Third, we develop components for a distributed system to continuously monitor activities in providers' TR-069 deployments. Our setup consists of inexpensive hardware sensors deployed on customer premises and centralized log collectors. We perform real-world measurements and find that the purported security benefits of TR-069 are not realized as providers' firmware update processes are lacking.
机译：TR-069是服务提供商对最终用户设备进行远程管理的标准。尽管已在将近十亿个设备中实现，但几乎没有关于TR-069的安全性和隐私性方面的研究发表。本文的第一个贡献是对TR-069生态系统和检查TR-069通信的技术的研究。我们发现，大多数经过分析的提供程序都不使用建议的安全措施，例如TLS。其次，我们提供了TR-069 honeyclient，可以分析提供者的TR-069行为并测试配置服务器的安全漏洞。我们发现流行的开源配置服务器使用不安全的方法对客户端进行身份验证。例如，基于这些服务器的TR-069实施公开了其用户的Internet电话凭据。第三，我们为分布式系统开发组件，以连续监视提供商TR-069部署中的活动。我们的设置包括部署在客户场所的廉价硬件传感器和集中式日志收集器。我们进行了实际测量，发现TR-069的所谓安全优势并未得到实现，因为缺少提供商的固件更新过程。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号