Interesting firewall challange

RouterOS General
1

Im working with a very interesting issue. Worldwide there is a BIG issue with Intel Puma based cable modems. These are in use all over the world. These ALL have a CVSSv3 7.3 rated DoS attack that cannot be blocked at the ISP of a MSO because the hardware would cost $1M USD per ISP installation. The main issue is that these MAJOR ISPs are going 40Gbps and 100Gbps connections going to single CMTS boxes. Dealing with 10’s of millions of clients.

The DoS is trival and very low bandwidth. You simply send at least 1500 packets per second of NEW connections and a look up table in the modem chokes and a DOS occurs. This it turns out is very difficult to block without effecting legit things. TCP/UDP IPv4 or IPv6. Its ANY protocol.

I run the badmodems.com site where we have collected all the data on this issue. The list of effected devices is huge. There is a unpublished CVE but its a 0-day and the code is published and redily avaliable. Google Puma6fail.. This has all been covered in the press a lot. http://www.theregister.co.uk/2017/08/09/intel_puma_modem_woes/

We are having technical discussions now on this thread about it. https://www.dslreports.com/forum/r31122204-SB6190-Puma6-TCP-UDP-Network-Latency-Issue-Discussion~start=7352

Its a tricky issue. The power required to inspect a 100Gbps stream for this and NOT false positive on a MSO of 20 million clients is not easy.

I was going to try some rules on my CCR router and start to work out a rule that could be used that would not effect normal traffic. This is at home just to work out what kind of rule would work for this. I have a DoS web based tool I use to test. So I can test if this works.

Im posting here for some advice on how to write a rule that requires the least CPU power to block this issue. Rate limiting seems scary to use as there might be something that uses a high new connection rate legitimate. The packets are random content and random port numbers. The only thing common is the high rate and that they are new.. This has to work on every protocol and IPv4 and 6.

The other issue is this could be turned into a DDoS so the source IP could also be random.

Most likely any of you in Eurpoe who are on cable and have high speeds are likely to have a Intel Puma based device. Its a serious issue, its a CVSSv3 7.2 0-day with trival published code. IT can be scaled up and weaponized and because of its low rates per IP can attack a whole ISP and knock entire Intel Puma based ISPs offline with no mitigation known.

So far no firmware patch has been issued to any modem vendor after 9 months.

All the details are here http://www.badmodems.com/

We could really use some really skilled network guys to come help work on a solution. Im working with Intel and MITRE. I run the badmodems site. The main place for discussion is the DSLReports forum thread I linked above.

This is a really hard problem that can knock a entire MSO offline with no mitigation possible currently and patches to the modems is months to years away. If you think you can help, come join us.

2

In the UK Virgin Media’s Superhub V3 is affected by this bug. For normal users it isn’t an issue but I see a lot of gamers on other forums I frequent are seeing the problem.
The normal setup here is that the SH3 is the modem and then this is bridged down to a router so no firewall will help it at all as it hits hardware further up the chain before it gets to it. The problem is present regardless to whether the hub is in modem only or router mode also.

The only solution here is to use older hardware such as a Superhub v2AC which does not have the problem.

I was under the impression that Intel were already a few months into working on a patch for this as they couldn’t simply leave users high and dry off the back of this?

3

Even without DoS issues, Puma chipset based modems are garbage. If you’re an ISP I would seriously look into what it takes to return them all to the manufacturer as they are not fit for their marketed purpose. They have high latency jitter and often packet loss for no discernible reason, even in bridge mode. My ISP here “upgraded” me to a Puma based modem recently, I complained every few days until I got it replaced by a Technicolor. See if you can spot when the Puma modem was installed…

4

Hello, i think i have the solutions.

Please contact me

jmiguelcd [@] gmail dot com

Regards

5

Yes, the Puma is S**T.. But.. Besides that.. There is a SERIOUS issue. The DoS. As all of Virgin Media is on the Puma a DDoS from a botnet could paralyze the entire ISP with no mitigation possible. Its at least a CVSSv3 of 7.2.. Its a 0-day.. The code is available and its trivial..

On the DSLReports thread what we are tryign to do is figure out a way at the ISP to block this WITHOUT requiring $1M hardware. The first step is to come up with a firewall rule, a Snort rule, that can block the attack without effecting other traffic. Keep in mind this would be applied in production on the largest ISPs in the world. These have CMTS gear thats doing 40Gbe connections. Millions of users. So any solution would need to be VERY low CPU. Ideally we are thinking about maybe running something in the CMTS..

Smaller ISPs like those serviced by CCRs might benefit from this rule.

This is a hard problem.

6

This is generosity at it’s best. Intel bring to market a chip that is sub standard, even with the amount of $$$ they have behind them for R&D and testing.

It is then left to a handful of users to try and mitigate the issue?

I admire what you are doing.

7

Well, I offered my help but you have not contacted me.

The problem can be solved using the RAW option of the Firewall and with an Address List that contains the IP’s that are owned by the ISP.

This would prevent DDoS attacks from that ISP to other ISP’s. To mitigate attacks other than IP Spoofing, other additional configurations should be used.


Regards