论文标题
观看弱环节进入您的家：TR-069的检查和监视工具包
Watching the Weak Link into Your Home: An Inspection and Monitoring Toolkit for TR-069
论文作者
论文摘要
TR-069是服务提供商对最终用户设备进行远程管理的标准。尽管在近十亿个设备中实施，但几乎没有关于TR-069的安全性和隐私方面的研究。本文的第一个贡献是对TR-069生态系统的研究和检查TR-069通信的技术。我们发现，大多数经过分析的提供商不使用建议的安全措施，例如TLS。其次，我们提出了一个TR-069 Honeyclient，以分析提供商的TR-069行为和用于安全漏洞的测试配置服务器。我们发现流行的开源配置服务器使用不安全的方法来验证客户端。例如，基于这些服务器的TR-069实现将公开其用户的Internet电话凭据。第三，我们开发了分布式系统的组件，以连续监视提供商TR-069部署中的活动。我们的设置包括在客户场所和集中日志收集器上部署的廉价硬件传感器。我们执行现实世界的测量结果，发现由于缺乏提供商的固件更新过程，因此未能实现所谓的TR-069的安全益处。
TR-069 is a standard for the remote management of end-user devices by service providers. Despite being implemented in nearly a billion devices, almost no research has been published on the security and privacy aspects of TR-069. The first contribution of this paper is a study of the TR-069 ecosystem and techniques to inspect TR-069 communication. We find that the majority of analyzed providers do not use recommended security measures, such as TLS. Second, we present a TR-069 honeyclient to both analyze TR-069 behavior of providers and test configuration servers for security vulnerabilities. We find that popular open-source configuration servers use insecure methods to authenticate clients. TR-069 implementations based on these servers expose, for instance, their users' internet telephony credentials. Third, we develop components for a distributed system to continuously monitor activities in providers' TR-069 deployments. Our setup consists of inexpensive hardware sensors deployed on customer premises and centralized log collectors. We perform real-world measurements and find that the purported security benefits of TR-069 are not realized as providers' firmware update processes are lacking.
