Before starting the article itself, I believe I should warn that the information contained here is purely for informational purposes, and what any user does beyond this is up to them and I am not responsible. With this detail clarified, here goes the article:
The TM+MM is the new type of telephone booth that Siemens is manufacturing for Telefónica, with more functionalities than “traditional” booths, such as internet access via ADSL, sending short messages to mobile phones, and the ability to take digital photos. Since I believe we are not the type of people who are satisfied just knowing what something is made for, we will proceed to conduct some tests with the booths that are already operating in Zaragoza (I don’t know if they are in other places as well).
The TM+MM
First, I will give a physical description of what has been installed so far (always in enclosed and well-monitored locations).
The front of the stand has been replaced by a wider one that contains the following:
- A Samsung backlit color TFT screen of 11 inches. Resolution of 800x600
- An alphabetical keyboard with 50 steel QWERTY-type keys, slightly inclined
- A trackball with two buttons, although the secondary button has been disabled
- Speakers
- A webcam
- A conventional numeric keypad
- A box under the stand with the ADSL router and its power supply. It is supposed that in the future this box will be located on the ceiling of the stands
And moving on to the computer hardware inside, we find:
- An industrial SBC board
- A Pentium processor at 166 MHz
- Two USB ports (one of them occupied by the webcam)
- Two serial ports (one of them communicates with the voice system controller board)
- An ethernet card
- 128 megabytes of RAM
- 10 gigabyte hard drive
- The board that controls the stand’s voice system, which is the usual board
Connection Diagram
Regarding the software:
- A RedHat Linux distribution, probably 7.2
- Kernel 2.4.18
- FVWM with alogin (automatically starts with a user in X)
- XFree86 4.2.0
- Escape-based browser that allows browsing, sending emails, and sending short messages to mobile phones. In addition to that, it stores (supposedly for statistical purposes) everything the user does (URLs visited, banners clicked…)
Navigation System
- Blackdown JDK1.1.8
- Videoconferencing system based on GnomeMeeting
- Application to control communication between boards
- An automatic software update system through which it connects via HTTPS to a server to download the packages that need updating
- OpenSSH server version 3.1p1
- Squid 2.4
Regarding the security of the booth, so far we have achieved nothing. It only has ports 22 (the patched SSH server) and port 80 (supposedly for the update port) open to the outside. The rest of the ports are closed. You can only exit the main application by opening the booth door or with the Telefónica technician’s card (things that are impossible for us. I take this opportunity to remind you that all booths of this type are in closed and monitored locations). LILO runs under chroot and prevents booting in single-user mode or entering any type of command. What we have not yet tried is attempting to exploit some browser error, which does not allow downloading files, Flash animations. We also do not know if with some type of Java browser (which it does interpret) we could do something.
The technical manual of the booth says:
To prevent external hacker-type attacks, the Kernel’s packet filtering functionality is used, which rejects fragmented packets.
What the heck does it really mean, but anyway 😈
If you scan it with Nessus, it finds two critical vulnerabilities in the SSH server, but none work with their appropriate exploit. Nevertheless, these are the two critical vulnerabilities it finds:
The host is running a version of OpenSSH earlier than 3.2.1
There is a buffer overflow in this daemon if AFS is enabled on your system, or if the KerberosTgtPassing or AFSTokenPassing options are enabled. Depending on the scenario, the vulnerability can be avoided by enabling UsePrivilegeSeparation.
Versions earlier than 2.9.9 are vulnerable to a remote root exploit. Versions earlier than 3.2.1 are vulnerable to a local root exploit.
Solution: Update the OpenSSH version
- Risk: High
- CVE: CAN-2002-0575
- BID: 4560
- Nessus ID: 10954
The host is running a version of OpenSSH earlier than 3.4
There is a flaw in this version that can be remotely exploited to give the attacker a shell on the host.
Solution: Update OpenSSH to version 3.4
- Risk: High
- CVE: CAN-2002-0639, CAN-2002-0640
- BID: 5093
- Nessus ID: 11031
I think it is advisable to clarify that voice call control is still performed by the booth through hardware, which only communicates with the computer to transmit user messages, so I don’t think it is possible to make free phone calls even if the booth is taken over, although I believe it would be possible to send SMS and browse the internet for free.
IPs of some of the booths:
- 80.37.142.174
Interesting URLs:
