Протокол удаленной настройки маршрутизаторов по HTTP (TR-069)

Router configuration protocol over HTTP

Technical Report 069 (TR 069) is a technical specification of the Broadband Forum that defines an application layer protocol for remote management and provisioning of customer premises equipment (CPE) connected to an Internet Protocol (IP) network. TR 069 uses the CPE WAN Management Protocol (CWMP) which provides support functions for auto configuration, software or firmware image management, software module management, status and performance managements, and diagnostics. The CPE WAN Management Protocol is a bidirectional SOAP and HTTP based protocol, and provides the communication between a CPE and auto configuration servers (ACS). The protocol addresses the growing number of different Internet access devices such as modems, routers, gateways, as well as end user devices which connect to the Internet, such as set top boxes, and VoIP phones. TR 069 was first published in May 2004, with amendments in 2006, 2007, 2010, July 2011 (version 1.3), and November 2013 (version 1.4 am5)

Other technical initiatives, such as the Home Gateway Initiative (HGI), Digital Video Broadcasting (DVB) and WiMAX Forum endorsed CWMP as the protocol for remote management of residential networking devices and terminals.

CWMP is a text based protocol. Orders sent between the device (CPE) and auto configuration server (ACS) are transported over HTTP (or more frequently HTTPS). At this level (HTTP), the CPE acts as client and ACS as HTTP server. This essentially means that control over the flow of the provisioning session is the sole responsibility of the device.

In order for the device to connect to the server, it needs to have certain parameters configured first. These include the URL of the server the device wants to connect to and the interval at which the device will initiate the provisioning session (PeriodicInformInterval). Additionally, if authentication is required for security reasons, data such as the username and the password needs to be provided.

All communications and operations are performed in the scope of the provisioning session. The session is always started by the device (CPE) and begins with the transmission of an Inform message. Its reception and readiness of the server for the session is indicated by an InformResponse message. That concludes the session initialization stage. The order of the next two stages depends on the value of the flag HoldRequests. If the value is false the initialization stage is followed by the transmission of device requests, otherwise ACS orders are transmitted first. The following description assumes the value is false. In the second stage, orders are transmitted from the device to the ACS. Even though the protocol defines multiple methods that may be invoked by the device on the ACS, only one is commonly found TransferComplete which is used to inform the ACS of the completion of a file transfer initiated by a previously issued Download or Upload request. This stage is finalized by transmission of empty HTTP request to the ACS. In the third stage the roles change on the CWMP level. The HTTP response for the empty HTTP request by the device will contain a CWMP request from the ACS. This will subsequently be followed by an HTTP request containing a CWMP response for the previous CWMP request. Multiple orders may be transmitted one by one. This stage (and the whole provisioning session) is terminated by an empty HTTP response from the ACS indicating that no more orders are pending.

The compromise of an ISP ACS or the link between an ACS and CPE by unauthorized entities can yield access to the TR 069 enabled devices of a service provider's entire subscriber base. Customer information and device operation would be available to the potential attackers, including other MAC addresses on client's networks. Covert redirection of DNS queries to a rogue DNS server might be possible, and even surreptitious firmware updates with backdoor features. TR 069 ACS software has been found to be often implemented insecurely. Flaws in combined implementations of TR 064 (LAN side DSL CPE configuration) and TR 069 (CWMP), that reused the same HTTP endpoint over public internet for Connection Requests without proper protections, were found in devices by various vendors and are exploited by Mirai based botnet and other malware.