Version Tomorrow is the first day of the rest of your life
lecture: A look at TR-06FAIL and other CPE Configuration Management Disasters
In late 2016 a TR-064 (LAN-side CPE management) misconfiguration in a wide range of CPE devices was disclosed that allowed for remote device takeover. Within days, botnets began exploiting a related command injection issue, leading to widespread internet outages for customers of certain ISP's in the UK and abroad.
This talk will explore the impacts of these issues, along with taking a look at some other, related vulnerabilities related to TR-069 (WAN-side CPE management) protocol implementations that could allow for remote takeover of routers en-masse.
Will be looking at ACS servers, general TR-069 vulnerabilities, the TR-064 issue, and other epic fails :)