OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: [Full-Disclosure] TiVo Network Security

From: Randal L. Schwartz (merlynstonehenge.com)
Date: Sat Jan 03 2004 - 14:32:20 CST

>>>>> "Crist" == Crist J Clark <cristjccomcast.net> writes:

Crist> I have not found much information about the network security of
Crist> factory installations of TiVo (this one is not "customized" in any
Crist> way, yet). What sort of risks am I running if this thing is on the
Crist> WLAN? Are there any listening services someone could break into? (I'd
Crist> just nmap it, but I'd like to know some of these answers before I
Crist> bother getting a USB WiFi unit.) What protocols are used for upload
Crist> and download? If they are not well known (FTP, HTTP, HTTPS, etc.) or
Crist> are proprietary, anyone know how easy passive eavesdropping or active
Crist> insertion or modification attacks may be?

The connections are outbound for fetching program guide and remote
programming requests (it polls every 15 minutes for remote
programming), using HTTP to a non-standard port. The program guide is
an encrypted payload, but otherwise HTTPS is not used.

Home Media Option uses peer to peer HTTP, again with an encrypted
payload on a non-standard port.

The box doesn't have any ports open except when HMO is enabled.

If you're using this only for program guide fetching or remote
programming (no peer-to-peer HMO), you can probably get away with
simply punching a hole to talk to the tivo central on a specific port
from your box. You can enable WEP to prevent casual sniffing: the
TiVo understands WEP with a single fixed 40 or 128 bit key.

Let me know if you have a more specific question. I've been using
mine in wireless mode for longer that most people around. :)

--
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlynstonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html