Hack2Win – The Online Version – Ubiquiti Router

After the great success of the first “Hack2Win – The Online Version” (https://blogs.securiteam.com/index.php/archives/3310 ) we decided to raise the bar.

The rules are very simple – you need to hack the Ubiquiti EdgeRouter X router (ER-X) and you can win up to 10,000$ USD.

To try and help you win – we bought a Ubiquiti EdgeRouter X device and plugged it to the internet (we will disclose the IP address on 10th of August 2017) for you to try to hack it, while the WAN access is the only point of entry for this device, we will be accepting LAN vulnerabilities as well.

Just to make things clear – the competition has began – you can submit your findings from today!

If you successfully hack it – submit your findings to us ssd[]beyondsecurity.com, you will get paid and we will report the information to the vendor.

The competition will end on the 1st of October 2017 or if a total of 20,000$ USD was handed out to eligible findings.

Product details:

• Model: ER‑X
• Product name: EdgeRouter X
• Firmware: EdgeRouter ER-X/ER-X-SFP/EP-R6: Firmware v1.9.7
• Updated: Latest == 2017-07-24

Prizes:

1. Unauthenticated Remote Code Execution – up to 10,000$ USD
2. Authentication Bypass (bypassing authentication mechanism without any knowledge, or resetting of the password to the default) – up to 5,000$ USD
3. Information Disclosure (access to current password) – up 2,500$ USD
4. Other – the amount paid will depend on the risk and seriousness of the vulnerability

The total amount paid during the contest will be up to 20,000$ USD.

If more than one person submits an unauthenticated RCE, the first one to submit the vulnerability to us will win the amount promised, while the other person will receive 50% of the above promised amount.

If you submit a RCE vulnerability, for example, and you need to use couple of vulnerabilities in order to do so – you will get paid for the RCE vulnerability and not for the components.

All items will be considered, unless they are a duplicate – duplication will be considered for any vulnerability that targets the same URL or mechanism to preform the attack.

For any duplicate submissions we will receive, we will give the researcher a free T-shirt as well as an acknowledgement in the vendor’s advisory and our advisory for finding the vulnerability.

Judging Criteria

• The participant uses an unknown vulnerability (no record of it can be found Google, Exploit-DB, etc)
• Complexity of attack – what was required to achieve the attack
• Innovative method – SQLi, RCE, etc from least to most innovative
• Whether Attack affects the LAN or WAN – more points if it affects the WAN
• What is achieved by the attack – no access is given to the challengers, so they would need to reach from no-access to some access – therefore a guest access would be considered less valuable than root
• Write-up Quality – the best write up (in English), most detailed, best explanation, etc

Device Settings
The router will be accessible to participants via IP we will disclose the IP address on 10th of August 2017.

The router has been updated to the latest version available from the vendor website (https://www.ubnt.com/download/edgemax/edgerouter-x/default/edgerouter-er-xer-x-sfpep-r6-firmware-v197) at the time of writing its Security Advisement (EdgeRouter ER-X/ER-X-SFP/EP-R6: Firmware v1.9.7)

We left the default settings, and the only non-default setting is that we changed the password for the ‘admin’ account and disabled the “default firewall” feature.

What counts as ‘hacked’
A device would be considered ‘hacked’ if the participant can prove they:

• Gained access to the device’s post-authentication admin web interface (remember – you will not be given any credentials)
• Changed some configuration value, like WiFi password
• Made the device do something it’s not supposed to do: like execute code, open a port/service which was previously closed (like SSH, telnet, etc)

What we won’t count as a ‘hacked’

• Causing a malfunction to the device, DoS / XSS / CSRF, making it unresponsive, making it no longer boot, etc
• Usage of any known method of hacking – known methods including anything that we can use Google/Bing/etc to locate – this includes: documented default password (that cannot be changed), known vulnerabilities/security holes (found via Google, exploit-db, etc)

Eligibility
The contest is open to anyone who is at the legal age to receive a contest prize in your country, if you are not allowed to receive prizes – and please make sure to check this before participating – you may want to team up with a person that is at the legal age to receive prizes.

The contest is not allowed to anyone working for Ubiquiti, or are involved in development of the above device.

Submitting your findings
In order to submit your findings – please send us email to ssd[]beyondsecurity.com with the following title: “Hack2Win [TYPE-OF-VULNERABILITY] [YOUR-NAME]”

The email should contain the following information:

1. Vulnerability Title
2. Date of submission
3. Description of Vulnerability
4. Configuration Requirements (if needed)
5. Vulnerability Requirements (if needed)
6. Vulnerability Summary Information
7. Affected Versions Tested
8. Attack Vector
9. Exploitation Impact (Code Execution, Denial of Service, etc)
10. Exploitation Context (runs on Server/ attacks User)
11. Vulnerability Technical Details
12. Exploitation

Please use the following gpg encryption key when submitting us a report: