KPN-hackers could movement customers as possible, intercept

The hackers that break-ins at KPN, may have also broken into one or more core routers. It was therefore possible in theory to internet traffic at KPN customers to intercept, but the attackers would not have done it.

That says a source around the hackers of the systems of KPN have cracked across Tweakers.net. The hackers would be using an exploit, into a core router of KPN that is used for the data traffic of customers to route. Possible it went to zero day: an exploit that was not yet known.

The router of the brand Juniper turned as the operating system Junos 10.4 R5.5; an outdated version of Junos, that during the hack already on version 10.4 R8 was reached. It is possible that the cracked router is not the only node that was fragile, so think a different source, who is familiar with the matter.

As far as is known, there is no internet traffic at KPN customers will be intercepted; that was in theory, however, have been possible. However, it is the hacked router used to further the KPN network to penetrate; it may be a recently discovered vulnerability exploited which makes it possible to in Junos tcp traffic through a ssh-tunnel to the locks. Normally that would be a router in such a position is not possible.

Spokeswoman Simona Petescu of KPN wants the allegations of the source confirm or deny this. “We are still busy with the investigation into the hack, so here we can’t say.” KPN made the hack on its systems Thursday known. Until now, however, was not yet known that there might also be core-routers are hackable: the company speaks only about hacked servers with customer data.

It is striking that on the day that KPN, the hack announced, last Wednesday, a software update from Junos 10.4 appeared. It is not unusual that the day that a hack is revealed is agreed with the supplier of the software. Or this is really so, is, however, unclear.

According to the source, who wishes to remain anonymous, is also tried to the computer in a botnet. Earlier survey showed that of Nu.nl all that the hacked server with customer data, KPN outdated software contained, and also possibly gave access to a dns server. According to KPN, the hack no customer information ontfutseld, but a source of Nu.nl claims 16GB of information to be downloaded. That would now have been removed. Be confirmed KPN that InternetPlus Call by the hack problems would be able to run; then people would not, for example, 112 can call.

It is unclear who exactly is behind this attack. Beveiligingsonderzoeker Rickey Gevers sets given to members of the los-fixed link Anonymous behind the attack sit. KPN works with the police and the Cyber Security Centre for the hackers to find.