2Wire BT2700HGV - Port 50001 open ... how to close it - fails security audit

[stripey]

We have a 2wire as follows, how can we close it/disable it?

thanks in advance

Model:     BT2700HGV
Hardware Version:     2701-100589-005
Firmware Version:     6.3.9.63-plus.tm

It is failing a security audit due to port 50001 being open for TCP (was used by 2wire for remote diagnostics but is now a know security issue):

Title: TLS Protocol Session Renegotiation Security Vulnerability Impact: The vulnerability allows man-in-the-middle attack.

Resolution: For OpenSSL, [http://www.openssl.org/source/] upgrade to 0.9.8l or higher. For Microsoft IIS web servers, install the appropriate patch available through [http://technet.microsoft.com/en- us/security/bulletin/MS10-049] Microsoft Security Bulletin 10-049. For other types of products, consult the product documentation.

Risk Factor: Medium/ CVSS2 Base Score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P) CVE: CVE-2009-3555 BID: 36935

[markp]

Hi All,

We have been investigating this issue with the Security Metrix scan showing port 50001 as open. This has now been confimred as a fault with the software that the Security Metrix scan is using and not a fault with the BT routers.

If you are having this problem you will need to report this back to Security Metrix.

Regards

Markp

BT Business Forum Moderator

[TheMightyBox]

Hi Mark,

Who confirmed this software fault, was it Security Metrics themselves?

Regards,

Tony

[markp]

Hi,

We have been advised by BT security that this port does not affect PCI compliance,  and that if  you have any problems with this port and Security Metrix, you need to go back to Security Metrix to resolve the problem.

Regards

Markp

[TheMightyBox]

Then it's a bit misleading to say "been confimred as a fault with the software that the Security Metrix scan is using", when there is no fault, the scan is correctly identifying an open port.

An open port that allows a third party to alter the router without the knowledge of the broadband subscriber. Not sure why BT Security thinks this isn't a PCI issue, it clearly is as 2wire would be gaining direct access to part of the PCI environment without any ability for us to control that.

I've emailed Security Metrics, I doubt they'll confirm this as a false positive based upon what I can see. I shall be ordering a new, more secure, router I guess.

[realitytech]

This is the reason we dont use BT supplied kit, between this and the open access points ours got binned 3 days after it arrived.

If the VoIP lines are non BT then you could perhaps look at a standard router with one or two linsys PAP devices. I beleive there is a dual FXS (two lines out) model that would do this. Failing that we use an Asterisk box here. Thats sat behind a PFSense firewall (which can run Asterisk) and thats sat behind a TP Link modem in PPPOE mode. This setup is a pain but it'll give you better security than any consumer router. Otherwise the FXS behind any generic router will work (possibly you'll need port forwards for 5060/udp)

If its BT provided VoIP lines the above *can* be made to work if you can get the BT SIP credentials. There is info on doing just this about but BT wont tell you what they are or how to get them if you ask.

if your VoIP provider already provided a stand alond FXS you may just need the port forward and any generic router will work. We use a hell of a lot of TP Link kit which has never let us down over hundreds of installs.

[Stephenc]

Hi there,

Yes the software does show the port open as it is open.  However enough testing was not performed by Security Metrix to check if this was a security risk, upon further testing Security Metrix have confirmed the port is not a security risk and is used for genuine purposes.

Thanks,

Steve

[WelshGrass]

Hi there,

I've just been completing the PCI DSS process for Cardsave using Trustwave's online scanner.  I too had vulnerabilities on port 50001 and 3479.

I went to Firewall, Advanced configuration and made sure everything that was unchecked was checked except Excessive Session Detection. Rescanning after this gave me the all clear.

So, can anyone tell me which option(s) out of Block Ping, Strict UDP Session Control, Inbound NetBIOS and Outbound NetBIOS I really needed to set or is disabling these a good idea anyway?

BT should be made aware that this issue may crop up again as more SMEs have to take PCI DSS certification.

[murrayharr]

I have this problem as well. BT seem to say it is securitymetrix and securitymetrix say it is BT. Either way, it must be resolved or a load of SME's like us are going to have to find new broadband providors. As mentioned, HSBC charge a lot of money each month if one is not secure, not to menion customer problems if one does not show the right security features to ones website-using clients.

This is not a joke, it is a very serious matter. What is the point of having bt business, which is supposed to be the Rolls-Royce of broadband ... if it is not suitable for business?

[adrianc]

"Either way, it must be resolved or a load of SME's like us are going to have to find new broadband providors"

Well, a new router really. As to the earlier question about VoIP support - if the VoIP in question is BT Broadband Voice then it is fully SIP compliant and should work with any SIP compatible equipment.

Adrian

[Edited for grammar]

[Ham1979]

Has there been any update on this on anyone had any breakthroughs?

I'm not hopeful and I think it's wrong of BT to say it's a fault with Security Metrics when it's not. Their job is to identify unnecessary open ports which this appears to be and that is what they have done. I've tried changing settings on the firewall as someone else mentioned but scan still fails

It's BT's job to tells us how to close the port or liaise with the companies that run the scans to stop it being identified as a security vulnerability if thats genuienly true and not just them trying to pass the buck. 

If it's for firmware updates, there is no need for this to be open all the time or at least it should be hidden that it's open

If the only solution is to bin the BT equipment and use a third party modem then there should be a reduction in fees to contribute to the cost of the equipment