topic Re: Home Hub 4000 port 22 is open ! in Internet

Home Hub 4000 port 22 is open !

Felice — Fri, 27 Jan 2023 05:00:08 GMT

Hello, I run a port scanner daily. Few days ago my scanner reported a new port open on my Home Hub 4000 router public IP, ssh port 22. It looks like Bell enabled sshd service on my router remotely without my knowledge and consent. Called support but was waste of time, never received call back from next level tech. Anyone know how to disable sshd on this router or block this port ? It's a vulnerability.

Re: Home Hub 4000 port 22 is open !

ZaneP — Fri, 27 Jan 2023 18:01:15 GMT

Hi @Felice

A scan on port 22 on my HH4k shows it's filtered. Bell would use this port to access their modem. Why it's been opened to run an ssh daemon for no clear reason is uncertain.

There's no user access to disable or block this port.

You may want to post this question on the DSLR, Bell forum, as there are many tech-oriented people there who will likely reply. https://www.dslreports.com/forum/sympat

Keep us posted.

Cheers,

ZaneP

Re: Home Hub 4000 port 22 is open !

Felice — Fri, 27 Jan 2023 18:55:12 GMT

Thanks @ZaneP ,

That's odd, this morning I asked a friend of mine to scan it on his HH4K and it's open on his too.

You need to scan from outside your home network. Try telnet'ing to yyour public IP port 22 from your smartphone data connection or from some other network like Videotron.

Regards,
Felice

Re: Home Hub 4000 port 22 is open !

ZaneP — Fri, 27 Jan 2023 20:35:44 GMT

I've tried to ssh to my public IP port 22, with my phone with a non-Bell data connection. Keeps timing out 🙄

I cannot forward my ssh port as Router 22 port is already open

mai1015 — Sun, 12 Feb 2023 15:55:48 GMT

Hello, I have been using the Bell Hub 4000 for a while now. I was able to forward the SSH port to my computer so I could remotely connect to it. However, right now the router is not forwarding it anymore. When I try to connect remotely, I get an error message that says "port 22: no matching host key type found. Their offer: ssh-rsa, ssh-dss."

so, I assume that means the ssh port is open on router and wondering what could have happened to the router that caused it to open SSH port. There doesn't seem to be any setting to disable SSH on the router. As a result, I have to use an alternative port. Has anyone else experienced something similar?

Re: I cannot forward my ssh port as Router 22 port is already open

ZaneP — Sun, 12 Feb 2023 22:24:51 GMT

Bell uses port 22 to manage the modem, afaik. Did your HH4000 get a firmware update recently?

Someone else posted to this Community forum re SSH, here . Also, a recent post was made to the Bell sub on Reddit, here . Sounds like an RSA key change?

Re: I cannot forward my ssh port as Router 22 port is already open

mai1015 — Sun, 12 Feb 2023 23:07:25 GMT

i think do not know as it should be automatic. so i guess there is no way to close it?

Re: I cannot forward my ssh port as Router 22 port is already open

miradna — Mon, 13 Feb 2023 03:20:12 GMT

Why is this marked as "solved"?

There is a rogue dropbear server running on "Giga Hub", preventing the use of port 22 for user services. This a big security risk, and very inconvenient for those of us that need port 22.

It's ridiculous, I've never seen this behaviour in 35 years of internet use. A modem or router has no reason to block a standard and well-known port, especially one below 1024, for it's own internal use. There are multiple CVEs on dropbear, and it forces me to do a lot of work to update other scripts to include port numbers.

Bell please revert your changes and allow your users to use the ports we've paid for, as is standard for any ISP in the world.

Re: I cannot forward my ssh port as Router 22 port is already open

ZaneP — Mon, 13 Feb 2023 03:36:37 GMT

Agreed. This issue is not solved. MITM attack in SSH?

Re: I cannot forward my ssh port as Router 22 port is already open

mai1015 — Mon, 13 Feb 2023 03:42:07 GMT

i actually call bell for it, and they have no idea about it and keep telling me that they do can not change anything other than resetting password. Guess will need another hot fix for the router.

Re: I cannot forward my ssh port as Router 22 port is already open

ZaneP — Mon, 13 Feb 2023 03:45:08 GMT

The open port exposes exploits.

I don't think the first tier of Bell tech support is equipped to deal with this issue. You may want to post your specific concerns, with as much detail as you can provide, to the Bell Direct forum on DSL Reports, here . The forum is moderated by Bell techs, and your post is private. You'll need to register as a user, since anonymous posts are not accepted on that forum.

You could also post publicly, to get users' feedback and input, on this DSL Reports Bell forum

SSH on Giga Hub

suwalski — Wed, 01 Nov 2023 20:33:56 GMT

At some point in the past few months, my SSH forward to my home server stopped working.

I finally had time to explore in detail, and it appears the Giga Hub is responding with Dropbear SSH on port 22 instead of honouring my forward. This seems like a huge security risk, and overall broken as a concept, since it breaks the legitimate forward. The forward does work on another port.

Other posts suggest that this broke back in January with a firmware update.

Is Bell getting this issue fixed with another update?

Re: Home Hub 4000 port 22 is open !

User163974 — Mon, 18 Dec 2023 23:21:03 GMT

Any updates on this issue? Observing an open port 22 on my giga hub as well. To make it worse, user/pass auth is on and the ssh server being served is an outdated (by quite a few years) dropbear server with known vulnerabilities...why is something like this left open???? Fix please as we can't close it on our end?

Re: Home Hub 4000 port 22 is open !

Zadigre — Mon, 22 Jul 2024 22:54:08 GMT

I see this thread has been dead since December 2023... but it's still an issue (port 22 is still opened on my GigaHub. Is Bell listening? Any opened port is a security risk. Bell, when are you going to fix this?

Re: Home Hub 4000 port 22 is open !

Vanadiel — Mon, 22 Jul 2024 23:14:24 GMT

How are you scanning for the open port?

Re: Home Hub 4000 port 22 is open !

Zadigre — Mon, 22 Jul 2024 23:20:17 GMT

I used https://www.shodan.io/ to see if this website had anything on my ip address.

I also connected to port 22 from my work network (non bell internet connection)

Re: Home Hub 4000 port 22 is open !

Vanadiel — Mon, 22 Jul 2024 23:24:33 GMT

So if you use this it shows port 22 open?

Re: Home Hub 4000 port 22 is open !

Zadigre — Mon, 22 Jul 2024 23:26:50 GMT

yes this is shown as opened on this website too.

Re: Home Hub 4000 port 22 is open !

Vanadiel — Mon, 22 Jul 2024 23:33:52 GMT

Interesting. Must the the USB file sharing service that is using that port.

Re: Home Hub 4000 port 22 is open !

Zadigre — Mon, 22 Jul 2024 23:36:47 GMT

euh no...

this is public facing ssh port. I guess bell is using it to remotely manage the equipement... but this doesn't make sense considering it's opened to everyone. they should limit connection to their own internal network.