Compromising OpenWrt Supply Chain

#1

Post by udev4096 » Mon, Dec 09, 2024, 4:36 AM UTC

Compromising OpenWrt Supply Chain
flatt.tech

Re: Compromising OpenWrt Supply Chain

#2

Post by efitz » Mon, Dec 09, 2024, 5:28 AM UTC

Very well written and easy to follow description of your attack.

Re: Compromising OpenWrt Supply Chain

#3

Post by renewiltord » Mon, Dec 09, 2024, 5:37 AM UTC

Nicely done. Good write up too. I liked the bits about making hashcat do what you wanted.

Re: Compromising OpenWrt Supply Chain

#4

Post by micw » Mon, Dec 09, 2024, 5:40 AM UTC

That's why open source can never compete with business grade closed source stuff:

- they fixed the in 3 hours instead of making customers wait 6 months for a patch (if any)

- they did not try to sue the reporter of the issue

- they did not even tell the users to throw away the "outdated" but perfectly working devices, offering a small discount to buy new

Re: Compromising OpenWrt Supply Chain

#5

Post by rekttrader » Mon, Dec 09, 2024, 5:54 AM UTC

Killer write up, very clever bit of code reading and exploit development.

Re: Compromising OpenWrt Supply Chain

#6

Post by holoduke » Mon, Dec 09, 2024, 6:18 AM UTC

micw wrote: post #4

That's why open source can never compete with business grade closed source stuff: - they fixed the in 3 hours instead of making customers wait 6 months for a patch (if any) - they did not try to sue the reporter of the issue - they did not even tell the users to throw away the "outdated" but perfectly working devices, offering a small discount to buy new

Home assistant and vlc anyone?

Re: Compromising OpenWrt Supply Chain

#7

Post by [deleted] » Mon, Dec 09, 2024, 6:19 AM UTC

micw wrote: post #4

That's why open source can never compete with business grade closed source stuff: - they fixed the in 3 hours instead of making customers wait 6 months for a patch (if any) - they did not try to sue the reporter of the issue - they did not even tell the users to throw away the "outdated" but perfectly working devices, offering a small discount to buy new

[deleted]

Re: Compromising OpenWrt Supply Chain

#8

Post by nrvn » Mon, Dec 09, 2024, 6:42 AM UTC

Loving this. I wonder how people even come up with an idea of truncating hashes. For what purpose or benefit?

Re: Compromising OpenWrt Supply Chain

#9

Post by teleforce » Mon, Dec 09, 2024, 6:51 AM UTC

>I immediately noticed that the length of the hash is truncated to 12, out of 64 characters.

Ouch...

Re: Compromising OpenWrt Supply Chain

#10

Post by ffk » Mon, Dec 09, 2024, 6:52 AM UTC

nrvn wrote: post #8

Loving this. I wonder how people even come up with an idea of truncating hashes. For what purpose or benefit?

Sometimes it’s done to fit into an existing tool/database that has a preexisting limit. Or when the hash is used only as a locator rather than for integrity.

Not a good practice imo but people are pragmatic.