Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor found in Linksys, Netgear Routers

github.com

Post reply on HN
Print view View original

51–60 of 144 posts

Re: Backdoor found in Linksys, Netgear Routers

#51

Post by eschulte »

voltagex_ wrote: post #27
sprobertson wrote: post #19

Earlier quoted context omitted.

Could you describe the whole reversing process in a bit more detail? Binary goes in, understanding comes out, you can't explain that (well I hope someone can).

I'm going to rush this, sorry. * Guy sees service running on 32764 and thinks that's quite odd * Gets very frustrated at useless forum posts from people with no clue * Downloads a copy of the firmware from the (horrible) modem-help.co.uk This is where it gets interesting: Binwalk ------ First off, a program called Binwalk is used. This is a combo of a really cool python script, the libmagic database (if you've used t…

I walk through a similar process here [1], using binwalk to extract the source-code from a firmware image, then running the insecure router software in a QEMU VM. Although the purpose in the linked instructions is to repair a different Netgear exploit from October 2013 by modifying the insecure binary executable (see [2] for information on the technique).

[1] http://eschulte.github.io/netgear-repair/INSTRUCTIONS.html

[2] http://eschulte.github.io/netgear-repair/

Re: Backdoor found in Linksys, Netgear Routers

#52

Post by X4 »

rjzzleep wrote: post #16
X4 wrote: post #6

I hacked my Fritz!Box (yeah, a bad name for a german router) and I'm entirely sure that it has a backdoor integrated too. That's why I wiped and flashed it with an alternative image. That and the Telecom's Speedport router are the most popular routers by far in Germany. And both have backdoors, I know that other router manufacturers also integrate backdoors from a source who works at such a company. A friend can also…

i think it's kinda convenient for companies that they can now blame the nsa for everything. i really think a lot more companies put backdoors into their software without external pressure(sometimes not intentional, just because of laziness or stupidity)

I agree, there are also some laws that force ISPs to do things they don't feel comfortable with. I know it's not entirely their fault.

I've heard of some cases that ISPs tried to stop by going to court, like permanent-storage of all data, but lost the case. It's not just the NSA btw. in Germany there is the Bundesnachrichtendienst (BND), which translates to "Federal Intelligence Service"

Re: Backdoor found in Linksys, Netgear Routers

#53

Post by gwu78 »

gry wrote: post #44
yuvadam wrote: post #28

Earlier quoted context omitted.

Or, you know, any $30 OpenWRT-supported router.

Tell me, either way a Soekris box or an OpenWRT compatible router, how this brings a solution to the masses.

Take orders on Kickstarter for "open source router".

You order the Soekris boxes on behalf of the crowdfunders. You image your chosen open source OS on blank CF cards, bundle the CF cards together with the Soekris boxes and ship these to the crowdfunders as the "open source router".

If you want to bring a solution to the masses out of the goodness of your heart and you are motivated, then nothing is stopping you.

Re: Backdoor found in Linksys, Netgear Routers

#54

Post by tracker1 »

salient wrote: post #31

Can this be fixed by changing the firmware to OpenWRT or DD-WRT?

If supported, I like Tomato (prefer the shibby variant) is my fav, a large number of routers are supported... I've been using and recommending a couple asus models.. RT-N12, RT-N16 and RT-N66(U/R) ... Been pretty good hardware (stock firmware sucks though).

Note: Tomato is imho a bit nicer than DD-WRT, but not as good for tweaking as OpenWRT (which I use on my office routerstation pro).

Re: Backdoor found in Linksys, Netgear Routers

#55

Post by Cakez0r »

tagliala wrote: post #11
jacob019 wrote: post #8

is this backdoor only served up on the wlan or is it also exposed to the internet?

fortunately, on my wag160n it doesn't seem exposed to the internet

That's not to say somebody can't embed something on a web page (E.G. flash) that connects to 192.168.1.1 and enables configuration from WAN :)

Re: Backdoor found in Linksys, Netgear Routers

#56

Post by voltagex_ »

haberman wrote: post #49
voltagex_ wrote: post #13

Earlier quoted context omitted.

Can you tell me which parts you couldn't get? I want to test my understanding - I'll see if I can explain it to you.

What is the tool being shown on slide 18? It looks like it breaks the assembly into basic blocks and shows a control flow graph based on that. Very cool tool, is it open-source?

No, it's IDA Pro, and it's very, very expensive.

Re: Backdoor found in Linksys, Netgear Routers

#58

Post by vinhboy »

earlz wrote: post #35

Interesting. Reminds me of the hack I did on a (mandatory) modem/router forced on AT&T users. They had a bunch of problems with it, so one day I got fed up after the millionth disconnect and cracked it open. Got a serial root shell by using the "magic !" command (completely randomly discovered) and dumped the source to the web UI(in Lua/haserl). From there found the equivalent of a SQL injection vulnerability and use…

do you have a write up with more details about those exploits?

Re: Backdoor found in Linksys, Netgear Routers

#59

Post by voltagex_ »

revelation wrote: post #46
voltagex_ wrote: post #27

Earlier quoted context omitted.

I'm going to rush this, sorry. * Guy sees service running on 32764 and thinks that's quite odd * Gets very frustrated at useless forum posts from people with no clue * Downloads a copy of the firmware from the (horrible) modem-help.co.uk This is where it gets interesting: Binwalk ------ First off, a program called Binwalk is used. This is a combo of a really cool python script, the libmagic database (if you've used t…

He doesn't actually exploit the heap overflow. He just sends messages as a normal backdoor user would, theres no authentication. (He also greps for the string the server sent upon connection, but it's nowhere to be found. He then just greps for bind and filters for binary files only, to find all binaries that call bind (remember dynamic linking in the end comes down to strings..))

Thanks.

Re: Backdoor found in Linksys, Netgear Routers

#60

Post by wahsd »

rikacomet wrote: post #57

From the sounds of it, these are purposely made backdoors? or something ignored ? My expression: http://i.imgur.com/pYJMKC6.jpg

NSA/Government/Military mindset.... secrecy by obscurity. It's now "We'll just hide our backdoor, really, super well. No one will every find it. And we'll use our deep black VPN no one knows about....and hope no one notices."
Post reply on HN