Can this be fixed by changing the firmware to OpenWRT or DD-WRT?
Backdoor found in Linksys, Netgear Routers
31–40 of 144 posts
Re: Backdoor found in Linksys, Netgear Routers
#32Why backdoor?? That's what I want to know.
Me too. Up this!
Re: Backdoor found in Linksys, Netgear Routers
#33Can this be fixed by changing the firmware to OpenWRT or DD-WRT?
Yes, this isn't a hardware backdoor, it's all in the software.
Re: Backdoor found in Linksys, Netgear Routers
#34TIL: Some people know a lot more than me about hacking. That PDF was interesting, but I only understood a small fraction of it.
Can you tell me which parts you couldn't get? I want to test my understanding - I'll see if I can explain it to you.
My main problems were with the memes.
Seriously, nothing against a little humor in your slides. But making every seconds slide a meme reference gets annoying pretty fast :)
Re: Backdoor found in Linksys, Netgear Routers
#35Interesting. Reminds me of the hack I did on a (mandatory) modem/router forced on AT&T users. They had a bunch of problems with it, so one day I got fed up after the millionth disconnect and cracked it open. Got a serial root shell by using the "magic !" command (completely randomly discovered) and dumped the source to the web UI(in Lua/haserl). From there found the equivalent of a SQL injection vulnerability and used it to gain a remote root exploit.
Most annoyingly, AT&T put out a firmware update some months later that closed the exploit, but didn't fix any other problems. So, I found another more intrusive/permanent exploit. Still waiting on them to patch it next heh. But now they are actually putting out some updates that actually fix problems too at least. Hopefully user uproar will continue to drive them to fix more problems
Re: Backdoor found in Linksys, Netgear Routers
#36Don't worry, no one will ever find out.
Re: Backdoor found in Linksys, Netgear Routers
#37Earlier quoted context omitted.
Could you describe the whole reversing process in a bit more detail? Binary goes in, understanding comes out, you can't explain that (well I hope someone can).
I'm going to rush this, sorry. * Guy sees service running on 32764 and thinks that's quite odd * Gets very frustrated at useless forum posts from people with no clue * Downloads a copy of the firmware from the (horrible) modem-help.co.uk This is where it gets interesting: Binwalk ------ First off, a program called Binwalk is used. This is a combo of a really cool python script, the libmagic database (if you've used t…
It sounds like binwalk is a member of a family of programs referred to as file rippers. These used to be easy to find, but the "rip" keyword has been taken over by CD and DVD ripping software. They were commonly used to extract embedded files from demo scene demos, including .mod/.s3m/.xm/.it music and .flc videos.
Re: Backdoor found in Linksys, Netgear Routers
#38Earlier quoted context omitted.
Could you describe the whole reversing process in a bit more detail? Binary goes in, understanding comes out, you can't explain that (well I hope someone can).
I'm going to rush this, sorry. * Guy sees service running on 32764 and thinks that's quite odd * Gets very frustrated at useless forum posts from people with no clue * Downloads a copy of the firmware from the (horrible) modem-help.co.uk This is where it gets interesting: Binwalk ------ First off, a program called Binwalk is used. This is a combo of a really cool python script, the libmagic database (if you've used t…
This is one of the most useful comments I've seen on HN. Thanks!
Re: Backdoor found in Linksys, Netgear Routers
#39Earlier quoted context omitted.
I'm going to rush this, sorry. * Guy sees service running on 32764 and thinks that's quite odd * Gets very frustrated at useless forum posts from people with no clue * Downloads a copy of the firmware from the (horrible) modem-help.co.uk This is where it gets interesting: Binwalk ------ First off, a program called Binwalk is used. This is a combo of a really cool python script, the libmagic database (if you've used t…
It sounds like binwalk is a member of a family of programs referred to as file rippers. These used to be easy to find, but the "rip" keyword has been taken over by CD and DVD ripping software. They were commonly used to extract embedded files from demo scene demos, including .mod/.s3m/.xm/.it music and .flc videos.
I'd forgotten about these rippers!
Another good one to look at is QuickBMS - allows you to define a "script" and then feed it to the ripper. I guess it saves you time writing boilerplate code when trying to get at new/unknown file formats. The Xentax Game Research forum loves it - http://aluigi.altervista.org/quickbms.htm (blocked as Hacking/Internet by the corporate proxy here, so it's good)
Re: Backdoor found in Linksys, Netgear Routers
#40[deleted]