Live data from Hacker News

Backdoor found in Linksys, Netgear Routers

github.com

71–80 of 144 posts

Re: Backdoor found in Linksys, Netgear Routers

#71

Earlier quoted context omitted.

Can you tell me which parts you couldn't get? I want to test my understanding - I'll see if I can explain it to you.

What is the tool being shown on slide 18? It looks like it breaks the assembly into basic blocks and shows a control flow graph based on that. Very cool tool, is it open-source?

I am also curious if anybody knows?

*update I Didn't see yalls response until I refreshed the page

Re: Backdoor found in Linksys, Netgear Routers

#72
About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had configured the thing in a manner I thought to be fairly secure -- strong password, no broadcast, etc.. One day the internet goes down and my friend doesn't know what to do. She calls the ISP and asks them what's wrong. They say they can't release any information about the service to her without my permission, so I suddenly get a three-way call explaining that my friend and the ISP representative are on the line and I need to give my authorization to access the account information. Being the person I am, I attempt to troubleshoot things over the phone before giving out any sort of account credentials. Eventually, I ask her to log into the router configuration page. She doesn't know the password and the first one I gave her doesn't work. The representative chimes in "That's fine -- I can just change it from here."

"...What?"

I was furious. Time Warner had left a backdoor in all their modems that gives them administrative access to my private connection. And yes -- she did alter the password remotely. She didn't seem to think there was anything wrong with this. I tried googling for relevant information, but wasn't able to find anything more than speculation at the time.

Re: Backdoor found in Linksys, Netgear Routers

#73
ScMM = SerComm, perhaps?

Many of Linksys' old DSL modems were manufactured by them, AFAIK.. and it seems many of the noted 'probably affected' models have a SerComm manuf'ed device for at least one revision of that model line

More probable SerComm manuf'ed devices are visible at the WD query link below..

http://wikidevi.com/w/index.php?title=Special%3AAsk&q=[[Manu...

Re: Backdoor found in Linksys, Netgear Routers

#76
post #72

About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had configured the thing in a manner I thought to be fairly secure -- strong password, no broadcast, etc.. One day the internet goes down and my friend doesn't know what to do. She calls the ISP and asks them what's wrong. They say they can't release any information a…

This is one of many reasons why routers should be purchased separately from modems, and modems should be configured to be as dumb as possible.

Re: Backdoor found in Linksys, Netgear Routers

#77
post #72

About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had configured the thing in a manner I thought to be fairly secure -- strong password, no broadcast, etc.. One day the internet goes down and my friend doesn't know what to do. She calls the ISP and asks them what's wrong. They say they can't release any information a…

Of course they can. The way DOCSIS is designed, your cable company has full access to your modem; your modem receives configuration data via TFTP from them and in most cases the firmware can only be updated over the coax interface. In fact, it's very rare that there's any configuration you can change on the DOCSIS modem side of things at all, even on the most expensive modems.

Lately cable companies have been pushing these hybrid modem/router combinations with things like wifi support built in. From a consumer standpoint, this seems very convenient, but the cable companies do this because it makes it easier for then. If you call up with an issue with "your Internet," they can remotely diagnose it and reset your modem/router. Make no mistake; they have more control over these than you do.

If you want to stop your ISP from having administrative access to your "private connection" (I assume you mean your wifi), then don't put the modem and the router in the same box. There's no other way around this.

Re: Backdoor found in Linksys, Netgear Routers

#78
post #55

Earlier quoted context omitted.

fortunately, on my wag160n it doesn't seem exposed to the internet

That's not to say somebody can't embed something on a web page (E.G. flash) that connects to 192.168.1.1 and enables configuration from WAN :)

Flash won't let you open connections to other hosts (unless there's a crossdomain.xml file that allows it).

With html/javascript you can send http requests to other hosts, but you can't read the response. It seems like the backdoor isn't accessed over http, so that wouldn't help you either.

Re: Backdoor found in Linksys, Netgear Routers

#79
post #44
post #28

Earlier quoted context omitted.

Or, you know, any $30 OpenWRT-supported router.

Tell me, either way a Soekris box or an OpenWRT compatible router, how this brings a solution to the masses.

There is no purely technological solution for the masses. Actually solving the problem requires either a political revolution to make shipping backdoors like this criminal rather than a favor to the government, or educating users enough that they can protect themselves with the existing technological methods that are easy to deploy given basic computer literacy. It's not really clear which one is less impossible.

Re: Backdoor found in Linksys, Netgear Routers

#80

Earlier quoted context omitted.

No, it's IDA Pro, and it's very, very expensive.

The evaluation version is rather usable and there's a free version of an older release.

Hopper Disassembler is my go-to alternative until my income lets me justify IDA Pro (or Hopper catches up)
Post reply on HN