7 ms·

DD-WRT, I Know Where You Live

94 points by r11t 16y ago

jberryman 16y ago
For those not familiar with the whole router firmware hacking thing, here is the backstory http://www.wi-fiplanet.com/tutorials/article.php/3562391/The-Open-Source-WRT54G-Story.htm http://www.wi-fiplanet.com/tutorials/article.php/3562391/The... Also in addition to DD-wrt there is openwrt which I've got running on my router, and probably a number of others.
jpcx01 16y ago
Some background here would be really nice (for us non device hackers). Who exactly would have DD-WRT on their routers? Is it something you have to install manually? edit: i should have googled before asking :-). Apparently it's a custom firmware for linksys routers. Looks like you have to go through a lot of trouble to get it installed, so I'm sure the overall userbase is pretty small.
- reeses 16y ago
  There was enough demand that Linksys created models just for this purpose (the WRT54GL and friends). It's an easy upgrade for a technical person. Download custom firmware, upload to router, reboot. The same people who would upgrade their own firmware from Linksys can install dd-wrt, Tomato, hyperwrt, etc. Admittedly, that's a small slice of the population but a large number of people.
  - jimmyjim 16y ago
    For what purpose exactly would you want to put custom firmware on it? Why isn't the stock firmware good enough? I've a WRT54G router -- do I have any good reason to use any custom firmware? I'm guessing it's just for hobbyists -- "just for the fun of it" kind of thing?
    - johnny22 16y ago
      These firmware variants allow it to replace far more expensive devices. It's also quite small and requires little power. I personally use an WRT54GL hardware to offer public internet access to folks at a coffeeshop. Here is what this $69 USD (when i bought it) device helped with. Public Wireless - The range covers the entire store and the outdoor seating area. Here we mention terms of service and "beg" them to buy something with captive portal software. I'm not really sure how many clients it can handle, but it certainly meets the need. Public Terminals - It serves up PXE boot images to 3 netbooted terminals. They run the Linux Terminal Server Project software. It also makes it easy to set up firewalls, QOS, and anything else you might do with any other Linux box. I think it's a great deal for $69 USD. This same device has been running for > 4 years!
    - anonymous246 16y ago
      QoS (prioritize your ssh packets over your netflix stream over your http reqs); ssh server (so that you can have a SOCKS proxy to connect to from public Wifi); VPN endpoint; VOIP SIP proxy (to do fancy routing of SIP calls). I'm pretty sure you can install a web browser and serve up static content from a consumer NAS too. Basically, it lets you do a large subset of what you would be able to do with an always-on computer, but without burning all that power.
      - evilduck 16y ago
        Some router models have USB ports and can be NAS devices too. Also, my biggest reason for custom firmware: upping the radio range. Linksys' default output is very conservative.
    - pontifier 16y ago
      I have a couple of routers using dd-wrt. I have one of them set up on my roof, and another in my server room (a closet). The one on the roof acts as a wireless client to the main access point, and also as a wireless access point itself. I have also set up a bunch of internal static ips for different machines and printers and such, and I seem to recall there was some ridiculously low number of slots to add them in default firmware on one of the routers I was using. (it has been a few years though).
  - johnny22 16y ago
    If you happen to have an original wrt54gl of version 1.0 or 1.1 you can reasonably use those as well since they ran Linux The ones that came after switched to vxWorks and really slimmed down on the ram. Then, then introduced the wrt54GL (the L meaning Linux)
- david2777 16y ago
  I have it installed on my Belkin router because the stock firmware doesn't support Telnet connections. It's pretty great.
- trafficlight 16y ago
  I work for a small WISP and we install DD-WRT on all of the routers we hand out. It's much easier to manage and diagnose connection problems with DD-WRT than with the default firmware.
- JonnieCache 16y ago
  The best feature for me is the support for unusual wireless topographies. Our house is rented, so I can't go drilling holes in things to route ethernet cable. Instead I've built a wireless mesh network out of several DD-WRT routers, with the bonus of bridging this to the wired switch on each unit. This way the xbox and the kitchen computer can connect to the internet, which comes in upstairs, with no fuss. You can also do lots of fun point-to-point stuff. With a decent aerial and line of sight you can throw wifi for 2 miles or more using consumer routers. http://www.dd-wrt.com/wiki/index.php/Linking_Routers http://www.dd-wrt.com/wiki/index.php/Linking_Routers a close second is the SNMP server, allowing me to use this OSX dashboard widget to get a graph of incoming/outgoing bandwidth usage at the router: http://www.apple.com/downloads/dashboard/networking_security/ieyenet.html http://www.apple.com/downloads/dashboard/networking_security... If anyone is wondering which device is generally considered the best balance of price/spec for running these firmwares, its widely agreed to be the Buffalo WHR-HP-G54, which can be had for around £40/$60 EDIT: oh yeah and of course its also an openVPN server. Forgot about that. And if you get one with a USB port you can plug in a HDD and run rsync on it...
jared314 16y ago
"Info Page" setting he talks about is: Administration tab > Management sub-tab > Web Access section > "Enable Info Site"
ck2 16y ago
I wonder if Tomato is affected. I randomize the two mac addresses weekly anyway.
- jedsmith 16y ago
  > I randomize the two mac addresses weekly anyway. Why?
  - ck2 16y ago
    Paranoia. It's also a guaranteed way to get a new external IP assigned, even when renewing your DHCP lease fails to.
    - newman314 16y ago
      Do you have a script to do this or do you do it manually?
      - ck2 16y ago
        Manually. I wish I could tell it to randomize when I shutdown but that would be pretty difficult to accomplish. I wonder if I could make Tomato randomize them on startup (I power the router down nightly).
Pent 16y ago
So by visiting his blog we are essentially letting him use rebind on our connections? ;)
blinkingled 16y ago
My SVN build of DD-WRT has a "No DNS Rebind" setting defaulting to true. Not sure if this prevents the attack - couldn't find easy steps to reproduce in order to verify.
frou_dh 16y ago
DD-WRT seemed decidedly "bloated" after I found out about Tomato. Maybe that is unfair or ignorant on my part, but do check out Tomato if you are considering DD-WRT. http://www.polarcloud.com/tomato http://www.polarcloud.com/tomato
- drivebyacct2 16y ago
  Only if you're fortunate enough to have a supported device. :(
  - bconway 16y ago
    Both OpenWRT and Tomato USB (http://tomatousb.org/ http://tomatousb.org/) feature broader device support (via a 2.6 kernel). I prefer the latter.
    - drivebyacct2 16y ago
      Thanks for the link, sadly it appears that the later version of the WRT54G still aren't supported. :(
- djacobs 16y ago
  Why are the only routers supported using 802.11G? I got one of the Buffalo 300N routers and was looking forward to trying this instead of DD-WRT.
  - nuclear_eclipse 16y ago
    I assume it's because the developers of Tomato don't have any of the newer routers to attempt supporting them. There are a few other options for the G300NH, including OpenWRT, but I've just decided to stick with DD-WRT because it seems to have the best overall feature set.
dfhjtyjty 16y ago
Click on our website: ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== "Priority, my friend!! Christmas is coming, quick to our website shopping, our web site shopping there will be something different, unexpected things to you, let you have different sense, our website wholesale various fashion shoes, such as Nike, Jordan, prada, also includes the jeans, shirt, bags, hats and decoration. All these products are our free transport, prices are competitive, we can also accept paypal j, after the payment within short time, can ship. = New era cap $12; Air jordan(1-24)shoes $30; jordan air max oakland raiders $34a€“39; Ed Hardy AF JUICY POLO Bikini $25; Christan Audigier BIKINI JACKET $25; Tshirts (Polo ,ed hardy,lacoste) $15 coogi DG edhardy gucci t-shirts $18; gstar coogi evisu true jeans $35; coach chanel gucci LV handbags $36; Sunglasses(Oakey,coach,gucci,A r m a i n i) $15; ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ====
djacobs 16y ago
Is there a solution to this yet? He says it affects you whether or not you have the info page enabled.
- EastSmith 16y ago
  The solution is to password protect the info page. I also checked if there is new firmware. Also, on my Buffalo I just set up SSH and stopped httpd. Didn't know how to do it, so I read here http://www.dd-wrt.com/wiki/index.php/Telnet/SSH_and_the_command_line http://www.dd-wrt.com/wiki/index.php/Telnet/SSH_and_the_comm... and here http://www.howtoforge.com/ssh_key_based_logins_putty http://www.howtoforge.com/ssh_key_based_logins_putty

94 points by r11t 16y ago

For those not familiar with the whole router firmware hacking thing, here is the backstory http://www.wi-fiplanet.com/tutorials/article.php/3562391/The-Open-Source-WRT54G-Story.htm http://www.wi-fiplanet.com/tutorials/article.php/3562391/The... Also in addition to DD-wrt there is openwrt which I've got running on my router, and probably a number of others.

jpcx01 16y ago

Some background here would be really nice (for us non device hackers). Who exactly would have DD-WRT on their routers? Is it something you have to install manually? edit: i should have googled before asking :-). Apparently it's a custom firmware for linksys routers. Looks like you have to go through a lot of trouble to get it installed, so I'm sure the overall userbase is pretty small.

reeses 16y ago
There was enough demand that Linksys created models just for this purpose (the WRT54GL and friends). It's an easy upgrade for a technical person. Download custom firmware, upload to router, reboot. The same people who would upgrade their own firmware from Linksys can install dd-wrt, Tomato, hyperwrt, etc. Admittedly, that's a small slice of the population but a large number of people.
- jimmyjim 16y ago
  For what purpose exactly would you want to put custom firmware on it? Why isn't the stock firmware good enough? I've a WRT54G router -- do I have any good reason to use any custom firmware? I'm guessing it's just for hobbyists -- "just for the fun of it" kind of thing?
  - johnny22 16y ago
    These firmware variants allow it to replace far more expensive devices. It's also quite small and requires little power. I personally use an WRT54GL hardware to offer public internet access to folks at a coffeeshop. Here is what this $69 USD (when i bought it) device helped with. Public Wireless - The range covers the entire store and the outdoor seating area. Here we mention terms of service and "beg" them to buy something with captive portal software. I'm not really sure how many clients it can handle, but it certainly meets the need. Public Terminals - It serves up PXE boot images to 3 netbooted terminals. They run the Linux Terminal Server Project software. It also makes it easy to set up firewalls, QOS, and anything else you might do with any other Linux box. I think it's a great deal for $69 USD. This same device has been running for > 4 years!
  - anonymous246 16y ago
    QoS (prioritize your ssh packets over your netflix stream over your http reqs); ssh server (so that you can have a SOCKS proxy to connect to from public Wifi); VPN endpoint; VOIP SIP proxy (to do fancy routing of SIP calls). I'm pretty sure you can install a web browser and serve up static content from a consumer NAS too. Basically, it lets you do a large subset of what you would be able to do with an always-on computer, but without burning all that power.
    - evilduck 16y ago
      Some router models have USB ports and can be NAS devices too. Also, my biggest reason for custom firmware: upping the radio range. Linksys' default output is very conservative.
  - pontifier 16y ago
    I have a couple of routers using dd-wrt. I have one of them set up on my roof, and another in my server room (a closet). The one on the roof acts as a wireless client to the main access point, and also as a wireless access point itself. I have also set up a bunch of internal static ips for different machines and printers and such, and I seem to recall there was some ridiculously low number of slots to add them in default firmware on one of the routers I was using. (it has been a few years though).
- johnny22 16y ago
  If you happen to have an original wrt54gl of version 1.0 or 1.1 you can reasonably use those as well since they ran Linux The ones that came after switched to vxWorks and really slimmed down on the ram. Then, then introduced the wrt54GL (the L meaning Linux)
david2777 16y ago
I have it installed on my Belkin router because the stock firmware doesn't support Telnet connections. It's pretty great.
trafficlight 16y ago
I work for a small WISP and we install DD-WRT on all of the routers we hand out. It's much easier to manage and diagnose connection problems with DD-WRT than with the default firmware.
JonnieCache 16y ago
The best feature for me is the support for unusual wireless topographies. Our house is rented, so I can't go drilling holes in things to route ethernet cable. Instead I've built a wireless mesh network out of several DD-WRT routers, with the bonus of bridging this to the wired switch on each unit. This way the xbox and the kitchen computer can connect to the internet, which comes in upstairs, with no fuss. You can also do lots of fun point-to-point stuff. With a decent aerial and line of sight you can throw wifi for 2 miles or more using consumer routers. http://www.dd-wrt.com/wiki/index.php/Linking_Routers http://www.dd-wrt.com/wiki/index.php/Linking_Routers a close second is the SNMP server, allowing me to use this OSX dashboard widget to get a graph of incoming/outgoing bandwidth usage at the router: http://www.apple.com/downloads/dashboard/networking_security/ieyenet.html http://www.apple.com/downloads/dashboard/networking_security... If anyone is wondering which device is generally considered the best balance of price/spec for running these firmwares, its widely agreed to be the Buffalo WHR-HP-G54, which can be had for around £40/$60 EDIT: oh yeah and of course its also an openVPN server. Forgot about that. And if you get one with a USB port you can plug in a HDD and run rsync on it...

jared314 16y ago

"Info Page" setting he talks about is: Administration tab > Management sub-tab > Web Access section > "Enable Info Site"

ck2 16y ago

I wonder if Tomato is affected. I randomize the two mac addresses weekly anyway.

jedsmith 16y ago
> I randomize the two mac addresses weekly anyway. Why?
- ck2 16y ago
  Paranoia. It's also a guaranteed way to get a new external IP assigned, even when renewing your DHCP lease fails to.
  - newman314 16y ago
    Do you have a script to do this or do you do it manually?
    - ck2 16y ago
      Manually. I wish I could tell it to randomize when I shutdown but that would be pretty difficult to accomplish. I wonder if I could make Tomato randomize them on startup (I power the router down nightly).

Pent 16y ago

So by visiting his blog we are essentially letting him use rebind on our connections? ;)

blinkingled 16y ago

My SVN build of DD-WRT has a "No DNS Rebind" setting defaulting to true. Not sure if this prevents the attack - couldn't find easy steps to reproduce in order to verify.

frou_dh 16y ago

DD-WRT seemed decidedly "bloated" after I found out about Tomato. Maybe that is unfair or ignorant on my part, but do check out Tomato if you are considering DD-WRT. http://www.polarcloud.com/tomato http://www.polarcloud.com/tomato

drivebyacct2 16y ago
Only if you're fortunate enough to have a supported device. :(
- bconway 16y ago
  Both OpenWRT and Tomato USB (http://tomatousb.org/ http://tomatousb.org/) feature broader device support (via a 2.6 kernel). I prefer the latter.
  - drivebyacct2 16y ago
    Thanks for the link, sadly it appears that the later version of the WRT54G still aren't supported. :(
djacobs 16y ago
Why are the only routers supported using 802.11G? I got one of the Buffalo 300N routers and was looking forward to trying this instead of DD-WRT.
- nuclear_eclipse 16y ago
  I assume it's because the developers of Tomato don't have any of the newer routers to attempt supporting them. There are a few other options for the G300NH, including OpenWRT, but I've just decided to stick with DD-WRT because it seems to have the best overall feature set.

dfhjtyjty 16y ago

Click on our website: ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== "Priority, my friend!! Christmas is coming, quick to our website shopping, our web site shopping there will be something different, unexpected things to you, let you have different sense, our website wholesale various fashion shoes, such as Nike, Jordan, prada, also includes the jeans, shirt, bags, hats and decoration. All these products are our free transport, prices are competitive, we can also accept paypal j, after the payment within short time, can ship. = New era cap $12; Air jordan(1-24)shoes $30; jordan air max oakland raiders $34a€“39; Ed Hardy AF JUICY POLO Bikini $25; Christan Audigier BIKINI JACKET $25; Tshirts (Polo ,ed hardy,lacoste) $15 coogi DG edhardy gucci t-shirts $18; gstar coogi evisu true jeans $35; coach chanel gucci LV handbags $36; Sunglasses(Oakey,coach,gucci,A r m a i n i) $15; ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ====

djacobs 16y ago

Is there a solution to this yet? He says it affects you whether or not you have the info page enabled.

EastSmith 16y ago
The solution is to password protect the info page. I also checked if there is new firmware. Also, on my Buffalo I just set up SSH and stopped httpd. Didn't know how to do it, so I read here http://www.dd-wrt.com/wiki/index.php/Telnet/SSH_and_the_command_line http://www.dd-wrt.com/wiki/index.php/Telnet/SSH_and_the_comm... and here http://www.howtoforge.com/ssh_key_based_logins_putty http://www.howtoforge.com/ssh_key_based_logins_putty