3 ms·

If I'm reading right the router has SSH listening with admin/1234 to log in, as bought from the shop? That's a bit sad.

by mkj 4y ago

unwind 4y ago
Well yes, but the article doesn't say (that I saw) if that applies to the network interface(s) as well. If it's only once you've opened the case, soldered on headers, and hooked up your TTL2USB UART adapter, I don't think it's anything particularly worrying. It's a domestic wireless wi-fi router after all, not Fort Knox' vault door. Perhaps I'm being naive.
- denysvitali 4y ago
  The S in IoT stands for security
  - snvzz 4y ago
    You'd first need to solve the problem of Identity in the IoT.
  - gsich 4y ago
    A wireless AP is now IoT?
- mkj 4y ago
  Dropbear's listening on all interfaces, so the only thing that would save it would be iptables perhaps?
- Karliss 4y ago
  From the article it seems like there are two separate things: * root shell accessible using UART header -> this is more or less fine as you said. Because at that point you might as well solder wires to intercept communication between RAM and CPU, unsolder flash memory chip containing firmware and connect it to a dedicated reader/writer, or possibly use the CPU debug port. It would be a bit more difficult than using serial connection over UART, but not different from the perspective of overall security model. Note that a physical serial port with shell access is not the same as SSH. * SSH server listening on ??? network interfaces. Using the UART shell author was able to recover admin password, which might be usable for connecting using SSH over network. But it wasn't really confirmed whether the SSH server is configured to accept passwords and on which network interfaces is it listening. If the SSH server is really accepting hard coded password and listening on all interfaces by default then it's very bad. But the article after getting admin password jumped to completely unrelated stuff of modifying firmware downloaded from manufacturers website and uploaded using the firmware update feature in web interface.

If I'm reading right the router has SSH listening with admin/1234 to log in, as bought from the shop? That's a bit sad.

by mkj 4y ago

If I'm reading right the router has SSH listening with admin/1234 to log in, as bought from the shop? That's a bit sad.

Well yes, but the article doesn't say (that I saw) if that applies to the network interface(s) as well. If it's only once you've opened the case, soldered on headers, and hooked up your TTL2USB UART adapter, I don't think it's anything particularly worrying. It's a domestic wireless wi-fi router after all, not Fort Knox' vault door. Perhaps I'm being naive.

denysvitali 4y ago
The S in IoT stands for security
- snvzz 4y ago
  You'd first need to solve the problem of Identity in the IoT.
- gsich 4y ago
  A wireless AP is now IoT?
mkj 4y ago
Dropbear's listening on all interfaces, so the only thing that would save it would be iptables perhaps?
Karliss 4y ago
From the article it seems like there are two separate things: * root shell accessible using UART header -> this is more or less fine as you said. Because at that point you might as well solder wires to intercept communication between RAM and CPU, unsolder flash memory chip containing firmware and connect it to a dedicated reader/writer, or possibly use the CPU debug port. It would be a bit more difficult than using serial connection over UART, but not different from the perspective of overall security model. Note that a physical serial port with shell access is not the same as SSH. * SSH server listening on ??? network interfaces. Using the UART shell author was able to recover admin password, which might be usable for connecting using SSH over network. But it wasn't really confirmed whether the SSH server is configured to accept passwords and on which network interfaces is it listening. If the SSH server is really accepting hard coded password and listening on all interfaces by default then it's very bad. But the article after getting admin password jumped to completely unrelated stuff of modifying firmware downloaded from manufacturers website and uploaded using the firmware update feature in web interface.