4 ms·

Hey, I am one of the developers of the Commotion project. OpenWRT can be a confusing system. Let me help you find what you are looking for. The Commotion-router

by elation 13y ago

Hey, I am one of the developers of the Commotion project. OpenWRT can be a confusing system. Let me help you find what you are looking for. The Commotion-router repo above is contains our setup scripts that make it easier for new users like you to build our software from source. If you look at the feeds.conf file you will find the exact sources we are pulling in to the openWRT build system for compilation. The most important line, for your concerns about backdoors would be the third line of that file. That line pulls in the master branch of the repo commotion-feed. This repository is full of makefiles. These makefiles specify how to build the source code into the compiled binary your pointed to before. If you follow the follow the install instructions that were poster earlier and then explore the curses (command line GUI) menu for make menuconfig you can explore the exactly what packages are going to be built for the specific architecture. (If you are curious about tampering we sadly have not had the time or funding to do deterministic builds, so I suggest you build it from source yourself so that you can examine the code.) Now, each item in the menuconfig references a "feed." You can look at the feeds.conf file in the current directory, and the various makefiles in the feeds folder to explore where exactly things are being pulled from. Our source code will use the git repo's specified in the makefiles in commotion-feed on the master branch. You can find all of those in our github, because we are an open-source project. If you have any concerns about specific lines of code that have been implemented I beg of you to submit a bug to the repo you find a problem with. We want every possible opportunity better our code. While we have done internal testing, I hope that with eyes like yours looking over the code we will find more bugs that we can address in the future. If you have any questions I will try to follow this thread the best I can, and am elationfoundation on github. You can also find most of the developers and our field experts on freenode at #commotion. I have built, and debugged, far too many openWRT images. So, If you do need assistance jump on #commotion during Americas East Coast working hours and I will be glad to help you. I hope this helped. OpenWRT's build system is a beautiful, but complex being.

cinquemb 13y ago
Thanks for the response. I have to be honest and say I'm probably not going to dig through a bunch of the makefiles listed in the third repo in feeds.conf (at least right now). But at least from you even mentioning deterministic builds, must mean that the thought has crossed your minds? I know the Tor project has to deal with concerns like that, and I figure firmware providers for mesh-networks will increasingly have to deal with the same. These sorts of things have piqued my interest lately and right now I'm in the middle of digging through the linksys e1000 firmware[0][1] (from yesterdays hubbub, too bad the script didn't work for me :/) and my cousin telling me about open ports (10080,1780,51000) on 192.168.1.1 on his network with some interesting traffic (his words). So, if I hear any stories relating to traffic on ports from postings online relating to this firmware, I'll probably take a look for fun (though there are probably many other people better at these things like yourself). [0] http://support.linksys.com/en-us/support/routers/E1000 http://support.linksys.com/en-us/support/routers/E1000 [1] http://i.imgur.com/jWebamh.png http://i.imgur.com/jWebamh.png
- voltagex_ 13y ago
  From your screenshot, I don't think that squashfs detection is right, you may have to play around with dd and unsquashfs. Also try a newer version of binwalk [-1] and/or the 2.0 branch [0] -1: https://github.com/devttys0/binwalk/ https://github.com/devttys0/binwalk/ 0: https://github.com/devttys0/binwalk/tree/binwalk-2.0 https://github.com/devttys0/binwalk/tree/binwalk-2.0
  - cinquemb 13y ago
    I saw your comment yesterday, which made me want to take a stab at it. Thanks alot! I used dd to get squashfs filesystem by itself[i], and unsquashfs [unsquashfs -v unsquashfs version 4.2 (2011/02/28)][i^2] but that gave that error, then I tried compiling with lzma,xz, lzo by their selfs and neither worked. But your right about the old version of binwalk, I was using v1.2.1. [i] http://i.imgur.com/Vk35XL0.png http://i.imgur.com/Vk35XL0.png [i^2] http://i.imgur.com/HxTE0rR.png http://i.imgur.com/HxTE0rR.png
    - voltagex_ 13y ago
      You're at the point where I normally get stuck. From the slides yesterday, see if you can find the version of squashfs that was used when the firmware was built.
      - cinquemb 13y ago
        That makes sense, cant access linksys website now to check (glad I got this binary in time :P) binwalk says "Squashfs filesystem, little endian, version 3.0" so I'm going to dl that and try again. Who knows, if I can get this to work, I can make a new wifi cracking script[0] that wont take hours with the vulns found so far by going through the backdoor, for security research purposes of course ;) [0] https://github.com/cinquemb/WifiBruteCrack/blob/master/wifi_brute_crack.py https://github.com/cinquemb/WifiBruteCrack/blob/master/wifi_...
        voltagex_ 13y ago

by elation 13y ago

cinquemb 13y ago

Thanks for the response. I have to be honest and say I'm probably not going to dig through a bunch of the makefiles listed in the third repo in feeds.conf (at least right now). But at least from you even mentioning deterministic builds, must mean that the thought has crossed your minds? I know the Tor project has to deal with concerns like that, and I figure firmware providers for mesh-networks will increasingly have to deal with the same. These sorts of things have piqued my interest lately and right now I'm in the middle of digging through the linksys e1000 firmware[0][1] (from yesterdays hubbub, too bad the script didn't work for me :/) and my cousin telling me about open ports (10080,1780,51000) on 192.168.1.1 on his network with some interesting traffic (his words). So, if I hear any stories relating to traffic on ports from postings online relating to this firmware, I'll probably take a look for fun (though there are probably many other people better at these things like yourself). [0] http://support.linksys.com/en-us/support/routers/E1000 http://support.linksys.com/en-us/support/routers/E1000 [1] http://i.imgur.com/jWebamh.png http://i.imgur.com/jWebamh.png

voltagex_ 13y ago
From your screenshot, I don't think that squashfs detection is right, you may have to play around with dd and unsquashfs. Also try a newer version of binwalk [-1] and/or the 2.0 branch [0] -1: https://github.com/devttys0/binwalk/ https://github.com/devttys0/binwalk/ 0: https://github.com/devttys0/binwalk/tree/binwalk-2.0 https://github.com/devttys0/binwalk/tree/binwalk-2.0
- cinquemb 13y ago
  I saw your comment yesterday, which made me want to take a stab at it. Thanks alot! I used dd to get squashfs filesystem by itself[i], and unsquashfs [unsquashfs -v unsquashfs version 4.2 (2011/02/28)][i^2] but that gave that error, then I tried compiling with lzma,xz, lzo by their selfs and neither worked. But your right about the old version of binwalk, I was using v1.2.1. [i] http://i.imgur.com/Vk35XL0.png http://i.imgur.com/Vk35XL0.png [i^2] http://i.imgur.com/HxTE0rR.png http://i.imgur.com/HxTE0rR.png
  - voltagex_ 13y ago
    You're at the point where I normally get stuck. From the slides yesterday, see if you can find the version of squashfs that was used when the firmware was built.
    - cinquemb 13y ago
      That makes sense, cant access linksys website now to check (glad I got this binary in time :P) binwalk says "Squashfs filesystem, little endian, version 3.0" so I'm going to dl that and try again. Who knows, if I can get this to work, I can make a new wifi cracking script[0] that wont take hours with the vulns found so far by going through the backdoor, for security research purposes of course ;) [0] https://github.com/cinquemb/WifiBruteCrack/blob/master/wifi_brute_crack.py https://github.com/cinquemb/WifiBruteCrack/blob/master/wifi_...
      - voltagex_ 13y ago