3 ms·

Why do they bother with doing this? I could see signing firmware, but maybe I'm crazy, but I don't see anything in the WRT120N which is particularly innovative

by rdl 13y ago

Why do they bother with doing this? I could see signing firmware, but maybe I'm crazy, but I don't see anything in the WRT120N which is particularly innovative in hardware or software that they'd be trying to keep secret, or RF stuff which they'd need to keep locked down in a baseband to keep their FCC/CE certs. Did they do this just for the lulz?

gvand 13y ago
I could be wrong, but it looks like a decision come out from some management-only meeting.
- alextingle 13y ago
  I've been the technical guy in a meeting where this kind of nonsense was decided... Me: The customer has asked for security measures to stop unauthorised employees from subverting the system and defrauding them. Your solution uses clear-text passwords, so anyone with a copy of Wireshark could crack it in seconds. Management: Yeah, but they're only asking for the appearance of security. They don't care about the details. Me: What will they say if someone cracks our "security" and steals millions of dollars from them? Management: <shrug> Me: ???
  - 1qaz2wsx3edc 13y ago
    Rest assured Mr. Management, hackers only target profitable business, and since you're the manager, we won't have much to worry about.
- drdaeman 13y ago
  And what could management reasons be? I don't get it from economical point of view. It's just additional work that doesn't bring any profits. Sole exception I could think of, is securing software-based limitations that "encourage" consumers to purchase more pricey devices. But it doesn't seem to be the case for this device - there aren't much of fancy hardware features hiding behind missing software options. One could probably solder an USB port (not sure whenever soldering and rebuilding firmware worth the savings from buying cheaper device), but I guess that's about it.
  - sobkas 13y ago
    If there is a possibility to flash in a third party firmware, there is also possibility to brick the device. It brings up costs of customer support, company needs to replace faulty devices, repair them or argue with customers over it. Also a third party firmware brings no benefit in the eyes of the corporation, device was already sold(thanks to marketing and low price) and now comes device bricking firmware that inflates costs and eats margins. It's very easy to see why someone would like to defend himself against such menace. Sometimes in spite of the fact, that a third party firmware was the only reason why so many devices were sold in the first place. I have heard a rumour, that for the same reason SanDisk stopped supporting(with free hardware) Rockbox development.
    - tmzt 13y ago
      Supporting (or at least not actively stopping) third-party firmware can also make sense for a company like Linksys not that they aren't part of Cisco. Before somebody could purchase a less expensive Linksys wireless router, install a third-party firmware, and use it like the would a more expensive Cisco AP. So for Cisco this might take away from their higher end lines. For the new owners it's just an added sale that they wouldn't otherwise get. It's too bad that HTC didn't get how important their XDA supporters were to staying relevant in the mindshare of the early adopters, who in turn recommend hardware purchases for the mainstream consumer. It's the same thing with Linksys.
smtddr 13y ago
If someone finds an "accidental" backdoor in the firmware then I'd bet that's why it was obfuscated.
- raverbashing 13y ago
  Yeah, like running it through 'strings' and testing what comes out as password.
joezydeco 13y ago
Perhaps Linksys doesn't want their overseas CM to pirate the firmware into a no-name model for the grey market? I worked on a similar type of project. We designed and prototyped a module in the US but the end customer wanted to assemble their finished product in China. Management was worried that the 'proprietary secrets' (cough cough) from the firmware could be stolen by the CM and used in their other customers' projects or sold to someone else. Fears escalated when our staff came back from a first visit and they showed us photographs of counterfeit Samsung Galaxies being built on the line right next to our legitimate product. So what we did was design the bootloader to use a form of obsfucation (really, a rotating matrix of XOR patterns) and have the trusted processor manufacturer flash that onto the chips at the fab before reeling them up and shipping them to China. Then management could rest easier knowing that the production firmware being transmitted to the CM's testing line wasn't easily disassembled or copied into a similar part. Of course, any clever engineer (like the OP) could have blown it apart in a day or so. We were a bit luckier that our entire firmware could fit on the protectable on-board eNVM and not use external NOR flash like this router. I guess the hope was to just discourage the practice and cross your fingers that this method would be enough.

by rdl 13y ago

gvand 13y ago

I could be wrong, but it looks like a decision come out from some management-only meeting.

alextingle 13y ago
I've been the technical guy in a meeting where this kind of nonsense was decided... Me: The customer has asked for security measures to stop unauthorised employees from subverting the system and defrauding them. Your solution uses clear-text passwords, so anyone with a copy of Wireshark could crack it in seconds. Management: Yeah, but they're only asking for the appearance of security. They don't care about the details. Me: What will they say if someone cracks our "security" and steals millions of dollars from them? Management: <shrug> Me: ???
- 1qaz2wsx3edc 13y ago
  Rest assured Mr. Management, hackers only target profitable business, and since you're the manager, we won't have much to worry about.
drdaeman 13y ago
And what could management reasons be? I don't get it from economical point of view. It's just additional work that doesn't bring any profits. Sole exception I could think of, is securing software-based limitations that "encourage" consumers to purchase more pricey devices. But it doesn't seem to be the case for this device - there aren't much of fancy hardware features hiding behind missing software options. One could probably solder an USB port (not sure whenever soldering and rebuilding firmware worth the savings from buying cheaper device), but I guess that's about it.
- sobkas 13y ago
  If there is a possibility to flash in a third party firmware, there is also possibility to brick the device. It brings up costs of customer support, company needs to replace faulty devices, repair them or argue with customers over it. Also a third party firmware brings no benefit in the eyes of the corporation, device was already sold(thanks to marketing and low price) and now comes device bricking firmware that inflates costs and eats margins. It's very easy to see why someone would like to defend himself against such menace. Sometimes in spite of the fact, that a third party firmware was the only reason why so many devices were sold in the first place. I have heard a rumour, that for the same reason SanDisk stopped supporting(with free hardware) Rockbox development.
  - tmzt 13y ago
    Supporting (or at least not actively stopping) third-party firmware can also make sense for a company like Linksys not that they aren't part of Cisco. Before somebody could purchase a less expensive Linksys wireless router, install a third-party firmware, and use it like the would a more expensive Cisco AP. So for Cisco this might take away from their higher end lines. For the new owners it's just an added sale that they wouldn't otherwise get. It's too bad that HTC didn't get how important their XDA supporters were to staying relevant in the mindshare of the early adopters, who in turn recommend hardware purchases for the mainstream consumer. It's the same thing with Linksys.

smtddr 13y ago

If someone finds an "accidental" backdoor in the firmware then I'd bet that's why it was obfuscated.

raverbashing 13y ago
Yeah, like running it through 'strings' and testing what comes out as password.

joezydeco 13y ago

Perhaps Linksys doesn't want their overseas CM to pirate the firmware into a no-name model for the grey market? I worked on a similar type of project. We designed and prototyped a module in the US but the end customer wanted to assemble their finished product in China. Management was worried that the 'proprietary secrets' (cough cough) from the firmware could be stolen by the CM and used in their other customers' projects or sold to someone else. Fears escalated when our staff came back from a first visit and they showed us photographs of counterfeit Samsung Galaxies being built on the line right next to our legitimate product. So what we did was design the bootloader to use a form of obsfucation (really, a rotating matrix of XOR patterns) and have the trusted processor manufacturer flash that onto the chips at the fab before reeling them up and shipping them to China. Then management could rest easier knowing that the production firmware being transmitted to the CM's testing line wasn't easily disassembled or copied into a similar part. Of course, any clever engineer (like the OP) could have blown it apart in a day or so. We were a bit luckier that our entire firmware could fit on the protectable on-board eNVM and not use external NOR flash like this router. I guess the hope was to just discourage the practice and cross your fingers that this method would be enough.