Craig Heffner

Craig Heffner: https://github.com/devttys0 http://www.devttys0.com Fabrice Bellard: http://www.bellard.org

I'll write one when I find something worthy of it. I've got stupidly high standards though. I've bought everything from wireless hard drives to $250 Wifi routers to $20 ethernet/3G bridges and the quality of the firmware is pretty garbage on all of them. I see brand new devices on kernel 2.4 and 2.6 with no upgrade plans in sight, and hacked up kernel trees that have no chance of building except on the developers' Red Hat 9 (!) workstations. http://www.devttys0.com/blog/ is another good place to follow. I guess it's more fun to write a negative article, not to mention it gets a lot more views.

It is NOT by mistake. Dlink engineers are INCREDIBLY INCOMPETENT. Let me remind you this excellent piece: http://www.devttys0.com/2015/04/what-the-ridiculous-fuck-d-link/

You don't. Lock it down as best you can: http://www.tomsguide.com/us/home-router-security,news-19245.html But as for the software being immune to vulnerabilities - no chance. Read http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/ which lists huge security issues and then D-LINK putting out a patch which doesn't even fix what they said it did.

Reminds me of the backdoor in D-Links routers: http://www.devttys0.com/2013/10/from-china-with-love/

Great article. So what's the fix? What should the right approach have been? Let's see a solution! And yes, I read the blog post associated with it and didn't see a solution: http://www.devttys0.com/2010/12/breaking-ssl-on-embedded-devices/

> What then struck me was the way he casually decided to hack a VPN He's intentionally vague, but given he mentions two routers and two vpn systems, it's highly probable that he's referring to one of the two routers (which is embedded, and has firmware). Furthermore, he refers to a website[1] which predominately deals with routers. > is it really so straightforward? Routers, yes[2], VPN daemons, not as much. [1]: http://www.devttys0.com/training/ - which can also contain a vpn daemon of course. [2]: https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2

This is often the case with WPS on home routers. Here's a blog post detailing the reversing of D-Links WPS PIN generation. http://www.devttys0.com/2014/10/reversing-d-links-wps-pin-algorithm/

I suspect this is going to cause a significant problem in the future with regaurds to all these embedded home routers that stopped receiving updates 6 months after release. Its essentially an unmonitored backdoor to 95% of networks on earth. http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/ http://arstechnica.com/security/2014/02/bizarre-attack-infects-linksys… Not to mention the similar situation with android phones. What a spectacular mess.

Also there is a list of tools located at http://www.devttys0.com/tools/

Off-topic: does anyone know what software was used to make graphics like http://www.devttys0.com/wp-content/uploads/2013/10/recvfrom.png ?

Not quite what you're talking about, but there was recently a couple of posts by the 'binwalk' author about differentiating encrypted vs compressed data (presumed header-less): http://www.devttys0.com/2013/06/differentiate-encryption-from-compress… http://www.devttys0.com/2013/06/encryption-vs-compression-part-2/

I hacked my Fritz!Box (yeah, a bad name for a german router) and I'm entirely sure that it has a backdoor integrated too. That's why I wiped and flashed it with an alternative image. That and the Telecom's Speedport router are the most popular routers by far in Germany. And both have backdoors, I know that other router manufacturers also integrate backdoors from a source who works at such a company. A friend can also verify the fact, because a different employee told him the same. Also it's public that the ISP can upgrade, modify, flash and disable features remotely. My friend's router has wifi, but their provider disabled it remotely within the firmware (it even has an antenna) and his ISP wants him to pay 5€/m to re-enable wifi. I really wonder why nobody complained about that earlier. Also the interesting thing here is that for a very long time, you weren't allowed to use a different router than the one provided by your ISP. Which enforced their surveillance monopoly. Here's an article about reverse engineering the backdoor in D-Link routers using IDA: http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/ PoC Available: http://pastebin.com/vbiG42VD

http://www.devttys0.com/blog/ http://www.dumpanalysis.org/blog/ https://blogs.oracle.com/ksplice/ http://j00ru.vexillium.org/?lang=en http://blogs.msdn.com/b/ntdebugging/

The web is full of articles like this. Vendors still come out with shitty, usually GPL-violating firmware. Links below from some quick googling and going through the archives of devttys0.com, but it doesnt even begin to describe the problem. Nearly every consumer router has some stupid injection or authentication bypass vulnerability. [0] http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/ [1] http://www.exploit-db.com/exploits/35917/ [2] http://arstechnica.com/security/2014/02/bizarre-attack-infects-linksys… [3] https://threatpost.com/more-trouble-for-linksys-home-small-office-rout… [4] http://www.devttys0.com/2015/04/reversing-belkins-wps-pin-algorithm/ [5] http://www.devttys0.com/2015/04/reversing-belkins-wps-pin-algorithm/ [6] http://www.devttys0.com/2014/05/hacking-the-dsp-w215-again-again-again… [7] http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug… [8] http://www.devttys0.com/2014/02/wrt120n-fprintf-stack-overflow/ [9] http://www.devttys0.com/2014/02/cracking-linksys-crypto/