{"id":13325,"date":"2018-09-10T08:10:15","date_gmt":"2018-09-10T16:10:15","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/09\/10\/news-7092\/"},"modified":"2018-09-10T08:10:15","modified_gmt":"2018-09-10T16:10:15","slug":"news-7092","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/09\/10\/news-7092\/","title":{"rendered":"Assessing the security of a portable router: a look inside its hardware"},"content":{"rendered":"

Credit to Author: Jean Taggart| Date: Mon, 10 Sep 2018 15:00:00 +0000<\/strong><\/p>\n

Network administrators should perform security assessments of hardware that they will provide their users, or particularly paranoid users might want to poke at their devices just to be extra sure.<\/p>\n

In this blog post, we will demonstrate the techniques used to assess security on a generic portable router purchased online. We have redacted its identifiable information as our goal here isn\u2019t to provide a free penetration test to the hardware manufacturer. (Someone enterprising enough could still figure this out.)<\/p>\n

Can we actually trust this device? This was an inexpensive router, and probably assembled with off-the-shelf components.<\/p>\n

In order to assess how secure this device really is, we are going to have to take it apart and figure out what makes it tick.<\/p>\n

The packaging<\/h3>\n

The router came in a small box covered in helpful information about its capabilities, with the only brand attribution being a silver sticker with [REDACTED] written on it.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

 <\/p>\n

It looks like a device made by a third party and re-branded to quickly bolster the product offerings of another company. A quick Google search did not yield a website for this product on the first page of results, but more digging did reveal a manufacturer that we will not disclose here.<\/p>\n

Perusing their product line, we were able to find the\u00a0router\u00a0we had purchased.\u00a0We located a firmware update and downloaded it for further investigation. More on this later.<\/p>\n

Gathering equipment<\/h3>\n

Once we received the router, the first thing we did was disassemble it. The best tool to do this is the\u00a0ifixit tool kit.<\/a><\/p>\n

This is the gold standard for disassembling stuff. It comes with many of the esoteric fastener heads devised to frustrate anyone trying to take things apart.<\/p>\n

This mini router had no visible screws\u2014this is a trend for many devices as of late. Disassembly required the use of the \u201cspudge tool\u201d from the ifixit toolkit, and we gently pried the cover off. Thankfully, there weren\u2019t any of the warranty \u201cvoid if tampered\u201d stickers. These are\u00a0illegal<\/a>.<\/p>\n

Taking the router apart revealed the main router board with two antennae and one chip in the center. The main chip in the center was an MIPS processor, and there\u2019s a specific model number silk screened onto the mainboard.<\/p>\n

\"\"<\/p>\n

Some light Googling revealed that this chipset has a manufacturer website and even a\u00a0product-specific page.<\/p>\n

I also found a WikiDevi page on our\u00a0exact model.\u00a0WikiDevi\u00a0is a user-editable database for computer hardware based on\u00a0MediaWiki\u00a0and\u00a0Semantic MediaWiki. This page contains a ton of good info on the chipset, its capabilities, where it is sold, and by who.<\/p>\n

Let\u2019s file those tidbits of information away for now. We\u2019ll come back to them later.<\/p>\n

The board has four unpopulated pin holes. These are typically called either \u201cplated-through holes\u201d or \u201cannular rings.\u201d We will just refer to them as plated-through holes for this exercise.<\/p>\n

\"\"<\/p>\n

This looks suspiciously like an interface that the manufacturer left on the mainboard. These plated-through holes are usually used to flash the operating system onto the board and test the unit at the factory to verify everything is working properly. There\u2019s no attempt made to hide its purpose.<\/p>\n

After some light digging on\u00a0the product website, we did find mention of the slow I\/O features of this chipset.<\/p>\n

\"\"<\/p>\n

Further, Googling showed that this pinout is fairly common and might be of the UART variety.<\/a><\/p>\n

There\u2019s mention of UART on the [REDACTED] product page. This looks promising, like a good place to start. But the plated-through holes are in an awkward position, and examining the mainboard is difficult.<\/p>\n

More equipment<\/h3>\n

In order to get a better look, we did some online shopping. We purchased a \u201cthird\u00a0hand\u201d to hold the mainboard. This portable router is bolted straight to a transformer for the sake of compactness. This means we are in the proximity of\u00a0120 Volts,\u00a0so we should exercise a modicum of caution.<\/p>\n

This device is compact and tightly integrated. The chips on the mainboard are pretty small, and our eyesight isn\u2019t what it used to be. Back to the Internet to get a jeweler\u2019s lamp.<\/p>\n

\"\"\"\"<\/p>\n

So now we had the magnifying lamp, and it is much better than the little one that comes with the third hand. The LED lights also made examining the main board much easier.<\/p>\n

To interact with these pins, we could solder wires in, but we\u2019re planning on using this device, provided it passes muster. This meant we were going to try and be as delicate with our probing as we could. Back to the Internet. After some searching, we found breakaway headers.<\/p>\n

\"\"<\/p>\n

Snapping four off the length make for a perfect pinout adapter. No solder needed, plus easy access for eventually connecting the USB header and for probing the pins.<\/p>\n

\"\"<\/p>\n

Shopping<\/h3>\n

Now we needed to investigate what those diagnostic pins were. Did they have voltage? Were they used to send and receive information? Back to the Internet again for more shopping.<\/p>\n

Not wanting to buy something too cheap or inappropriate for the task, we Googled affordable voltmeter and found a\u00a0review<\/a>\u00a0for decent and affordable voltmeters. We\u00a0settled on the Extech EX330 Autoranging Mini Multi-Meter with Built-In Thermometer and Type K Remote Probe.<\/p>\n

We also purchased the additional probe connectors kit for good measure. We started with checking for voltage. The bottom half of the router is the transformer. It typically steps down from 120 Volts to 12 Volts. We set the voltmeter to 200 Volts, just to be safe, and got to probing.<\/p>\n

Diving in<\/h3>\n

The bottom plated-through hole had a square about it. Maybe it was special? So we started by applying the ground to it and power to the top pin, and the result was -3.3 Volts. Quickly inverting the probes gave us +3.3 Volts.<\/p>\n

Some quick Googling told us that there are two common voltages used in these types of interfaces: 3.3 Volts and 5 Volts. It looks like our router is of the 3.3 Volts variety, the top pin is ground, and the bottom square pin is positive with 3.3 Volts.<\/p>\n

So now we knew what the top and bottom pins were. This left the two center pins as a mystery.<\/p>\n

Many other much more talented people than us have gone down this particular rabbit hole, and in this, Google was invaluable. We found pictures of other UART interfaces on other routers.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

It does not appear that there\u2019s a standardized pin order, but in most of the examples we found online, gnd (ground) and\u00a0VCC<\/a>\u00a0are at the outer edges.<\/p>\n

In our case, VCC would stand for \u201cVoltage Common Collector.\u201d More Googling indicated that there is a cable available to interface with these pins and,\u00a0most importantly, that you don\u2019t need to connect the 3.3 Volt pin unless you want to watch your cable, your router, and potentially your computer go \u201cpoof-the-magic-dragon.\u201d<\/p>\n

Good to know. Let\u2019s also store this tidbit of information for later.<\/p>\n

More shopping<\/h3>\n

So back to more shopping. We found a USB to RS232 TTL UART PL2303HX Converter USB to COM Cable Adapter Module.<\/p>\n

\"\"<\/p>\n

We also found some that specified that they came with both voltage selections and, just to be thorough, we also ordered one of these. It wasn\u2019t available with Prime, so we\u2019re still waiting for this to arrive from the slow boat from China.<\/p>\n

\"\"<\/p>\n

Back to the investigation<\/h3>\n

Not being one to assume anything, we also researched what the color coding was for the cable, as it came in a little bubble wrap with no instructions and sadly nothing in the packaging to indicate whether it was of the 3.3 Volts or 5 Volts variety. Similar USB to UART cables had documentation on the web. We made an assumption and theorized that the cable coloring would be the same as the Google picture results (fingers crossed).<\/p>\n

\"\"<\/p>\n

Roadblocks<\/h3>\n

Colors matched: black for ground, red for power, green for receive, white for transmit. So far, so good. We plugged in the UART to USB cable in our test machine and encountered another roadblock.<\/p>\n

While it was properly detected and Windows did install the correct drivers, it didn\u2019t work. Some investigation revealed the device could not start.<\/p>\n

\"\"<\/p>\n

We tried moving the USB device to a different com port in the device manager with no success. We tried downloading the driver directly from the Prolific website and again weren\u2019t met with success. We also tried moving the USB device to a different port (from USB v3 to regular USB). Again, no go.<\/p>\n

Digging a little further into the properties of the device revealed that the device cannot start.<\/p>\n

\"\"<\/p>\n

Researching this error yielded this forum post<\/a>. And more specifically, to this entry:<\/p>\n

\u201cWindows 8\/8.1\/10 are NOT supported in PL-2303HXA and PL-2303X\u00a0EOL<\/a>\u00a0(End Of Life) chip versions.\u201d<\/strong><\/p>\n

So while this USB dongle presumably works, it won\u2019t work in Windows 10. What a surprise! Not to be easily defeated, we rebooted into Ubuntu Linux with the USB dongle still attached.<\/p>\n

We then proceeded to check if the USB to serial adapter was working. This is achieved by issuing this command:<\/p>\n

$ dmesg | grep tty<\/p>\n

\"\"<\/p>\n

So now we know that the USB adapter is ttyUSB0. The Windows forum mentioned the pl2303 chipset in the adapter wasn\u2019t supported, and we see it here. In Windows, we would\u2019ve used the Putty terminal program. In Linux, we elected to use GtkTerm. It was installed with this command:<\/p>\n

$ sudo apt-get install gtkterm<\/p>\n

We found that for best results, invoking GtkTerm from bash needed sudo. (We suspect it needed the user account to be part of a group that has permissions to access the ports.)<\/p>\n

$ sudo gtkterm<\/p>\n

Once gtkterm was running, we needed to select the proper port. We selected the configuration option and opened the port option.<\/p>\n

\"\"<\/p>\n

In the port drop-down menu, at the very bottom, we saw \/dev\/ttyUSB0. This is the Prolific USB adapter.<\/p>\n

We left parity bit, stop bit, and flow control to the defaults and hoped for the best.<\/p>\n

After this came the tedious task of determining which of the two pins in the center were transmit and receive, as well as the correct baud rate. Our first attempt was gnd, rx \u00a0tx and\u00a0vcc unconnected. <-VCC = 3.3V = poof! bad!<\/p>\n

\"\"<\/p>\n

These were the results we got. Either TX and RX are inverted, or we have selected the wrong baud rates. There is some kind of communication taking place, but the contents are all garbled. We went through the most common baud rates, but were not met with any success.<\/p>\n

\"\"<\/p>\n

We then flipped the TX and RX and started the process of unplugging and re-plugging the transformer portion of the router, while incrementing the available baud rates in GtkTerm. When selecting the 57600 baud rate, we were met with success!<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

We could now see how this portable router starts up. It uses u-boot (1.1.3). As the system is starting, there is a brief moment where you are offered options:<\/p>\n

\"\"<\/p>\n

If you enter “4” at just the right moment, it interrupts the boot process and dumps you at a prompt. This is probably the menu used at the factory to apply the correct firmware and perform quality assurance checks and confirm that the unit isn\u2019t defective. Some of the options look like they could be destructive and brick the device, so we were careful in our selection.<\/p>\n

Entering \u201chelp\u201d gives you a list of the commands available at the u-boot command line.<\/p>\n

\"\"<\/p>\n

Printenv gives even further information. We could re-flash this unit. We could reset the unit. All of this is good, but doesn’t really help us ascertain the security posture of the device.<\/p>\n

\"\"<\/p>\n

We kept navigating the menus looking for interesting things to do, but the U-Boot environment was pretty limited. We also discovered that if you let the boot process take place normally and press any key once it is done, you are dumped at a command prompt as well.<\/p>\n

\"\"<\/p>\n

Navigating to the available directories revealed a set of folders: cfg, net, and os. These folders contain files. They are not subdirectories. They don\u2019t have an extension. When invoked individually with no switches, they show a Usage description.<\/p>\n

What we learned so far<\/h3>\n

So what have we learned about the security of this device? Someone with local access could probably modify its behavior quite easily.<\/p>\n

The documentation on the chipset mentions that the \u201c[REDACTED] embedded with 8MB memory and provide eCos turnkey for compact router\u2026\u201d<\/p>\n

We have a sneaky suspicion that this is the underlying operating system. We know that the\u00a0U-Boot for MIPS<\/a>\u00a0boot loader turns control over to \u201csomething\u201d once it\u2019s done initializing the hardware. Turnkey sounds easy, and easy is usually what manufacturers go for.<\/p>\n

The\u00a0wiki for eCos<\/a>\u00a0has interesting entries under the “Criticism” heading:<\/p>\n

The\u00a0FreeBSD\u00a0TCP\/IP network stack included with eCos is out of date (circa 2001) and exposes systems to numerous security and stability vulnerabilities (FreeBSD RELENG 4 4 0 RELEASE for IPv4 and FreeBSD\u2019s origin\u00a0KAME\u00a0for IPv6). Official eCos maintainers do not appear to monitor FreeBSD or KAME for security or stability updates, but rather rely on minimal and insufficient bug reports from users of eCos.<\/em>[citation needed]<\/sup><\/em><\/p>\n

The\u00a0SNMP\u00a0package is rudimentary at best, once again, apparently due to its age.<\/em>[original research?]<\/sup><\/em><\/p>\n

Retrospection<\/h3>\n

Let\u2019s look at what it has taken so far to gather this information. Some specialized tools, some specialized hardware, some non-trivial computer knowledge, and a certain amount of pig-headedness. And after all this, we haven\u2019t even found anything remotely close to a glaring vulnerability. We know more about our device, and that\u2019s a good thing. However, there\u2019s no way that an average user will go through this. It\u2019s a cool exercise. But it isn\u2019t realistic to expect average users to reverse their devices.<\/p>\n

What next?<\/h3>\n

We want to confirm what the OS is 100 percent and not just rely on a \u201chunch.\u201d Remember the firmware update we collected from the [REDACTED] website? We\u2019ll try to extract information from the .img file. We are hoping that the update will contain information that is useful. We\u2019re also interested in dumping the local firmware off of the router as well. We’re doing this so we can compare the original firmware with the modified, updated one, as well as to see what was corrected or changed and maybe figure out what was the issue that this update addressed.<\/p>\n

Maybe they implemented a fix that only partially fixes the issue? Maybe they fixed the problem and not the underlying vulnerability? All of these questions are worthy of an answer.<\/p>\n

Do you see something I\u2019ve done wrong? Have suggestions on other things to try? Reach out to @jean_taggart on the Twitters. I\u2019m keenly interested to hear from all of you.<\/p>\n

The post Assessing the security of a portable router: a look inside its hardware<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: Jean Taggart| Date: Mon, 10 Sep 2018 15:00:00 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
In this post, we acquire the necessary equipment to analyze the security of an inexpensive portable router, which we access through its diagnostic interface, and poke around inside.<\/p>\n

Categories: <\/p>\n