Craig Heffner

I hacked my Fritz!Box (yeah, a bad name for a german router) and I'm entirely sure that it has a backdoor integrated too. That's why I wiped and flashed it with an alternative image. That and the Telecom's Speedport router are the most popular routers by far in Germany. And both have backdoors, I know that other router manufacturers also integrate backdoors from a source who works at such a company. A friend can also verify the fact, because a different employee told him the same. Also it's public that the ISP can upgrade, modify, flash and disable features remotely. My friend's router has wifi, but their provider disabled it remotely within the firmware (it even has an antenna) and his ISP wants him to pay 5€/m to re-enable wifi.

I really wonder why nobody complained about that earlier. Also the interesting thing here is that for a very long time, you weren't allowed to use a different router than the one provided by your ISP. Which enforced their surveillance monopoly.

Here's an article about reverse engineering the backdoor in D-Link routers using IDA:

http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/

PoC Available: http://pastebin.com/vbiG42VD

The web is full of articles like this. Vendors still come out with shitty, usually GPL-violating firmware. Links below from some quick googling and going through the archives of devttys0.com, but it doesnt even begin to describe the problem. Nearly every consumer router has some stupid injection or authentication bypass vulnerability.

[0] http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/

[1] http://www.exploit-db.com/exploits/35917/

[2] http://arstechnica.com/security/2014/02/bizarre-attack-infects-linksys-routers-with-self-replicating-malware/

[3] https://threatpost.com/more-trouble-for-linksys-home-small-office-routers/104322

[4] http://www.devttys0.com/2015/04/reversing-belkins-wps-pin-algorithm/

[5] http://www.devttys0.com/2015/04/reversing-belkins-wps-pin-algorithm/

[6] http://www.devttys0.com/2014/05/hacking-the-dsp-w215-again-again-again/

[7] http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug/

[8] http://www.devttys0.com/2014/02/wrt120n-fprintf-stack-overflow/

[9] http://www.devttys0.com/2014/02/cracking-linksys-crypto/

I'll write one when I find something worthy of it. I've got stupidly high standards though.

I've bought everything from wireless hard drives to $250 Wifi routers to $20 ethernet/3G bridges and the quality of the firmware is pretty garbage on all of them.

I see brand new devices on kernel 2.4 and 2.6 with no upgrade plans in sight, and hacked up kernel trees that have no chance of building except on the developers' Red Hat 9 (!) workstations.

http://www.devttys0.com/blog/ is another good place to follow. I guess it's more fun to write a negative article, not to mention it gets a lot more views.

> What then struck me was the way he casually decided to hack a VPN

He's intentionally vague, but given he mentions two routers and two vpn systems, it's highly probable that he's referring to one of the two routers (which is embedded, and has firmware).
Furthermore, he refers to a website[1] which predominately deals with routers.

> is it really so straightforward?

Routers, yes[2], VPN daemons, not as much.

[1]: http://www.devttys0.com/training/ - which can also contain a vpn daemon of course.

[2]: https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2

I suspect this is going to cause a significant problem in the future with regaurds to all these embedded home routers that stopped receiving updates 6 months after release. Its essentially an unmonitored backdoor to 95% of networks on earth.

http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/

http://arstechnica.com/security/2014/02/bizarre-attack-infects-linksys-routers-with-self-replicating-malware/

Not to mention the similar situation with android phones.

What a spectacular mess.