SHODAN Researches DD-WRT Vulnerability – /dev/ttyS0

By | |
Comments Off on SHODAN Researches DD-WRT Vulnerability – /dev/ttyS0

John Matherly of SHODAN fame and Dan Tentler from Aten Labs teamed up to research the DD-WRT information disclosure vulnerability we released back in December. The results show that approximately 10% of remotely accessible DD-WRT routers were both vulnerable to the attack and could be geo-located based on the information… Continue reading →

Serial File Uploads With Serio – /dev/ttyS0

By | | ,
Comments Off on Serial File Uploads With Serio – /dev/ttyS0

So you’ve got an embedded device that’s running Linux, you’ve tapped into the board’s serial port and you have a root shell. You’re poking around and want to run netstat/netcat/grep/whatever – but it’s not installed! And what’s worse, the device doesn’t have any utilities to perform a network file transfer…. Continue reading →

DD-WRT, I Know Where You Live – /dev/ttyS0

By | |
Comments Off on DD-WRT, I Know Where You Live – /dev/ttyS0

I’ve always envied CSI’s amazing IP address geolocation capabilities. Not only can they get your exact physical address based solely off your IP (right down to your hotel room number!), it even works on IP addresses that don’t exist! While that level of IP address tracking is beyond the grasp… Continue reading →

WBR-1310 Authentication Bypass Vulnerability – /dev/ttyS0

By | |
Comments Off on WBR-1310 Authentication Bypass Vulnerability – /dev/ttyS0

The D-Link WBR-1310 contains an authentication bypass vulnerability that allows remote attackers to change administrative settings without authentication. This can be used to enable remote management and change the administrative password. Note that even if remote administration is not enabled, this vulnerability can be easily exploited via CSRF. Read the… Continue reading →

Breaking SSL on Embedded Devices – /dev/ttyS0

By | | , ,
Comments Off on Breaking SSL on Embedded Devices – /dev/ttyS0

No, this is not some new SSL vulnerability. In fact, it’s a really old vulnerability, as old as cryptography itself: keep your secret keys secret. A lot of embedded devices provide HTTPS support so that administrators can administer the devices securely over untrusted networks. Some devices, such as SSL VPNs,… Continue reading →