00:00:00.000-->00:00:05.000
>>So, thank you for coming for
my talk on travel routers. Uh
,this is something that I just

00:00:09.042-->00:00:14.042
found very exciting to work on.
So, my name is Mikhail Sosonkin,
I’m the director of data and

00:00:16.750-->00:00:22.833
research at Synack and Synack is
a company that leverages the
crowds to find uh

00:00:22.833-->00:00:28.042
vulnerabilities in our clients.
So, uh if you like discovering
vulnerabilities, if you like

00:00:28.042-->00:00:32.250
hacking, uh this is something
that you might want to try out
because it’s uh, it’s sort of a

00:00:32.250-->00:00:39.208
way to do real world
vulnerability discovery and get
uh paid to do it. Um, so in the

00:00:39.208-->00:00:44.208
process of doing that, we get to
work on a lot of IT devices, and
I had a problem, uh I found

00:00:47.917-->00:00:52.917
myself to be a digital nomad for
a while and I sort of moving
around from an airbnb to a cafe

00:00:55.958-->00:01:02.042
and I had to connect all my
devices like laptops, phones, my
wife’s laptop and her phones as

00:01:02.042-->00:01:07.458
well, just, it became really
annoying to do that, so I was
trying to find something that

00:01:07.458-->00:01:14.208
would um solve this problem for
me. So, this was the motivation
for discovering a whole lot of

00:01:14.208-->00:01:19.708
section of devices that I did
not know existed before this um,
called the travel routers. In

00:01:19.708-->00:01:25.833
fact, I have one right here,
this is about the size of this
device. Uh, they’re essentially,

00:01:25.833-->00:01:30.833
there, there are tons of them
out there, I picked this uh
hootoo travelmate because uh, it

00:01:34.208-->00:01:38.917
is very reasonably priced, there
are a whole bunch of reviews out
there and people say that it is

00:01:38.917-->00:01:43.500
actually good for you, it’s
provides some security, it’s
very convenient to use,

00:01:43.500-->00:01:49.625
etcetera, etcetera, etcetera.
And I figured okay, I’ll try it
out. So, I bought one, it was

00:01:49.625-->00:01:55.792
really useful, uh because I was
able to have all my devices
connected to it, as, uh using

00:01:55.792-->00:02:02.083
WiFi and then, I would just
connect it to the cafe network,
uh cafe WiFi and it would sort

00:02:02.083-->00:02:07.125
of just bridge the two together.
Uh, it’s small, good for travel,
has a battery pack, uh never

00:02:07.125-->00:02:14.000
catches fire, uh and it sort of
gives you a little layer of
protection. I felt a little bit

00:02:14.000-->00:02:18.042
warm and cozy because I was
connecting to my own little
network. Uh, you- using uh

00:02:18.042-->00:02:24.417
network casualties translation.
So I thought, hmm well this is
interesting, I like to hack

00:02:24.417-->00:02:30.500
things, uh, does it actually
make me secure, or worse does it
make me less secure, and so I

00:02:30.500-->00:02:37.000
started uh doing some analysis.
Uh, first thing I did of course
was a network scan uh to see

00:02:37.000-->00:02:43.125
what services were available.
Uh, I wasn’t that surprised to
find uh http port 80 was open,

00:02:43.125-->00:02:49.833
and so this is for the admin
interface, however, when I
actually looked at the admin

00:02:49.833-->00:02:56.708
interface I found that it had uh
two services responding to me.
One was lighttpd which is very

00:02:56.708-->00:03:03.667
popular and I was very familiar
with that but the other one was
called vshttpd. I was a little

00:03:03.667-->00:03:09.500
bit confused for a while,
clearly there is some sort of
proxying going on in the

00:03:09.500-->00:03:15.500
background, but what what is
this service? So, I went out to
Shodan because that is what you

00:03:15.500-->00:03:20.625
would do when you are curious
about something uh and I
searched for it. I found a few

00:03:20.625-->00:03:26.250
devices, not many of them are
out there, but I would expect a
lot of them are actually hidden

00:03:26.250-->00:03:31.167
behind private networks, so you
wouldn’t be able to see them,
but there are still a few of

00:03:31.167-->00:03:36.167
them that kind of come up once
in awhile. Uh, primarily in the
area of uh Asia, so, Japan, uh,

00:03:39.042-->00:03:44.417
China, um I didn’t find any
North Korea but there was some
Taiwan devices. So, I knew they

00:03:44.417-->00:03:50.750
were out there somewhere and
there was some importance to
them. Then I kind of turned uh

00:03:50.750-->00:03:57.000
on the device itself, I decided
to start reverse engineering.
First, I downloaded the firmware

00:03:57.000-->00:04:02.000
from the hootoo main page, and
that was easy you know I just
clicked download, uh it turned

00:04:04.208-->00:04:10.417
out to be a RAR archive which
you can just extract and what
you get back is a shell script.

00:04:10.417-->00:04:16.167
And at the bottom of the shell
script, there is a file system
attached uh it was uh gc

00:04:16.167-->00:04:22.208
compressed, but you know that’s
trivial. Um, once I mounted this
I found that it was an EXT2 file

00:04:22.208-->00:04:28.333
system and it had more stuff in
there, and primarily there was
something called the rootfs. I

00:04:28.333-->00:04:33.333
figured okay that’s interesting
it’s a Little Endian Squash
Filesystem and um that’s kind of

00:04:35.417-->00:04:39.667
consistent with what you’d
expect with the flash based
device, so I mounted them and

00:04:39.667-->00:04:44.667
looked at the configuration and
I found that it had this ioos
service um, in reference from

00:04:47.167-->00:04:52.167
the LI HTTP uh config files, and
I thought that this this was
what the uh VSH TPD

00:04:57.708-->00:05:00.958
implementation. So, I didn’t
know what else to do, I kind of
went around some more I found a

00:05:00.958-->00:05:05.750
shadow file, I saw the hash, I
quickly threw it and John the
ripper I felt really elite with

00:05:05.750-->00:05:10.792
that one because it took a
couple of days to crack it. Uh,
but I didn’t know what else to

00:05:10.792-->00:05:15.125
do with it because I didn’t
really have any place to use
those passwords. Going online I

00:05:15.125-->00:05:19.792
found that there was some
research done on other devices,
uh from hootoo such as the

00:05:19.792-->00:05:25.167
original Titan and the Nano,
they’re all kind of similar in a
way. However, I had the Elite

00:05:25.167-->00:05:30.000
and it didn’t have telnet uh
anywhere on the device. I
thought hmm what are the chances

00:05:30.000-->00:05:33.667
that the vendor would actually
make custom firmware for each
and everyone of them, it’s

00:05:33.667-->00:05:38.000
probably all the same and they
just disable uh telnet on my
device to make it a little more

00:05:38.000-->00:05:43.833
secure. And sure enough, when I
did a search, on the firmware, I
found that it had open telnet

00:05:43.833-->00:05:48.833
dot sh script that would
actually enable telnet on my
device. But, I still didn’t have

00:05:48.833-->00:05:53.833
any way to run it. Until I
realized that I could just fake
an update of the firmware and I

00:05:56.833-->00:06:03.542
can tell it to execute the file
and enable telnet for me. Uh,
but I, when I tried that, even

00:06:03.542-->00:06:09.125
though there were no signatures
and no, no real validation done,
on this firmware, for some

00:06:09.125-->00:06:13.375
reason it did not execute, and I
didn’t really know what else to
do I just kind of continued on

00:06:13.375-->00:06:18.375
reverse engineering. Uh
throwing, throwing the ios, ioos
service into ida, I eventually

00:06:22.000-->00:06:27.000
found this function called check
firmware 2. Which apparently
does a uh checksum validation on

00:06:29.458-->00:06:34.125
the firmware that you applaud.
And of course there was no
signature or anything like that,

00:06:34.125-->00:06:39.708
so I said okay I can just
generate my own checksum. So I
did that, I just put it up there

00:06:39.708-->00:06:44.708
and uh the f, the firmware, the
device was very happy to accept
it, uh and it just executed open

00:06:46.750-->00:06:52.500
telnet dot sh for me. It said
there was an error in updating
the device because I didn’t exit

00:06:52.500-->00:06:58.125
once so it automatically means
that there was a problem.
However, doing this action

00:06:58.125-->00:07:04.042
enabled telnet and I was able to
receive a shell, I was able to
execute commands and essentially

00:07:04.042-->00:07:09.042
do dynamic analysis uh download
a debugger attached to uh any
services etcetera. So this was

00:07:11.583-->00:07:16.750
very happy news for me, uh in
the course of reverse
engineering I also found that uh

00:07:16.750-->00:07:22.292
the developer thought they were
writing nc plus plus because
most of the internal state was

00:07:22.292-->00:07:28.708
uh in the in the structures that
looked awfully like objects. Uh
there will be buffers inside,

00:07:28.708-->00:07:34.542
there was internal state and it
would usually be followed by
function pointers, um right at

00:07:34.542-->00:07:39.167
the bottom of the structure
itself. Uh, usually there would
be initialization, there with a

00:07:39.167-->00:07:45.542
sign function pointers to the
actual structure and when those
uh functions are used, every

00:07:45.542-->00:07:51.500
time it would pass in the
pointer to the structure itself.
So, it is very much like this

00:07:51.500-->00:07:55.500
pointer in C plus plus. So,
that’s kind of cool. In and of
itself, it’s not really a

00:07:55.500-->00:08:02.000
problem, however, it uh it just
feels very hairy situation when
you have uh lots of buffers and

00:08:02.000-->00:08:06.500
function pointers on the
navigation next to each other.
So immediately I thought okay

00:08:06.500-->00:08:12.458
well what kind of memory
protections does it provide? Uh,
I found that it had uh partial

00:08:12.458-->00:08:19.042
uh virtual space randomization,
so the binary itself and the
heap were at sta-static

00:08:19.042-->00:08:25.542
locations, however, the
libraries and the stack were uh
at randomized, so they moved

00:08:25.542-->00:08:30.167
around. But there was nothing
else, there were no stack
canaries, there was no heap

00:08:30.167-->00:08:34.542
protections, of course control
flow integrity would be way too
advanced for this device.

00:08:36.792-->00:08:41.792
Alright, so then I started
looking for more abilities, uh
started fuzzing, uh I kind of

00:08:41.792-->00:08:46.792
honed in on the fname, uh
parameter of the GET uh GET
request uh because I saw that

00:08:48.833-->00:08:53.292
fname was actually responding to
me verbatim. Whatever I put in
there it would come back inside

00:08:53.292-->00:08:57.708
of an xml file. So, I thought, I
wonder what happens there. After
about 2 seconds I found that

00:08:57.708-->00:09:04.167
there was uh, uh, a buffer
overflow and what was happening
was that the developer was uh

00:09:04.167-->00:09:09.167
copying the value of the
parameter into a, a, buffer on
the stack uh using s print f

00:09:13.500-->00:09:18.500
which is of course an unbanded
copy essentially and the the you
know it just quickly overflowed

00:09:21.375-->00:09:28.167
and I was able to control the um
return address on the stack. So,
I did that and I was really

00:09:28.167-->00:09:33.167
excited and I thought man I have
this vulnerability so quickly I
can just exploit and get

00:09:33.167-->00:09:38.167
execution on it cause I can
control the um program counter.
However, what I found is that

00:09:40.542-->00:09:44.333
even though I can control the
program counter, I couldn’t
point it anywhere useful. I

00:09:44.333-->00:09:49.667
tried pointing it to uh the main
binary and the heap, because
they were static and I could and

00:09:49.667-->00:09:56.375
I could predict those addresses,
um, but I had to, but those
things were allocated on a low

00:09:56.375-->00:10:02.667
memory so I had to uh insert a
null somehow into the string.
Fortunately, I couldn’t do it

00:10:02.667-->00:10:09.542
literally and I couldn’t use as
print as on uh ending null,
terminating null, uh for this

00:10:09.542-->00:10:15.083
address. That’s because of this
format string that it was using,
and then I tried to use uh

00:10:15.083-->00:10:20.417
red2libc attacks and I will see
if I can point it at some gadget
or directly to the stack because

00:10:20.417-->00:10:24.917
everything was essentially
executable. Uh, those things
move around so I would have to

00:10:24.917-->00:10:30.792
have uh, some sort of uh
information leak attack in order
to actually do this, but, I

00:10:30.792-->00:10:36.000
decided to move on. I started
fuzzing out the fields, um, for
example the cookies field,

00:10:36.000-->00:10:42.000
immediately overflowed for me as
well. Um, and this one was a
little bit more complex, this

00:10:42.000-->00:10:48.167
was a heap overflow, uh and what
was happening was the developer
allocated one of those object

00:10:48.167-->00:10:54.917
structures which was called cgi
tap, inside there was a buffer
of a thousand twenty four bytes.

00:10:54.917-->00:10:59.917
Now, in order to fill the buffer
they uh will take the value from
the cookie and just use strcpy

00:11:03.625-->00:11:09.000
which was obviously unbound and
put in there. Uh immediately I
thought okay well if it’s a

00:11:09.000-->00:11:14.333
thousand twenty four buffer, I
will just send a thousand thirty
six bytes and override one of

00:11:14.333-->00:11:19.333
the function pointers uh of the
structure. So, I did that and uh
about a hundred or so

00:11:22.250-->00:11:27.792
instructions later, this
function would be used, and I
was able to overflow and control

00:11:27.792-->00:11:32.792
um the program counter by uh
changing the function point of
the structure and immediately uh

00:11:35.583-->00:11:41.708
when it would jump to that
location I could have the
control there. Now, I was really

00:11:41.708-->00:11:47.125
excited about this because there
were a lot less restrictions, it
was a strcpy, and there w- there

00:11:47.125-->00:11:53.875
was no uh format to deal with.
So, what I did is I actually
point to this, um back into the

00:11:53.875-->00:12:00.500
into the heap, uh because that’s
where the value of the uh
processed messages uh body was

00:12:00.500-->00:12:05.500
being stored and post message
body is pretty much designed for
any sort of data, so I could uh

00:12:07.875-->00:12:14.542
insert pretty much any value and
I didn’t have to encode my
shellcode and I just uh was able

00:12:14.542-->00:12:19.542
to gain execution that way.
Alright, so now I can actually
show you a demo of this. I

00:12:21.875-->00:12:26.583
thought, well, if I’m an
attacker, and I have this
exploit what is it that I can

00:12:26.583-->00:12:31.917
do? So, this demo shows pretty
much everything that we’ve
talked up to this point. Um, I

00:12:31.917-->00:12:37.625
was able to attach with
debugger, I was able to get
telnet in there, um and then I

00:12:37.625-->00:12:43.708
attached with the debugging
client, gdb. So then I started
looking for some coffee, went to

00:12:43.708-->00:12:47.625
this website, and I thought okay
everything is working, the
device is fine, I throw the

00:12:47.625-->00:12:52.625
exploit and now we kind of just
let the program run. We can see
it’s working just fine, um and

00:13:00.208-->00:13:06.917
then we see some of the damage
that the exploit has done to
this device. So, when I refresh

00:13:06.917-->00:13:12.667
the same website, uh we can see
that I’m able to inject uh
javascript and essentially

00:13:12.667-->00:13:17.333
demonstrate a man in the middle
attack. And the way it was done
is basically execute in IP

00:13:17.333-->00:13:22.333
Table’s rules that allows me to
redirect http traffic to uh
somewhere else to some uh proxy

00:13:25.583-->00:13:31.875
that I’ve created. And you might
say well, I mean so what it’s of
course it’s http it’s vulnerable

00:13:31.875-->00:13:37.458
you know it’s all in clear text,
uh doesn’t everybody just use
SSL now? Uh, unfortunately not,

00:13:37.458-->00:13:44.250
I mean uh according to google’s
transparency report, there’s
still tons and tons of uh very

00:13:44.250-->00:13:50.708
popular websites such as CNN dot
com and BBC dot co dot UK that
still use http for a lot of

00:13:50.708-->00:13:56.042
portions of their website. And
really, I just need one that
will allow me to inject

00:13:56.042-->00:14:01.042
javascript in there in order to
install keyloggers or uh launch
browser attacks that way. Uh, so

00:14:05.083-->00:14:09.542
there, there are multiple ways
to actually exploit a router and
to trigger these

00:14:09.542-->00:14:14.542
vulnerabilities. First, is you
can go through the XSRF, let’s
say if a attacker visits a web

00:14:16.792-->00:14:22.583
forum and there is uh some sort
of request that has an f name
brand in there. Now I, even

00:14:22.583-->00:14:27.833
though I wasn’t able to exploit
it for uh this demo, it doesn’t
mean that the device doesn’t

00:14:27.833-->00:14:33.125
have any other attacks. And so,
if it was susceptible to other
overflows, through the

00:14:33.125-->00:14:38.708
unauthenticated get requests, we
could potentially do it without
even being close to the device

00:14:38.708-->00:14:43.750
itself. The other option is uh
from the external WiFi, you know
like I said, this is a travel

00:14:43.750-->00:14:48.792
router, it connects to all kinds
of networks with questionable
cyber hygiene in there, and so

00:14:48.792-->00:14:53.667
there could be a way to be
vulnerable to exploitation from
there. Uh, and then of course

00:14:53.667-->00:14:59.000
from inside the WiFi itself.
Now, what if you connect an
Android device that has uh

00:14:59.000-->00:15:05.125
Malware that specifically
targets uh the infrastructure.
For example, there was one

00:15:05.125-->00:15:12.042
called switcher which would look
for routers to attack from the
Android device. Alright, so

00:15:12.042-->00:15:16.917
pretty much getting to the end
at this point, so this was a lot
of fun, I mean these

00:15:16.917-->00:15:22.708
vulnerabilities were reported to
the vendor and they were
recorded in the cve database,

00:15:22.708-->00:15:28.542
you know the stack overflow was
very easy to fix, uh just
specifically use snprintf which

00:15:28.542-->00:15:33.458
is bonded, or in more general
terms you can use stack
canaries, which wouldn’t prevent

00:15:33.458-->00:15:38.292
the vulnerability itself but at
least it was terminate the
attack vector. And, it wouldn’t

00:15:38.292-->00:15:43.292
be able to take advantage of
this. Uh, the heap overflow is a
little bit uh, little bit harder

00:15:46.083-->00:15:53.000
to deal with. Uh, basically just
use a bonded strncpy, or you can
also in more general terms, you

00:15:53.000-->00:15:58.083
can try to encode your function
point, such as something that
Windows does. Um, but

00:15:58.083-->00:16:03.083
unfortunately, as you can see
here the NSA has a patent on
that, so we don’t get to use it.

00:16:05.167-->00:16:09.792
Alright, so why would somebody
actually try to attack uh travel
routers or any sort of

00:16:09.792-->00:16:14.833
infrastructure. I mean, there,
there a lot of use cases for
this. First one is attribution

00:16:14.833-->00:16:19.833
obfuscation, uh you know if I’m
an attacker and I want to hide
my, my exploits, you know I may

00:16:22.625-->00:16:26.500
want to blame someone else for
it so I can exploit their
infrastructure and then use that

00:16:26.500-->00:16:33.250
as a jumping point for my
attacks. Uh of course, stealing
uh user information, you know

00:16:33.250-->00:16:36.958
authentication tokens,
usernames, passwords, pretty
much anything that is uh

00:16:36.958-->00:16:43.042
unencrypted I can start
collecting uh from this device.
And then also I can manipulate

00:16:43.042-->00:16:47.500
the user information, you know,
you can, you saw in the in the
demonstration where I was able

00:16:47.500-->00:16:52.458
to inject javascript so that
means I can inject exploits, uh
I can manipulate what they see,

00:16:52.458-->00:16:57.917
etcetera, etcetera. And, of
course, the last one is uh
getting a foothold into other

00:16:57.917-->00:17:02.083
networks, you know it’s a travel
device so it’s going to be
touching a lot of different

00:17:02.083-->00:17:06.667
networks, you know if I want to
propagate as fast as possible, I
may, I may try to use this

00:17:06.667-->00:17:11.667
device to launch attacks you
know into airbnbs, hotels,
enterprises, what have you. So,

00:17:14.417-->00:17:19.375
I reported this to the vendor,
they were quite happy to receive
it, they said, hey, thanks for

00:17:19.375-->00:17:24.083
finding these vulnerabilities
however, our entire product team
is off on Spring festival

00:17:24.083-->00:17:30.083
[laughter] ha. I said to myself
this is kind of cool, I want to
be part of that, it sounds like

00:17:30.083-->00:17:34.542
fun. Uh, then it turns out this
was actually the Chinese New
Year, I didn’t know this, so

00:17:34.542-->00:17:39.625
this was like a really cool
cultural thing to learn, um and
of course, as soon as the

00:17:39.625-->00:17:44.500
Chinese New Year was over,
everyone got back and they
promptly responded by sending me

00:17:44.500-->00:17:50.042
a patched version personally,
but nothing to anyone else
[laughter] and about a couple

00:17:50.042-->00:17:54.500
of, couple of weeks later, I
noticed that it wasn’t published
on the website, I said hey can

00:17:54.500-->00:17:59.917
you guys like make this public
so that people are not exploited
by anyone and so, they did. Um,

00:17:59.917-->00:18:03.792
they just said that the release
cycle was a little bit slower
than to just send me an email.

00:18:03.792-->00:18:09.708
That was cool, they were super
nice about it. So, what did we
learn from this process? I mean

00:18:09.708-->00:18:13.792
you know the saying, “don’t roll
your own crypto” well, I think
there should be a saying that

00:18:13.792-->00:18:19.917
says “don’t roll your own custom
CGI webserver” cause those
things are notoriously complex,

00:18:19.917-->00:18:25.083
there’s a lot of work to be done
and there’s a lot of parsing
happening in there. And so

00:18:25.083-->00:18:30.625
really, either get a lot of
people, get a lot of eyes, or
use something that has been

00:18:30.625-->00:18:37.542
tested by the community. Vendors
do respond, I had a pretty good
experience in this case. Uh, if

00:18:37.542-->00:18:42.500
you can, use something like
openWRT just because like I
said, it’s been tested and used

00:18:42.500-->00:18:48.667
by other people. Um I mean to me
exploiting routers is a lot of
fun. I didn’t, I didn’t know

00:18:48.667-->00:18:54.000
mips before this and so it was
kind of cool to learn all this
process, and to be honest, I was

00:18:54.000-->00:18:59.458
really surprised that people
still use strcpys and sprintf s
just like they did in 1999.

00:18:59.458-->00:19:04.458
Alright, so, if you enjoyed this
and you want to chat about this,
I mean thank you for coming,

00:19:06.583-->00:19:11.375
it’s been a real pleasure to be
here and if you have more
questions, please ask ahead. And

00:19:11.375-->00:19:16.333
if you want to catch me in the
hallways or online, uh you can
find me there as well, I-I love

00:19:16.333-->00:19:22.542
to talk about this stuff. Um I
will also put about 4 different
articles on my blog describing

00:19:22.542-->00:19:26.417
all the processes I’ve gone
through and more information
about reverse engineering at

00:19:26.417-->00:19:31.417
debugtrap dot com. So, thank you
for your attention [applause]