1
00:00:00,150 --> 00:00:04,500
- Let's give Jay Lagorio a big welcome,

2
00:00:04,500 --> 00:00:06,303
first time speaker at DEF CON.

3
00:00:07,872 --> 00:00:08,705
Come on!

4
00:00:08,705 --> 00:00:09,701
Come on, come on!

5
00:00:09,701 --> 00:00:12,701
(audience applauds)

6
00:00:13,740 --> 00:00:17,160
Man after my own heart, we're
digging into reversing here,

7
00:00:17,160 --> 00:00:20,833
breaking apart some
encryption, so let's go.

8
00:00:22,069 --> 00:00:22,902
- Thanks.

9
00:00:24,060 --> 00:00:26,883
Good evening DEF CON, and happy 30th.

10
00:00:28,422 --> 00:00:31,470
And I'm sure this has been
asked like a dozen times today,

11
00:00:31,470 --> 00:00:32,883
who's first DEF CON?

12
00:00:34,140 --> 00:00:35,790
Oh, that's awesome.

13
00:00:35,790 --> 00:00:36,900
Okay, that's great.

14
00:00:36,900 --> 00:00:37,733
So welcome.

15
00:00:37,733 --> 00:00:39,180
Glad you're enjoying it.

16
00:00:39,180 --> 00:00:40,620
There's a lot more for you to see tonight.

17
00:00:40,620 --> 00:00:43,080
Hacker Jeopardy is here after this.

18
00:00:43,080 --> 00:00:45,870
I think it's in a little bit,
but that's the next thing.

19
00:00:45,870 --> 00:00:47,340
So let's get this started.

20
00:00:47,340 --> 00:00:50,700
This is talk is called,
"Tear Down this Zywall,

21
00:00:50,700 --> 00:00:52,977
breaking open the Zyxel
Encrypted Firmware."

22
00:00:54,270 --> 00:00:56,850
So we'll talk about how I got into this,

23
00:00:56,850 --> 00:00:59,010
into the different
analysis that went into it.

24
00:00:59,010 --> 00:01:00,810
There's hardware, software,

25
00:01:00,810 --> 00:01:02,580
some firmware stuff going on,

26
00:01:02,580 --> 00:01:04,260
where that gets us later

27
00:01:04,260 --> 00:01:06,600
and then what's left
for other people to do

28
00:01:06,600 --> 00:01:08,283
after they take up this mantle.

29
00:01:09,360 --> 00:01:11,190
So who am I?

30
00:01:11,190 --> 00:01:12,023
My name's Jay.

31
00:01:12,023 --> 00:01:14,370
I went to school at UMBC in Maryland,

32
00:01:14,370 --> 00:01:17,040
and then I went to school
again in California,

33
00:01:17,040 --> 00:01:20,040
and I have a CISSP and
some various SANS certs

34
00:01:20,040 --> 00:01:22,560
that I'm sure have
expired, but they were fun.

35
00:01:22,560 --> 00:01:24,030
And when I think about myself,

36
00:01:24,030 --> 00:01:25,830
I think like, I'm a windows developer,

37
00:01:25,830 --> 00:01:28,620
so you're gonna see a lot
of windows stuff in here,

38
00:01:28,620 --> 00:01:31,050
even though this is
very much a Linuxy talk,

39
00:01:31,050 --> 00:01:32,190
I'm a security consultant

40
00:01:32,190 --> 00:01:35,520
and I'm also a licensed
private investigator in DC.

41
00:01:35,520 --> 00:01:38,370
And although I'm a first
time DEF CON speaker

42
00:01:38,370 --> 00:01:39,203
on the main stage,

43
00:01:39,203 --> 00:01:42,240
I've spoken at Hackfest in Quebec.

44
00:01:42,240 --> 00:01:43,470
That was super fun.

45
00:01:43,470 --> 00:01:46,050
I got to talk about making
artificial pancreases

46
00:01:46,050 --> 00:01:48,750
at DEF CON 27 in the Biohacking Village,

47
00:01:48,750 --> 00:01:50,520
which by the way is not a good village,

48
00:01:50,520 --> 00:01:52,020
it is an excellent village.

49
00:01:52,020 --> 00:01:55,080
So if you can get over
there, you definitely should.

50
00:01:55,080 --> 00:01:57,900
And I got to do sort
of a re-up on that talk

51
00:01:57,900 --> 00:02:00,420
with some updates at Kernelcon 2,

52
00:02:00,420 --> 00:02:03,030
which was in March of 2020,

53
00:02:03,030 --> 00:02:05,280
and very suddenly virtual.

54
00:02:05,280 --> 00:02:08,820
But boy, did they pull that
off in two weeks notice,

55
00:02:08,820 --> 00:02:09,653
it was good.

56
00:02:09,653 --> 00:02:12,423
And yeah, I'm an unrepentant nerd.

57
00:02:13,290 --> 00:02:16,020
So it was December, 2020

58
00:02:16,020 --> 00:02:18,480
and we all just got through
the first year of the plague

59
00:02:18,480 --> 00:02:20,670
and things were looking up.

60
00:02:20,670 --> 00:02:22,680
Vaccines were just over the horizon

61
00:02:22,680 --> 00:02:25,530
and things were looking a little hopeful,

62
00:02:25,530 --> 00:02:26,910
but then like usual,

63
00:02:26,910 --> 00:02:30,213
it all got ruined because I got an email.

64
00:02:31,380 --> 00:02:34,260
And so the text here is kind of small,

65
00:02:34,260 --> 00:02:35,137
but what it says is,

66
00:02:35,137 --> 00:02:36,810
"Hey, we are Zyxel,

67
00:02:36,810 --> 00:02:38,070
we make your firewall.

68
00:02:38,070 --> 00:02:40,381
And we know that you
diligently updated and patched

69
00:02:40,381 --> 00:02:44,400
for the last quarter
just like we ask you to.

70
00:02:44,400 --> 00:02:46,170
And we know it's only been two weeks

71
00:02:46,170 --> 00:02:47,400
since you installed that patch,

72
00:02:47,400 --> 00:02:49,110
but we've got this thing called

73
00:02:49,110 --> 00:02:51,810
an undocumented user account,

74
00:02:51,810 --> 00:02:54,510
and this is the fix for it."

75
00:02:54,510 --> 00:02:57,120
And so when I think
undocumented user account,

76
00:02:57,120 --> 00:03:01,620
I think, they just back and
backdoored all my firewalls.

77
00:03:01,620 --> 00:03:04,122
This, you gotta be kidding me!

78
00:03:04,122 --> 00:03:06,090
But maybe it's not that bad, right?

79
00:03:06,090 --> 00:03:07,140
So you go look up,

80
00:03:07,140 --> 00:03:09,450
I look up the CVE, and you
go look at the research

81
00:03:09,450 --> 00:03:10,283
and yeah,

82
00:03:10,283 --> 00:03:12,120
yeah, that's exactly what they did.

83
00:03:12,120 --> 00:03:13,860
So that was super cool.

84
00:03:13,860 --> 00:03:16,347
If you've got the username zyfwp

85
00:03:16,347 --> 00:03:18,870
and the password, it was out there,

86
00:03:18,870 --> 00:03:23,250
you could log into any Zyxel
firewall of this series,

87
00:03:23,250 --> 00:03:27,061
and that kind of seems terrible.

88
00:03:27,061 --> 00:03:30,000
So all this is bad, right?

89
00:03:30,000 --> 00:03:32,610
But I'm nosy and I wanna see the bug.

90
00:03:32,610 --> 00:03:34,500
And even though I've not really gone into

91
00:03:34,500 --> 00:03:36,390
reversing the Zyxel firmware before,

92
00:03:36,390 --> 00:03:37,560
I've always kind of thought about it.

93
00:03:37,560 --> 00:03:38,730
So I figure why not,

94
00:03:38,730 --> 00:03:40,170
this is a great opportunity

95
00:03:40,170 --> 00:03:42,660
and it's not like I'm doing much else.

96
00:03:42,660 --> 00:03:46,260
So even though it didn't
affect me directly because,

97
00:03:46,260 --> 00:03:47,827
and I'll quote from the article,

98
00:03:47,827 --> 00:03:49,650
"The account seemed to work on both

99
00:03:49,650 --> 00:03:51,780
the SSH and web interface,"

100
00:03:51,780 --> 00:03:53,940
I don't expose those to the internet,

101
00:03:53,940 --> 00:03:56,190
but what's to stop someone
from getting into the network

102
00:03:56,190 --> 00:03:57,750
a different way and then turning around

103
00:03:57,750 --> 00:04:00,930
and enabling more access
via my backdoored firewall.

104
00:04:00,930 --> 00:04:03,540
So again, all this seems pretty bad.

105
00:04:03,540 --> 00:04:05,370
And what makes it more interesting

106
00:04:05,370 --> 00:04:09,030
is that at the time there
was a hundred to 300,000

107
00:04:09,030 --> 00:04:11,370
potentially affected devices.

108
00:04:11,370 --> 00:04:14,073
So with all this, let's take a look.

109
00:04:15,570 --> 00:04:16,710
And I assume it'll be easy

110
00:04:16,710 --> 00:04:19,350
because everything that
I go into starting with,

111
00:04:19,350 --> 00:04:21,360
it seems like it's gonna be easy

112
00:04:21,360 --> 00:04:22,830
and then it definitely isn't.

113
00:04:22,830 --> 00:04:24,420
But what do we see here

114
00:04:24,420 --> 00:04:26,820
right off the back, PK.

115
00:04:26,820 --> 00:04:27,990
That's a really good sign for us

116
00:04:27,990 --> 00:04:29,490
because that means it's a zip file.

117
00:04:29,490 --> 00:04:31,050
So great news.

118
00:04:31,050 --> 00:04:32,613
Let's open it in 7zip,

119
00:04:33,780 --> 00:04:36,300
but 7zip says there's a password,

120
00:04:36,300 --> 00:04:37,950
which is weird because I've worked

121
00:04:37,950 --> 00:04:39,270
with these firewalls for a while

122
00:04:39,270 --> 00:04:40,800
and never had to know a password.

123
00:04:40,800 --> 00:04:43,950
So we've looked at this
for about five minutes.

124
00:04:43,950 --> 00:04:45,750
What do we know so far?

125
00:04:45,750 --> 00:04:47,460
We know it's a zip file.

126
00:04:47,460 --> 00:04:49,770
We know the file's password protected.

127
00:04:49,770 --> 00:04:51,540
We can see the files inside,

128
00:04:51,540 --> 00:04:53,520
that's how ZipCrypto works.

129
00:04:53,520 --> 00:04:56,310
And some of those files
are available online,

130
00:04:56,310 --> 00:04:58,290
we think, maybe.

131
00:04:58,290 --> 00:05:01,233
And the update process
doesn't require a password.

132
00:05:02,640 --> 00:05:04,110
And the other interesting thing is that

133
00:05:04,110 --> 00:05:05,910
7zip says there's a trailer.

134
00:05:05,910 --> 00:05:07,470
And I don't mean a trailer like,

135
00:05:07,470 --> 00:05:09,180
five or eight bytes
got added onto the end,

136
00:05:09,180 --> 00:05:11,100
'cause some weird download thing.

137
00:05:11,100 --> 00:05:13,253
That's 120 4K,

138
00:05:13,253 --> 00:05:15,543
that's not unintentional.

139
00:05:16,920 --> 00:05:18,360
So what do we do first?

140
00:05:18,360 --> 00:05:19,740
Default passwords.

141
00:05:19,740 --> 00:05:23,520
Zyxel has been raked over
the coals for Zyxel 1,2,3

142
00:05:23,520 --> 00:05:24,870
was the first thing I tried,

143
00:05:24,870 --> 00:05:27,150
it was the first thing not to work.

144
00:05:27,150 --> 00:05:29,700
Tried a few others that
other people suggested

145
00:05:29,700 --> 00:05:31,140
and none of that worked.

146
00:05:31,140 --> 00:05:35,850
So we can see the files
inside the archive,

147
00:05:35,850 --> 00:05:37,620
maybe we can do something with that.

148
00:05:37,620 --> 00:05:39,187
And what I tried next was called,

149
00:05:39,187 --> 00:05:40,620
"The Zip Plain-Text Attack.

150
00:05:40,620 --> 00:05:43,110
And this is not novel, it's not new.

151
00:05:43,110 --> 00:05:45,150
It's from 1994.

152
00:05:45,150 --> 00:05:46,590
And what you can do is

153
00:05:46,590 --> 00:05:49,740
if you have one file from
outside of the archive,

154
00:05:49,740 --> 00:05:52,470
you can derive the key stream
for the rest of the files

155
00:05:52,470 --> 00:05:55,560
in the archive with like
math and magic, I don't know,

156
00:05:55,560 --> 00:05:57,690
it's not my thing, but I tried it

157
00:05:57,690 --> 00:06:01,161
and yeah, it did not work.

158
00:06:01,161 --> 00:06:04,893
And one reason that it didn't work, oh no,

159
00:06:05,880 --> 00:06:08,400
there's nothing at the FTP site,

160
00:06:08,400 --> 00:06:09,300
it's just gone.

161
00:06:09,300 --> 00:06:11,100
My go-to for years

162
00:06:11,100 --> 00:06:14,400
for files from Zyxel is just gone.

163
00:06:14,400 --> 00:06:19,140
And what happened was between
when I submitted this paper

164
00:06:19,140 --> 00:06:22,380
and got accepted, they
took that service offline.

165
00:06:22,380 --> 00:06:24,300
So I don't have that to show you

166
00:06:24,300 --> 00:06:26,490
'cause it's gone and it's
replaced with a thing

167
00:06:26,490 --> 00:06:28,140
where you need to log in

168
00:06:28,140 --> 00:06:30,030
and give 'em a serial number and register,

169
00:06:30,030 --> 00:06:32,100
so all of those files are unavailable,

170
00:06:32,100 --> 00:06:35,100
but maybe somebody else has a copy.

171
00:06:35,100 --> 00:06:36,430
So we go to archive.org

172
00:06:37,560 --> 00:06:40,800
and it's not, I mean granted, great folks.

173
00:06:40,800 --> 00:06:42,900
It's not the most updated thing

174
00:06:42,900 --> 00:06:46,470
this is from 2014 in the June timeframe,

175
00:06:46,470 --> 00:06:48,060
but let's at least give it a try, right?

176
00:06:48,060 --> 00:06:51,150
It's something to go on and
it's better than what I got.

177
00:06:51,150 --> 00:06:54,060
So we can use something called bkcrack,

178
00:06:54,060 --> 00:06:56,220
it's available on GitHub

179
00:06:56,220 --> 00:06:57,630
and it didn't work.

180
00:06:57,630 --> 00:07:01,350
And I'm pretty sure that what
I had was just the wrong files

181
00:07:01,350 --> 00:07:02,910
because they have to be, you know,

182
00:07:02,910 --> 00:07:06,570
byte by byte identical in
order for this to work.

183
00:07:06,570 --> 00:07:08,160
So I have one more strategy to try,

184
00:07:08,160 --> 00:07:09,810
y'all might be familiar with it.

185
00:07:09,810 --> 00:07:12,513
our very last resort, Password Cracking.

186
00:07:13,440 --> 00:07:15,060
And I tried lost password.

187
00:07:15,060 --> 00:07:15,893
If you've used it,

188
00:07:15,893 --> 00:07:18,390
it's very pointy, clicky,
easy to use, it's great.

189
00:07:18,390 --> 00:07:20,730
And JohnTheRipper, which
is less easy to use,

190
00:07:20,730 --> 00:07:22,590
but really fast and really good

191
00:07:22,590 --> 00:07:24,090
if you can get the hang of it.

192
00:07:24,090 --> 00:07:25,950
And they were both
touchy about the trailer,

193
00:07:25,950 --> 00:07:28,950
but it gave me a couple
days to brainstorm,

194
00:07:28,950 --> 00:07:32,880
and when I was done brainstorming,
I just felt depressed.

195
00:07:32,880 --> 00:07:35,220
So this doesn't feel great.

196
00:07:35,220 --> 00:07:37,800
I don't really know where to go here

197
00:07:37,800 --> 00:07:39,750
until I realized what I have was

198
00:07:39,750 --> 00:07:41,700
a chicken and an egg problem.

199
00:07:41,700 --> 00:07:43,350
So I've gotten encrypted firmware

200
00:07:43,350 --> 00:07:45,630
and a device that knows how to decrypt it.

201
00:07:45,630 --> 00:07:48,210
So somewhere the firmware is decrypted

202
00:07:48,210 --> 00:07:51,270
and it just so happens that I'm a hoarder.

203
00:07:51,270 --> 00:07:53,430
And so I have the previous generation

204
00:07:53,430 --> 00:07:55,830
of this device on the shelf,

205
00:07:55,830 --> 00:07:58,530
so maybe we can bench it and
pull something out of it.

206
00:07:59,940 --> 00:08:02,400
So now we'll move on to the hardware.

207
00:08:02,400 --> 00:08:05,010
This is the original device in the rack,

208
00:08:05,010 --> 00:08:08,520
not gonna win any cable
porn awards or anything,

209
00:08:08,520 --> 00:08:09,480
but there it is,

210
00:08:09,480 --> 00:08:12,442
it does its job for the most
part when it's not backdoored.

211
00:08:12,442 --> 00:08:15,840
And so this is a typical MIPS box.

212
00:08:15,840 --> 00:08:18,660
You can see a serial port up at the top.

213
00:08:18,660 --> 00:08:20,940
You can see the ethernet
ports down at the bottom

214
00:08:20,940 --> 00:08:22,740
and where I've highlighted in red,

215
00:08:22,740 --> 00:08:25,440
is a separate board
where the storage goes.

216
00:08:25,440 --> 00:08:26,550
And this is the top view,

217
00:08:26,550 --> 00:08:30,330
it's your standard
Samsung NAND Flash Chip.

218
00:08:30,330 --> 00:08:32,640
And yeah, we're just gonna bend that back

219
00:08:32,640 --> 00:08:35,820
and I cut the hell out of those pins,

220
00:08:35,820 --> 00:08:38,340
I hoped they weren't needed later.

221
00:08:38,340 --> 00:08:41,160
And what we've got is a 10 pin connector.

222
00:08:41,160 --> 00:08:44,100
We've got this PHISON PS2251,

223
00:08:44,100 --> 00:08:46,620
which might look familiar to some of you

224
00:08:46,620 --> 00:08:48,630
and yeah, whatever the hell this is.

225
00:08:48,630 --> 00:08:51,780
But it turns out that the 10 pin connector

226
00:08:51,780 --> 00:08:53,730
is the same thing that you'd see

227
00:08:53,730 --> 00:08:56,310
on your regular desktop motherboard

228
00:08:56,310 --> 00:08:58,920
to connect external USB pins.

229
00:08:58,920 --> 00:09:03,030
And the PHISON chip is your
typical none to USB storage chip

230
00:09:03,030 --> 00:09:05,910
that you see these on
thumb drives all the time.

231
00:09:05,910 --> 00:09:09,270
And so I looked for a USB hub

232
00:09:09,270 --> 00:09:10,440
that I really didn't care about

233
00:09:10,440 --> 00:09:14,580
because this was gonna be a bet.

234
00:09:14,580 --> 00:09:15,630
This was gonna be fraught,

235
00:09:15,630 --> 00:09:18,660
and so you just shove
some pins into the header

236
00:09:18,660 --> 00:09:20,610
and sorter them onto a USB cable

237
00:09:20,610 --> 00:09:22,407
that I just cut in half

238
00:09:22,407 --> 00:09:25,140
and hope the magic smoke doesn't come out

239
00:09:25,140 --> 00:09:26,010
when you plug it in,

240
00:09:26,010 --> 00:09:30,090
but the drive mounted and I had a disc,

241
00:09:30,090 --> 00:09:33,362
which honestly surprised the
hell out of me (chuckles).

242
00:09:33,362 --> 00:09:34,800
(audience applauds)

243
00:09:34,800 --> 00:09:38,490
So you can use Win32DiskImager
to image the entire drive.

244
00:09:38,490 --> 00:09:39,930
You get the whole of the partitions

245
00:09:39,930 --> 00:09:41,670
and you throw it into binwalk

246
00:09:41,670 --> 00:09:44,550
and then out pops the
firmware in plain-text,

247
00:09:44,550 --> 00:09:46,020
which is great.

248
00:09:46,020 --> 00:09:48,360
And so we're not done yet though,

249
00:09:48,360 --> 00:09:49,889
because when I kind of set out for this,

250
00:09:49,889 --> 00:09:54,300
I didn't want the firmware
from this one device,

251
00:09:54,300 --> 00:09:56,520
that's now in the trash.

252
00:09:56,520 --> 00:09:59,550
I wanted to decrypt these
arbitrary firmware files

253
00:09:59,550 --> 00:10:02,673
whenever I got them off
of the Zyxel website.

254
00:10:03,600 --> 00:10:05,250
But now we have a starting point.

255
00:10:07,170 --> 00:10:08,880
So let's look at the software

256
00:10:08,880 --> 00:10:10,830
'cause now we have access to it, right?

257
00:10:11,820 --> 00:10:16,320
The device runs the Apache
web server, pretty typical.

258
00:10:16,320 --> 00:10:20,640
You submit the firmware to
firmware upload cgi in cgi.bin.

259
00:10:20,640 --> 00:10:22,890
And the first thing you do
with that is run strings.

260
00:10:22,890 --> 00:10:26,160
And it's got a really interesting one,

261
00:10:26,160 --> 00:10:27,603
zld_fsextract.

262
00:10:28,710 --> 00:10:30,600
Looks pretty promising.

263
00:10:30,600 --> 00:10:32,130
So we'll throw it into Google

264
00:10:32,130 --> 00:10:35,373
and we get one solitary result.

265
00:10:36,638 --> 00:10:38,730
And it's 10 years old,

266
00:10:38,730 --> 00:10:40,830
so it could mean nothing.

267
00:10:40,830 --> 00:10:42,540
But it says USG firmwares

268
00:10:42,540 --> 00:10:44,190
are zipped with a very strong password.

269
00:10:44,190 --> 00:10:46,080
Okay, that's yeah, I guess so.

270
00:10:46,080 --> 00:10:48,150
I mean the password
cracking sure didn't work.

271
00:10:48,150 --> 00:10:50,339
And it says the zld_fsextract command line

272
00:10:50,339 --> 00:10:52,590
verifies the zip and unzips it.

273
00:10:52,590 --> 00:10:53,730
Yeah, okay.

274
00:10:53,730 --> 00:10:56,610
It also says watch the console
output during the update,

275
00:10:56,610 --> 00:10:58,410
and I didn't do that because again,

276
00:10:58,410 --> 00:11:00,450
I just cut this thing off the board,

277
00:11:00,450 --> 00:11:01,740
so that wasn't really an option,

278
00:11:01,740 --> 00:11:04,473
but it looks like we're on the right path.

279
00:11:05,490 --> 00:11:08,580
Now again, I took the old device

280
00:11:08,580 --> 00:11:11,729
that I had on a shelf, right?

281
00:11:11,729 --> 00:11:15,720
The devices have the same
processor architecture,

282
00:11:15,720 --> 00:11:17,520
the firmware formats are similar

283
00:11:17,520 --> 00:11:20,520
an encrypted zip, trailing bytes.

284
00:11:20,520 --> 00:11:22,890
And so there's nothing
on the internet to say

285
00:11:22,890 --> 00:11:24,780
how to break into this firmware,

286
00:11:24,780 --> 00:11:27,930
so like, I don't know from
a vendor's perspective,

287
00:11:27,930 --> 00:11:29,790
if it ain't broke, don't fix it.

288
00:11:29,790 --> 00:11:32,850
So what's to say that it ended up changing

289
00:11:32,850 --> 00:11:33,960
for the new model,

290
00:11:33,960 --> 00:11:36,660
which was what I was
actually interested in.

291
00:11:36,660 --> 00:11:38,430
Now the first thing I wanted to run

292
00:11:38,430 --> 00:11:42,600
on this binary zld_fsextract, is file.

293
00:11:42,600 --> 00:11:44,430
Just give something to go on.

294
00:11:44,430 --> 00:11:45,750
And the thing that I really hated

295
00:11:45,750 --> 00:11:47,760
was that it's statically
linked and stripped.

296
00:11:47,760 --> 00:11:50,130
And that means that I
can't find things like

297
00:11:50,130 --> 00:11:51,510
mem copy, stir copy,

298
00:11:51,510 --> 00:11:55,440
the normal library functions
that you would wanna see

299
00:11:55,440 --> 00:11:57,090
because it's gonna help
you reverse engineer

300
00:11:57,090 --> 00:11:58,320
the rest of the thing.

301
00:11:58,320 --> 00:11:59,760
And maybe that doesn't hurt us so bad,

302
00:11:59,760 --> 00:12:01,740
but it didn't feel great.

303
00:12:01,740 --> 00:12:03,810
And the next thing that I ran was strings.

304
00:12:03,810 --> 00:12:06,990
And I got the best one that
you could ever hope for,

305
00:12:06,990 --> 00:12:08,760
a usage string.

306
00:12:08,760 --> 00:12:09,630
This is great.

307
00:12:09,630 --> 00:12:11,520
It tells me where to start

308
00:12:11,520 --> 00:12:13,560
when I wanna submit a file to this thing.

309
00:12:13,560 --> 00:12:15,180
And the second best news

310
00:12:15,180 --> 00:12:19,380
is that this thing calls
7za, which is 7zip.

311
00:12:19,380 --> 00:12:21,270
So again, feeling good,

312
00:12:21,270 --> 00:12:22,830
I'm on the right path.

313
00:12:22,830 --> 00:12:24,990
Now let's look at our other friend here

314
00:12:24,990 --> 00:12:27,780
that's gonna help us with our
software reverse engineering,

315
00:12:27,780 --> 00:12:29,070
and that's Ghidra.

316
00:12:29,070 --> 00:12:30,660
Now, if you've been living under a rock,

317
00:12:30,660 --> 00:12:33,960
it is a free disassembler and
decompile for a decompiler

318
00:12:33,960 --> 00:12:37,350
from the national security
agency, may have heard of them.

319
00:12:37,350 --> 00:12:41,790
And we can see a function that
is building a command line.

320
00:12:41,790 --> 00:12:44,253
And part of the command line is 7za.

321
00:12:44,253 --> 00:12:45,086
Okay, great.

322
00:12:45,086 --> 00:12:46,230
That's where we wanna start.

323
00:12:46,230 --> 00:12:48,360
And the other thing that
it adds to the command line

324
00:12:48,360 --> 00:12:51,060
is -p, and that's a really good sign

325
00:12:51,060 --> 00:12:54,930
because after -p that's where
it's gonna drop the password.

326
00:12:54,930 --> 00:12:57,780
So this is the function,
that calls the function

327
00:12:57,780 --> 00:12:59,253
that generates the password.

328
00:13:01,380 --> 00:13:03,905
Now I didn't wanna try and
emulate the entire device

329
00:13:03,905 --> 00:13:07,980
just because that seemed hard
and I'm lazy, I don't know.

330
00:13:07,980 --> 00:13:12,090
And so Qemu Usermode Emulation was great.

331
00:13:12,090 --> 00:13:13,470
It jumped right into action.

332
00:13:13,470 --> 00:13:15,510
So the only little trick that I had to do,

333
00:13:15,510 --> 00:13:17,525
was I had to grab a library

334
00:13:17,525 --> 00:13:20,550
that you see that .so off the device

335
00:13:20,550 --> 00:13:22,530
and just link it to somewhere else

336
00:13:22,530 --> 00:13:24,720
that was in my windows service subsystem

337
00:13:24,720 --> 00:13:27,930
for Linux build so that it could run.

338
00:13:27,930 --> 00:13:28,770
And then when you run it,

339
00:13:28,770 --> 00:13:30,450
you add S trace to it

340
00:13:30,450 --> 00:13:33,510
so that you can see the
different cis calls that it makes

341
00:13:33,510 --> 00:13:35,580
and maybe try to suss
out some information.

342
00:13:35,580 --> 00:13:37,260
So speaking of information,

343
00:13:37,260 --> 00:13:39,000
my first run at this, you can see,

344
00:13:39,000 --> 00:13:42,363
I added -i, because part of
the usage seemed to indicate

345
00:13:42,363 --> 00:13:45,180
if I do that, it'll just
tell me some information,

346
00:13:45,180 --> 00:13:46,590
it won't try to extract anything.

347
00:13:46,590 --> 00:13:49,350
And I thought that was
a good starting point,

348
00:13:49,350 --> 00:13:53,250
but just when I was gonna go
look for where it ran 7zip,

349
00:13:53,250 --> 00:13:57,300
I saw this here, where right off the back,

350
00:13:57,300 --> 00:14:00,570
we open the file for
read and seek to 120 4k

351
00:14:00,570 --> 00:14:02,820
from the end of the file.

352
00:14:02,820 --> 00:14:05,970
Now I'm not saying I don't
believe in coincidences,

353
00:14:05,970 --> 00:14:07,770
but that should look familiar.

354
00:14:07,770 --> 00:14:09,770
So I think we're on the right path here.

355
00:14:11,400 --> 00:14:13,410
Now again, I tried to run -i

356
00:14:13,410 --> 00:14:15,690
because I thought it was
gonna build this command line

357
00:14:15,690 --> 00:14:18,120
and have it be 7zip the whole thing.

358
00:14:18,120 --> 00:14:20,910
But what I actually found was that

359
00:14:20,910 --> 00:14:23,370
I control that parameter entirely.

360
00:14:23,370 --> 00:14:25,770
So if you look at this execve call here,

361
00:14:25,770 --> 00:14:27,960
it tries to run -i,

362
00:14:27,960 --> 00:14:31,230
and that means I can run
whatever I want in there.

363
00:14:31,230 --> 00:14:35,310
And then after -i, you have -o, -q, and -p

364
00:14:35,310 --> 00:14:37,740
and that really long string.

365
00:14:37,740 --> 00:14:41,790
So we could plug a tool in here
that spits out the password

366
00:14:41,790 --> 00:14:44,140
since we have direct
control of this parameter.

367
00:14:46,245 --> 00:14:48,810
And earmuffs goons, earmuffs.

368
00:14:48,810 --> 00:14:49,980
I didn't tell the conference

369
00:14:49,980 --> 00:14:52,530
that I was gonna release a tool today.

370
00:14:52,530 --> 00:14:54,420
So I'm gonna put it on the screen

371
00:14:54,420 --> 00:14:55,970
and it'll be our little secret.

372
00:14:57,060 --> 00:14:59,850
This is the most complicated
tool I've ever released.

373
00:14:59,850 --> 00:15:02,880
Put the camera down, please.

374
00:15:02,880 --> 00:15:04,530
This is hard work, all right.

375
00:15:04,530 --> 00:15:06,630
We're gonna print out the fourth argument.

376
00:15:08,070 --> 00:15:09,330
And it works.

377
00:15:09,330 --> 00:15:12,210
So you can feed the
extractor any firmware file

378
00:15:12,210 --> 00:15:13,860
and quickly output the password

379
00:15:13,860 --> 00:15:16,743
for easy extraction with 7zip.

380
00:15:17,930 --> 00:15:19,170
And I think we got there.

381
00:15:19,170 --> 00:15:20,820
So that's success.

382
00:15:20,820 --> 00:15:23,400
And you can see the password's
there multiple times

383
00:15:23,400 --> 00:15:25,470
because instead of, I don't know,

384
00:15:25,470 --> 00:15:28,950
being efficient, it
runs 7zip for each file

385
00:15:28,950 --> 00:15:29,880
it wants to extract,

386
00:15:29,880 --> 00:15:31,920
it doesn't just dump the entire archive

387
00:15:31,920 --> 00:15:34,260
and those dots there on the left side,

388
00:15:34,260 --> 00:15:35,190
if you see that,

389
00:15:35,190 --> 00:15:37,890
that's what would otherwise
be, just progress,

390
00:15:37,890 --> 00:15:40,554
you know, progress dots indicators.

391
00:15:40,554 --> 00:15:41,610
And yeah.

392
00:15:41,610 --> 00:15:42,924
So that's really all you had to do.

393
00:15:42,924 --> 00:15:44,850
And there's the command line to do it.

394
00:15:44,850 --> 00:15:48,060
You can pass any Zyxel.bin file there,

395
00:15:48,060 --> 00:15:50,045
including the one that was released,

396
00:15:50,045 --> 00:15:51,960
I think it was like a month ago

397
00:15:51,960 --> 00:15:53,410
or maybe a couple months ago.

398
00:15:54,990 --> 00:15:57,423
So can we see the bug yet?

399
00:15:59,790 --> 00:16:01,320
No!

400
00:16:01,320 --> 00:16:04,200
It turns out the backup of
my firmware got corrupted,

401
00:16:04,200 --> 00:16:07,230
which was awesome because
this bug exists in one

402
00:16:07,230 --> 00:16:09,240
but only one version of the firmware,

403
00:16:09,240 --> 00:16:12,363
not the one before it
and not the one after it.

404
00:16:12,363 --> 00:16:16,334
And it's just gone.

405
00:16:16,334 --> 00:16:19,230
Zyxel really effectively memory hold

406
00:16:19,230 --> 00:16:21,203
this backdoored firmware
from the internet.

407
00:16:21,203 --> 00:16:23,610
I feel really good about my Google fool

408
00:16:23,610 --> 00:16:25,620
and it is just gone.

409
00:16:25,620 --> 00:16:28,770
So I kind of sat around
and said, you know,

410
00:16:28,770 --> 00:16:30,600
what the hell do I do now?

411
00:16:30,600 --> 00:16:34,552
And I thought, I'll dm the researcher.

412
00:16:34,552 --> 00:16:37,950
His name's Niels Teusin on Twitter

413
00:16:37,950 --> 00:16:41,280
and he sent over his copy for the USG 40.

414
00:16:41,280 --> 00:16:43,320
And even though this wasn't
the model that I had,

415
00:16:43,320 --> 00:16:44,153
that's fine.

416
00:16:44,153 --> 00:16:46,744
I didn't want to load this

417
00:16:46,744 --> 00:16:48,903
onto a real device or anything.

418
00:16:50,700 --> 00:16:52,710
And so I extracted it like this.

419
00:16:52,710 --> 00:16:54,600
And since we already know the IOCs,

420
00:16:54,600 --> 00:16:55,800
we can just grep for them.

421
00:16:55,800 --> 00:16:57,120
And it's pretty easy.

422
00:16:57,120 --> 00:17:00,720
So you can see we grep for zyfwp

423
00:17:00,720 --> 00:17:02,850
and the first two files are winners,

424
00:17:02,850 --> 00:17:05,460
shadow.basic and password.basic.

425
00:17:05,460 --> 00:17:08,220
And remember, this is a
firmware for a device that

426
00:17:08,220 --> 00:17:09,600
maybe is never booted before,

427
00:17:09,600 --> 00:17:14,040
so these will become your Etsy
shadow, Etsy password files.

428
00:17:14,040 --> 00:17:18,390
And that hash right there in shadow.basic

429
00:17:18,390 --> 00:17:20,010
that's a good hash, you know,

430
00:17:20,010 --> 00:17:22,590
we're not looking at MD5 over here.

431
00:17:22,590 --> 00:17:24,656
And the other thing that
kind of struck me was,

432
00:17:24,656 --> 00:17:29,656
a match in Cap Wrap Serve,
which is in executable,

433
00:17:30,030 --> 00:17:31,500
and that seemed a little weird.

434
00:17:31,500 --> 00:17:34,770
So throw that into geiger two,

435
00:17:34,770 --> 00:17:39,770
and what you get is a function
that loads up this structure

436
00:17:40,020 --> 00:17:44,367
called FW info, and it plugs
the username in, zyfwp,

437
00:17:45,780 --> 00:17:48,300
and then it populates the password field.

438
00:17:48,300 --> 00:17:51,540
And this password is
otherwise really strong.

439
00:17:51,540 --> 00:17:52,590
So nice job guys,

440
00:17:52,590 --> 00:17:56,163
but maybe don't backdoor
all your firmwares with it.

441
00:17:57,330 --> 00:17:58,950
I don't know, that's just me.

442
00:17:58,950 --> 00:18:03,780
So continuing on, this is for someone else

443
00:18:03,780 --> 00:18:05,970
who might wanna pick up that mantle.

444
00:18:05,970 --> 00:18:07,350
Now the first thing I would do,

445
00:18:07,350 --> 00:18:10,350
if it were me, is I would
make a Python script

446
00:18:10,350 --> 00:18:13,020
and here is where the
deobfuscation function is,

447
00:18:13,020 --> 00:18:14,820
and here's the function that calls it.

448
00:18:14,820 --> 00:18:16,470
I am bad at MIPS.

449
00:18:16,470 --> 00:18:18,000
Boy, I cannot read that stuff,

450
00:18:18,000 --> 00:18:20,190
so I leave that as an exercise to somebody

451
00:18:20,190 --> 00:18:21,840
who's way better than that.

452
00:18:21,840 --> 00:18:23,970
But I would turn the
deobfuscation algorithm

453
00:18:23,970 --> 00:18:25,260
into a Python script,

454
00:18:25,260 --> 00:18:27,150
so you can just point
it at the firmware file

455
00:18:27,150 --> 00:18:28,530
and get the password.

456
00:18:28,530 --> 00:18:29,970
And I do hope somebody does this

457
00:18:29,970 --> 00:18:31,380
because it would be way better

458
00:18:31,380 --> 00:18:34,020
than this Rube Goldberg machine nonsense

459
00:18:34,020 --> 00:18:36,540
that I've kind of like
cobbled together here.

460
00:18:36,540 --> 00:18:40,470
And I did also mention that
I'm not releasing a tool,

461
00:18:40,470 --> 00:18:45,330
but if I'm giving you some
offsets and saying, go forth,

462
00:18:45,330 --> 00:18:46,410
how are you gonna do that,

463
00:18:46,410 --> 00:18:48,060
if you don't have anything to start with?

464
00:18:48,060 --> 00:18:50,253
'Cause remember I cut this thing open.

465
00:18:51,420 --> 00:18:54,583
Well, it turns out it was all
way easier than I made it.

466
00:18:54,583 --> 00:18:59,583
So the firmware releases
include the firmware files,

467
00:19:00,330 --> 00:19:04,080
the release notes, and the .ri file

468
00:19:04,080 --> 00:19:06,030
which is a recovery image.

469
00:19:06,030 --> 00:19:08,340
And you can blast that over a serial port

470
00:19:08,340 --> 00:19:11,250
if you've got your
firewall in a bad state.

471
00:19:11,250 --> 00:19:12,960
And it's unencrypted,

472
00:19:12,960 --> 00:19:14,580
so you can just throw it into binwalk

473
00:19:14,580 --> 00:19:17,730
and it's got fsextract , which is great.

474
00:19:17,730 --> 00:19:19,710
Now you all have fsextract

475
00:19:19,710 --> 00:19:21,633
and I'm not responsible for that.

476
00:19:22,590 --> 00:19:25,530
And I wanna thank HN Security
for pointing this out.

477
00:19:25,530 --> 00:19:27,000
It should have been obvious,

478
00:19:27,000 --> 00:19:31,950
but, you know, I don't claim
to be good at obvious things.

479
00:19:31,950 --> 00:19:35,040
And so if you wanna go that route,

480
00:19:35,040 --> 00:19:36,480
no firewalls need to be harmed

481
00:19:36,480 --> 00:19:38,553
in the process of your research.

482
00:19:39,450 --> 00:19:43,320
So here's their screenshot
of the binwalk.i file.

483
00:19:43,320 --> 00:19:46,290
You can see zld_fsextract is right there.

484
00:19:46,290 --> 00:19:47,700
And so yeah.

485
00:19:47,700 --> 00:19:51,450
Now we thank our firewalls
for their sacrifice

486
00:19:51,450 --> 00:19:53,250
and protecting me from just looking at

487
00:19:53,250 --> 00:19:55,113
what was literally right there.

488
00:19:56,760 --> 00:19:57,882
And the other thing that I would do,

489
00:19:57,882 --> 00:20:02,882
is I would run the user
land image through EMBA.

490
00:20:02,910 --> 00:20:04,980
EMBA's a really great
firmware analysis tool.

491
00:20:04,980 --> 00:20:08,850
It's still pretty new and
it's gotten really good,

492
00:20:08,850 --> 00:20:10,410
even in the short time it's been alive.

493
00:20:10,410 --> 00:20:13,350
So it'll generate this really
slick report at the end

494
00:20:13,350 --> 00:20:15,060
that shows everything that it found

495
00:20:15,060 --> 00:20:16,710
and it can find a lot.

496
00:20:16,710 --> 00:20:20,040
So it started out as this
text output only tool,

497
00:20:20,040 --> 00:20:22,380
and it would generate 15 different files

498
00:20:22,380 --> 00:20:25,560
of all kinds of different
categories of findings,

499
00:20:25,560 --> 00:20:27,780
which was good, but I mean it was dense.

500
00:20:27,780 --> 00:20:30,690
And so now it's got this
really sweet web based output

501
00:20:30,690 --> 00:20:32,850
that you can browse
locally, pointy, clicky,

502
00:20:32,850 --> 00:20:34,290
look at everything.

503
00:20:34,290 --> 00:20:35,640
And from our process above,

504
00:20:35,640 --> 00:20:38,580
it can do everything
after the unzip process,

505
00:20:38,580 --> 00:20:40,440
including the automated binwalk

506
00:20:40,440 --> 00:20:42,330
that check against known CBEs

507
00:20:42,330 --> 00:20:44,550
and even emulation of the target binaries

508
00:20:44,550 --> 00:20:47,730
for the whole spectrum of
static and dynamic analysis.

509
00:20:47,730 --> 00:20:50,400
So let's look at what things it found

510
00:20:50,400 --> 00:20:52,830
in this older firmware.

511
00:20:52,830 --> 00:20:56,850
Now the only thing I love more
than stir copy is mem copy.

512
00:20:56,850 --> 00:20:58,410
And the only thing I love more than that

513
00:20:58,410 --> 00:21:02,580
is a binary that'll call system
and has one or two of those.

514
00:21:02,580 --> 00:21:06,690
So I think libnetsnpmibs.so

515
00:21:06,690 --> 00:21:08,850
looks pretty interesting if I'm looking at

516
00:21:08,850 --> 00:21:11,583
the Venn diagram of
what calls those things.

517
00:21:13,170 --> 00:21:14,730
And the other thing that I can look at

518
00:21:14,730 --> 00:21:18,450
is file permissions and just
bad decisions related to those.

519
00:21:18,450 --> 00:21:21,660
So I see a lot of files
that can Sue it to just

520
00:21:21,660 --> 00:21:24,570
whatever permissions they want
and some of them make sense,

521
00:21:24,570 --> 00:21:26,550
but others definitely don't.

522
00:21:26,550 --> 00:21:30,791
So I'll give you Sue exec, makes sense.

523
00:21:30,791 --> 00:21:34,170
Pseudo.sue, totally yep, on board,

524
00:21:34,170 --> 00:21:35,640
that makes sense.

525
00:21:35,640 --> 00:21:37,380
Web author.cgi

526
00:21:37,380 --> 00:21:40,170
that's a weird one dynamic script.cgi,

527
00:21:40,170 --> 00:21:42,572
that sounds terrifying.

528
00:21:42,572 --> 00:21:45,480
Facebook, wifi.cgi,

529
00:21:45,480 --> 00:21:47,880
Why does that need to be root?

530
00:21:47,880 --> 00:21:52,860
And the two that I don't
really have any questions over

531
00:21:52,860 --> 00:21:54,990
is ping and trace root.

532
00:21:54,990 --> 00:21:56,520
I don't know why ping and trace root

533
00:21:56,520 --> 00:22:00,090
needs Sewed permissions, maybe
again, I'm not a Unix person,

534
00:22:00,090 --> 00:22:01,830
maybe somebody can help me with that,

535
00:22:01,830 --> 00:22:05,190
but that seems like you're
just asking for trouble.

536
00:22:05,190 --> 00:22:06,780
So the other thing,

537
00:22:06,780 --> 00:22:08,550
this is the last screen that I'll show

538
00:22:08,550 --> 00:22:09,810
that I really like is,

539
00:22:09,810 --> 00:22:12,330
it'll catalog your CVEs

540
00:22:12,330 --> 00:22:14,460
and give you a little more
information about those.

541
00:22:14,460 --> 00:22:17,460
So like it shows these three,
they're known exploited.

542
00:22:17,460 --> 00:22:19,800
It'll give you a whole
bunch of 10 out of tens,

543
00:22:19,800 --> 00:22:20,910
if you're looking for those,

544
00:22:20,910 --> 00:22:22,680
and it gives you the CVE number there.

545
00:22:22,680 --> 00:22:26,130
But my favorite part is if
there is a POC out there,

546
00:22:26,130 --> 00:22:27,330
it'll point you right at it.

547
00:22:27,330 --> 00:22:30,330
So what this helps you
in other products with,

548
00:22:30,330 --> 00:22:33,480
is if you are otherwise
running the latest firmware,

549
00:22:33,480 --> 00:22:37,380
but it's using old libraries
that are exploitable,

550
00:22:37,380 --> 00:22:40,290
this is the dead giveaway
that you might have

551
00:22:40,290 --> 00:22:41,793
something there to look at.

552
00:22:42,930 --> 00:22:47,930
And so it turns out EMBA on
WSL might not be a long way off

553
00:22:48,300 --> 00:22:50,730
'cause I was working with the
developer, Michael Messner,

554
00:22:50,730 --> 00:22:52,080
on how this can be done.

555
00:22:52,080 --> 00:22:55,380
And the older version of EMBA

556
00:22:55,380 --> 00:22:58,410
was really powerful and very good,

557
00:22:58,410 --> 00:23:01,260
but the newer version has
a dependency on docker

558
00:23:01,260 --> 00:23:04,350
and WSL on windows 10 has some
manner of incompatibility,

559
00:23:04,350 --> 00:23:06,480
so it's not on them.

560
00:23:06,480 --> 00:23:09,510
But the immediate answer was
to load up in a ubuntu to VM

561
00:23:09,510 --> 00:23:10,770
on windows 10.

562
00:23:10,770 --> 00:23:12,900
And that felt maybe like a heavier lift

563
00:23:12,900 --> 00:23:14,310
than it should have been.

564
00:23:14,310 --> 00:23:16,950
But they added some
improvements, not only for that,

565
00:23:16,950 --> 00:23:19,680
but also based on the
decrypted user mode images

566
00:23:19,680 --> 00:23:20,730
that otherwise would've been

567
00:23:20,730 --> 00:23:24,063
inaccessible to them without
running through all these.

568
00:23:26,760 --> 00:23:27,593
And the next thing,

569
00:23:27,593 --> 00:23:29,433
or I guess the last thing
that I'd pay attention to is,

570
00:23:29,433 --> 00:23:32,970
when Zyxel starts changing things.

571
00:23:32,970 --> 00:23:35,550
So I love this diagram and a prior talk

572
00:23:35,550 --> 00:23:36,960
and I couldn't find it again.

573
00:23:36,960 --> 00:23:38,280
So if you know who made it,

574
00:23:38,280 --> 00:23:40,320
please tag me on Twitter or whatever,

575
00:23:40,320 --> 00:23:42,240
so I can cite them because I really love

576
00:23:42,240 --> 00:23:44,970
this kind of paradigm here

577
00:23:44,970 --> 00:23:47,640
because in theory, we're
over here on the left

578
00:23:47,640 --> 00:23:50,100
where we can get the Plain-Text
version of the format

579
00:23:50,100 --> 00:23:51,750
and then there'll be a transition

580
00:23:52,950 --> 00:23:54,510
and then it'll be encrypted again,

581
00:23:54,510 --> 00:23:56,360
and we won't be able to see anything.

582
00:23:59,280 --> 00:24:01,290
But to get here in the middle,

583
00:24:01,290 --> 00:24:02,700
the firm where they've published,

584
00:24:02,700 --> 00:24:06,093
will have to understand the
format changes going forward,

585
00:24:07,080 --> 00:24:11,010
and it will itself be
vulnerable to this process here.

586
00:24:11,010 --> 00:24:13,920
And there'll be dead giveaway
language as to indicate

587
00:24:13,920 --> 00:24:16,140
which version has the new stuff.

588
00:24:16,140 --> 00:24:18,060
You can only install version X

589
00:24:18,060 --> 00:24:20,190
before you can install
version Y and beyond

590
00:24:20,190 --> 00:24:22,440
in the future, in future updates

591
00:24:22,440 --> 00:24:24,189
because firmware before version X

592
00:24:24,189 --> 00:24:27,393
won't know how to handle
the new update mechanism,

593
00:24:30,930 --> 00:24:33,090
because it won't conform
to the old scheme.

594
00:24:33,090 --> 00:24:36,330
And so once you trace
the upgrade flow here

595
00:24:36,330 --> 00:24:38,880
in this transitional firmware,

596
00:24:38,880 --> 00:24:42,060
you'll know how to decrypt
the new protection scheme

597
00:24:42,060 --> 00:24:43,680
and for whenever that happens,

598
00:24:43,680 --> 00:24:46,203
I leave that as an exercise
for the listener too.

599
00:24:52,650 --> 00:24:55,290
All right, so this went by
as I was making these slides.

600
00:24:55,290 --> 00:24:58,350
And I think stack smashing
is presenting this year,

601
00:24:58,350 --> 00:25:01,290
somewhere here, but I
thought it good to point out,

602
00:25:01,290 --> 00:25:04,200
and I guess I've seen some
bad firmware encryption,

603
00:25:04,200 --> 00:25:05,250
like static XOs,

604
00:25:05,250 --> 00:25:06,300
like one bite XOs

605
00:25:06,300 --> 00:25:07,770
or maybe even four byte XOs

606
00:25:07,770 --> 00:25:08,940
'cause they're super clever,

607
00:25:08,940 --> 00:25:12,180
or rolling XOs, none
of which is encryption,

608
00:25:12,180 --> 00:25:14,130
but you get my point.

609
00:25:14,130 --> 00:25:17,850
But I guess what we have here,

610
00:25:17,850 --> 00:25:19,170
isn't the worst,

611
00:25:19,170 --> 00:25:22,290
but man, if you're shipping
backdoor accounts, I don't know,

612
00:25:22,290 --> 00:25:23,610
maybe Dave's not wrong

613
00:25:23,610 --> 00:25:25,510
and it's just kind of window dressing.

614
00:25:26,490 --> 00:25:27,930
So with that I say,

615
00:25:27,930 --> 00:25:31,530
Happy Bug Hunting in this
firmware format and others.

616
00:25:31,530 --> 00:25:34,320
And just to kind of
recap what we went over,

617
00:25:34,320 --> 00:25:36,900
I talked the tiniest bit about myself

618
00:25:36,900 --> 00:25:38,970
and how I got into all this stuff.

619
00:25:38,970 --> 00:25:41,820
We covered a few different
methods of analysis

620
00:25:41,820 --> 00:25:43,350
to figure all this out.

621
00:25:43,350 --> 00:25:48,350
And what that got us and what
continuing forward for you

622
00:25:48,870 --> 00:25:50,490
could get you in the future.

623
00:25:50,490 --> 00:25:52,410
And before I take any questions,

624
00:25:52,410 --> 00:25:55,320
I want to thank my friends and family

625
00:25:55,320 --> 00:25:58,020
and especially the DEF CON CFP Review Team

626
00:25:58,020 --> 00:25:59,160
because I mean, without them

627
00:25:59,160 --> 00:26:00,664
I just wouldn't be here.

628
00:26:00,664 --> 00:26:04,500
And Niels Teusink for
responding to a message

629
00:26:04,500 --> 00:26:05,790
from an internet random,

630
00:26:05,790 --> 00:26:07,410
literally outta nowhere,

631
00:26:07,410 --> 00:26:09,150
and Michael Messner for EMBA,

632
00:26:09,150 --> 00:26:11,280
the author of every other tool mentioned

633
00:26:11,280 --> 00:26:14,070
because I kind of burn through a lot

634
00:26:14,070 --> 00:26:16,320
and I'll call them out separately to the

635
00:26:16,320 --> 00:26:19,502
Ghidra project because
decompilers are free now

636
00:26:19,502 --> 00:26:21,180
unless you're an American

637
00:26:21,180 --> 00:26:23,532
'cause you well paid for that shit.

638
00:26:23,532 --> 00:26:25,198
(audience laughs)

639
00:26:25,198 --> 00:26:26,942
And with that, I'll take any questions,

640
00:26:26,942 --> 00:26:29,212
but I thank you for your time tonight.

641
00:26:29,212 --> 00:26:32,212
(audience applauds)