Re:Backdoor found in Linksys, Netgear Routers
by potatolicious on Wednesday January 01, 2014 @07:58PM
(#6997601)
I don't think I get the whole thing either, but my impression is:
- Download image for modem firmware.
- Extract the filesystem from the image by hacking up an open source tool. This represents all the files on-disk on the modem.
- Search the file system for references to the suspicious port. Locate binary that listens on said port.
- Disassemble binary, figure out the protocol/format of messages it's expecting to hear on suspicious port.
- Brute force the effect of sending messages by sending messages to said port with the header it's expecting, and different permutations of payloads? (I'm not sure about this part, I might be making shit up)
- Using this brute forcing figure out what payloads do what and map out what this backdoor listener can do.
- Download image for modem firmware.
- Extract the filesystem from the image by hacking up an open source tool. This represents all the files on-disk on the modem.
- Search the file system for references to the suspicious port. Locate binary that listens on said port.
- Disassemble binary, figure out the protocol/format of messages it's expecting to hear on suspicious port.
- Brute force the effect of sending messages by sending messages to said port with the header it's expecting, and different permutations of payloads? (I'm not sure about this part, I might be making shit up)
- Using this brute forcing figure out what payloads do what and map out what this backdoor listener can do.