Exploiting Consumer Networking Hardware Start To Finish

The talk covers how cheap consumer networking gear can still be attacked after its firmware has vanished from the vendor's website. The speaker starts with the kit used for board-level work, including logic analyzers, a multi-function bus tool, a JTAG pin-finding device, chip clips and a digital microscope. The talk then explains how to spot UART and JTAG pins, use a continuity check to find ground, and connect to a serial console.

From there the focus moves to getting the firmware. The methods shown include downloading images from vendor sites, reading flash chips directly with clips, and copying the filesystem from a live root shell over TFTP, netcat or a USB drive. Unpacking images with Binwalk leads to the common embedded filesystems, and NVRAM is presented as a useful place to find configuration data and credentials. A case study of a low-cost device with an open telnet root shell and a weak default password shows how one backdoor can repeat across a product line. Encrypted images are handled with a brute-force approach against simple keys.

The final section covers a remote buffer overflow in a CGI handler found through IDA. The speaker reproduces it by emulating MIPS userland under QEMU with an OpenWrt kernel and an ext4 root filesystem, then shows automated analysis with EMBA. The talk closes with defensive measures such as signed images, secure boot, closed debug ports and hardened configuration.