Tear Down This Zywall: Breaking Open Zyxel Encrypted Firmware
Jay Lagorio demonstrates defeating proprietary encryption on Zyxel Zywall security gateway firmware, extracting executables to discover critical zero-days.
Summary
The Barrier of Encrypted Embedded Firmware
Hardware manufacturers increasingly distribute encrypted firmware updates to thwart vulnerability research and protect proprietary software implementations.
Analyzing Zyxel's Encrypted Firmware Architecture
Jay Lagorio investigates the update packaging used across Zyxel Zywall enterprise firewalls, analyzing how decryption occurs inside device memory.
Extracting Hardware Keys and Emulating the Decryption Engine
Lagorio demonstrates dumping bootloader memory via hardware debug interfaces, extracting AES decryption keys, and building an automated firmware unpacker.
Uncovering Zero-Day Vulnerabilities in Unpacked Binaries
The author showcases discovering critical unauthenticated vulnerabilities in the decrypted web management daemon and shares remediation advice.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Main Stage·41 min
Jeroen 'Jeroen' Domburg
Demonstrates hardware hacking and reverse engineering to run custom Linux kernels and open software on inexpensive USB webcams.
Main Stage·42 min
Mark Omo · James Rowley
Reverse engineers electronic gun safes and commercial digital vaults, demonstrating effortless physical and electromagnetic bypasses across leading brands.