Hacking travel routers like it's 1999

Digital Nomad Security

Traveling security researchers need internet safety like anyone else. The HooToo TM06 travel router was purchased to create a secure internet enclave while traveling globally.

Vulnerability Discovery

Fuzzing and reverse engineering revealed severe memory corruption vulnerabilities. Despite employing exploitation mitigations, the device lacks critical protections like NX-Stack/Heap and canaries.

Exploitation Bypass

Two memory corruption vulnerabilities are exploited to achieve arbitrary shellcode execution. Mitigation bypass techniques show what protections should have been employed but were missing.

IoT Security Implications

The research highlights the poor security state of IoT devices like travel routers. Detailed methodology for discovering and exploiting embedded systems is valuable for security of IoT and MIPS-based devices.