Hacking Transcend WiFi SD Cards
haxit.blogspot.com
haxit.blogspot.com
This is especially scary as some of these teams work on internet-facing pieces of hardware - home routers/gateways, etc. One cool weekend project to have is trying to get hold of an image of the firmware of your home router, run binwalk on it, try to extract the filesystem, and count the number of remote exploits you can spot in the CGI perl scripts (like they are, in 99% of the cases) found there. Yet another reason to run OpenWRT ;).
I think it's a mental thing: most people writing code never think "how could this go wrong", since they assume that they don't make mistakes. If you don't have a healthy fear of the code you write, you're not going to test the corner cases or not write complex features.
Ultimately, I'm not complaining, because buggy software is great in the context of devices that try to prevent you from doing something with your own property. I especially encourage people to write their system-level software in C and use lots of strcpy calls. It ensures that I can root my phone even though the carrier doesn't want me to.
Reminds me of claims of deliberate backdoors. Of course, these can often be used for bad things too.
We were all there once. It's a stage you hit when learning to program. Some of us passed through it, while others simply remain there forever.
I don't think they developers of Android, iOS, or the PS3 (and many others) were using insecure coding practices. They still got rooted over and over again.
Homework question: What's running on your blu-ray player?
[tries to keep straight face, fails utterly]
These memory cards are super fun and I've been meaning to pick another up to give it another go.
Thank you for your great piece of software.
Does anyone know whether Transcend provides source code [0] upon request? The EULA in the user manual for the product [1] mentions that it might contain "GPL Components", but I could not find any additional details.
[0]: http://www.busybox.net/license.html
[1]: http://www.transcend-info.com/files/Manual/WiFiSD_Manual_v1....
I thought only PHP did things like that :)
I hope this is disabled in mod_perl? Because if not I need to let someone know they need to audit their code.
PS. I get how useful this is, and it's well documented, but this functionality should be in the ancillary function (i.e. used when needed), not in the default one.
Moreover, this isn't a Perl issue. I can think of ways to do similarly I'll advised things with C#'s process.start or C/C++'s System command.
> Moreover, this isn't a Perl issue. I can think of ways to do similarly I'll advised things with C#'s process.start or C/C++'s System command.
Obviously every language has ways to cause this. It's just that open is the default command. This extra functionality should be in a openshell command or something, and the regular open not have it. (And yes I'm aware it's way too late to change it.)
the most simple way of starting the fun:
Create a file called autorun.sh on the card, put
telnetd -l /bin/sh &
in that file and boom. telnet 192.168.11.254 and enjoy.
I don't read French or Japanese but even the shell outputs are interesting reads.
Because if it did, it would be an interesting choice for pen testing. You could recase it, and it's small enough that properly installed and configured, it would be difficult to find. Processor is fast enough to get some cool tricks going.
Of course, it's possible some clever kernel hacker will get those working on the AR6003 at some point, which would open up this, as well as a bunch of devices, to some cool uses.
In the same vein, though I can't find the video for it right now: http://www.khanfu.com/m/plain/29/event/1978 (this was also presented at Defcon 21)
Do you think you could run owncloud or something similar to use it as a sort of wireless flash drive?
"Oh sure I've got an SD card you can borrow..."