OpenWRT Close Call. - techriot (inlägg med hubzilla) - techriot@hubzilla.eskimo.com

Channel Apps

Channel About Photos Files Calendar Gallery Wikis

System Apps

Directory Help

IRC Chat Language

Like Us Public Stream Random Channel Report Bug Search

techriot Posting with Hubzilla

techriot@hub.natehiggers.org

techriot@hub.netzgemeinde.eu (Posting with Hubzilla)

Location:: Texas

USA

Hometown:: Fairbanks, AK

Gender:: Male

Status:: Divorced

Homepage:: XMPP: agentcasey@movim.eu https://blog.natehiggers.org gemini://gemini.natehiggers.org gopher://gopher.natehiggers.org/

Welcome to Hubzilla.Eskimo.Com

Home of Censorship Free Hosting

Please tell your friends about hubzilla.eskimo.com and friendica.eskimo.com.

OpenWRT Close Call.

Mon, 09 Dec 2024 03:54:45 -0800

Carter Braxton

techriot@hub.natehiggers.org

OpenWRT Close Call.

Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision & Command Injection.

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router. After accessing the LuCI, which is the web interface of OpenWrt, I noticed that there is a section called Attended Sysupgrade, so I tried to upgrade the firmware using it. After reading the description, I found that it states it builds new firmware using an online service.

#OpenWRT #Routers #Firmware #Open_Source #Embed #Devices #Operating_Systems

Report Bug