Hacking Embedded Devices: For Fun & Profit.

I began a research project into a popular consumer broadband device over 12 months ago. The end result of that research was the construction of a 0day exploit that allowed for remote root compromise of a widely deployed consumer device, the SAGEM F@ST2504 Sky Broadband router (photographed to the right) which was provided to all Sky Broadband consumers since 2007. Additionally it raised concerns about the abilities of service providers to invade on a users privacy by enabling traffic monitoring capabilities and identified undocumented features and users. The research eventually became a presentation which was shown to former colleagues at an internal security conference and later privately to a second group of security professionals where it was well received. I discovered that many embedded devices suffer from the same types of flaws and can be exploited in a similar way and as such my material used in this project can be used as a methodology as well as how to gain an understanding into how a remote 0day exploit is discovered and developed. The device I assessed (like many others) made use of GPL source code and the security vulnerabilities identified proves that this code has been modified as the original source code is not susceptible to attack highlighting the importance of code used under the GPL being made available for peer-review. My exploit introduces a novel way of creating a connect back shell through syslog on embedded devices. As personal desktop environments become hardened against common threats attackers are likely to begin attacking the next weakest link in the chain which will often be an embedded device susceptible to trivial remote compromise such as in the case of Sky Broadband Sagem F@ST2504.

This particular example is a classic embedded device vulnerability showing how enumeration of device and information leaks can be leveraged alongside an exploitable code execution class to gain complete root access to a device which was previously locked down entirely from the user. I was unable to contact the vendor to discuss the security issues as a consumer and it took me several months to eventually furnish the affected parties with the vulnerability information. At this time I am unaware of any fix for the 0day presented in this research, however as the methodologies and techniques used for exploitation are beneficial to other security researchers I am now publishing the content. Once the embedded device had been exploited - up until exploitation the device prevented users from changing settings (even those such as DNS server) - it was possible to discover that the device had backdoor accounts and more worryingly had the ability to sniff and capture packets locally, including on the consumers wired/wireless side of the network with a built-in "tcpdump" which the attacker could also take full advantage of.
You can view my presentation slides which detail the vulnerability, methodologies and exploit here. You may view an uploaded video of this presentation given by me here. I will not be releasing any exploit code for this vulnerability, sufficient information is available in the presentation for anyone wishing to reconstruct the flaw or to develop their own exploit. This material is being released with the intention that it helps others to analyze and identify flaws within embedded devices.