Comments on: D-link firewall teardown and vulnerability https://www.epanorama.net/blog/2013/10/15/d-link-firewall-teardown-and-vulnerability/ All about electronics and circuit design Sun, 05 Apr 2026 13:29:12 +0000 hourly 1 http://wordpress.org/?v=3.9.14 By: Tomi Engdahl https://www.epanorama.net/blog/2013/10/15/d-link-firewall-teardown-and-vulnerability/comment-page-1/#comment-34576 Tue, 15 Oct 2013 07:36:01 +0000 http://www.epanorama.net/blog/?p=22412#comment-34576 Reverse Engineering a D-Link Backdoor
http://hackaday.com/2013/10/14/reverse-engineering-a-d-link-backdoor/

He fired up binwalk to extract the SquashFS file system, then opened the router webserver on the multi-processor disassembler/debugger IDA. [Craig] discovered that the webserver is actually a modified version of thttpd, providing the administrative interface for the router. As you can see in the picture above, it seems Alphanetworks (a spin-off of D-Link) performed the modifications.

]]> By: Tomi Engdahl https://www.epanorama.net/blog/2013/10/15/d-link-firewall-teardown-and-vulnerability/comment-page-1/#comment-34575 Tue, 15 Oct 2013 07:28:10 +0000 http://www.epanorama.net/blog/?p=22412#comment-34575 D-Link to padlock router backdoor by end of October
The backdoor lets attackers change a router configuration without authenticating
http://www.computerworld.com/s/article/print/9243201/D_Link_to_padlock_router_backdoor_by_end_of_October

D-Link will address by the end of October a security issue in some of its routers that could allow attackers to change the device settings without requiring a username and password.

The issue consists of a backdoor-type function built into the firmware of some D-Link routers that can be used to bypass the normal authentication procedure on their Web-based user interfaces.

“If your browser’s user agent string is ‘xmlset_roodkcableoj28840ybtide’ (no quotes), you can access the web interface without any authentication and view/change the device settings,”

When read in reverse, the last part of this hard-coded value is “edit by 04882 joel backdoor.”

D-Link will release firmware updates to address the vulnerability in affected routers by the end of October, the networking equipment manufacturer said via email.

According to Heffner, the affected models likely include D-Link’s DIR-100, DI-524, DI-524UP, DI-604S, DI-604UP, DI-604+, TM-G5240 and possibly DIR-615.

]]>