JAILBREAKING SOHO ROUTERS Dennis CPLUG | 2010 Aug 10

Thank you!  Jim Anteil - Asus router loan for demos  Open source programming& integration  Asterisk digital voice solutions  Customer Relationship Management software

Thank you!  tapestry technologies, LLC – food sponsor  Expertise: DoD STIG (Security Technical Implementation Guide) Security Training Technology Management Partner – full-service technology acquisition, integration and management services

Terms  Firmware – “a term often used to denote the fixed, usually rather small, programs and/or data structures that internally control various electronic devices” – Wikipedia.org  TFTP – trivial file transfer protocol; used to load firmware to a lot of routers/devices with little RAM  JTAG – troubleshooting port useful for fixing “bricked” (ie: corrupted) devices, converter required

Alternative firmware – WHY?  Extend functionality beyond stock firmware  OpenVPN – server and client endpoint  Advanced QoS – service, MAC and port-based  VLAN  SSH server

Alternative Firmware – WHY?  Advanced wireless functionality – AP, client bridge, repeater, WDS  SIP proxy  More advanced port-forwarding and triggering (origination lock-out)  Network traffic graphing

Alternative Firmware – WHY?  Dynamic DNS – sane updates  Hotspot portal / captive portal  Transmit power control / boost (don’t burn out!)  Site survey & Rx/Tx antenna selection

Compatible Hardware  Demo of 3 different models in this talk  Wireless-G router: WRT54G (v1.1) – WRT54GL is a known good candidate, regardless of version  Wireless-G access point: EOC-1650 – requires activation of DD-WRT (~$30 US)  Wireless-N router: Asus RT-N16

WRT54G / WRT54GL  ~$60 shipped, hard to find in brick and mortar  1 WAN, 4 LAN  Not all versions of WRT54G are compatible!  WRT54GL v1.0 / 1.1 compatible  BCM5352 – 200 MHz  RAM: 16MB  FLASH: 4MB  100 mW max (?)

Senao / Engenius EOC-1650  ~$50 shipped, hard to find brick and mortar  Wireless AP with internal 7dBi panel and 5 dBi external SMA omni antenna (selectable), 300’ PoE injector included, 200 mW max radio  Requires purchase of DD-WRT Professional  Atheros AR2315 – 180 Mhz  RAM: 32MB  Flash: 8MB

Asus RT-N16  ~$95 shipped  Wireless N router  1 WAN, 4 LAN, 2 USB  BCM4718A – 500 MHz  RAM: 128 MB  Flash: 32 MB

Alternative Firmware  We will cover:  Tomato  OpenWRT  DD-WRT

Alternative Firmware  Also available…  FreeWRT “meant to be an appliance development kit (ADK) especially designed for embedded system developers and advanced users.”

Tomato – PolarCloud.com  Simple replacement for Linksys, Buffalo, BCMxxx  Extends Linksys WRT54GL GPL firmware  License ? – author’s permission?  Simpler of the 3 with some powerful features  Linksys WRT54G v1-4, GS v1.-4, GL, Buffalo G54/G54s, Asus WL500G

OpenWRT – OpenWRT.org  GPL license  Latest version: Backfire (v10.03)  Very large HCL (hardware compatibility list)  Perhaps a bit more complicated, as many functions as command-line only

DD-WRT – DD-WRT.com  Nice HCL database search and compatibility  Lots of functionality, 99% GUI-driven  Controversial - “GPL”; does not follow GPL 100%, accusations of stolen code, encrypted GUI code  Commercial version available

HCL – Am I compatible?  Tomato  OpenWRT  DD-WRT database

Demo Time!  GUI of Tomato, OpenWRT and DD-WRT