Examination of mydlink™ home devices - Revision history

NKirnbauer: fixed link

2024-11-19T14:42:03Z

fixed link

← Older revision		Revision as of 14:42, 19 November 2024
Line 1,927:		Line 1,927:

	<li>https://eu.dlink.com/uk/en/products/dch-g020-mydlink-connected-home-hub</li>		<li>https://eu.dlink.com/uk/en/products/dch-g020-mydlink-connected-home-hub</li>
	<li>https://eu.dlink.com/~~landing~~/products/dch-107kt-smart-home-security-kit</li>		<li>https://eu.dlink.com/uk/en/products/dch-107kt-smart-home-security-kit</li>

	<li>https://web.archive.org/web/20131226002253/http://www.sourcesec.com/2010/01/</li>		<li>https://web.archive.org/web/20131226002253/http://www.sourcesec.com/2010/01/</li>

NKirnbauer: fixed link

2024-11-19T14:39:37Z

fixed link

← Older revision		Revision as of 14:39, 19 November 2024
Line 1,923:		Line 1,923:
	<h2>References</h2>		<h2>References</h2>
	<ul>		<ul>
	<li>~~ftp~~://ftp.dlink.de/dch/</li>		<li>https://ftp.dlink.de/dch/</li>
	<li>https://eu.mydlink.com/content/productfamily</li>		<li>https://eu.mydlink.com/content/productfamily</li>

NKirnbauer: expired links changed with links from wayback machine

2024-09-10T17:40:03Z

expired links changed with links from wayback machine

← Older revision		Revision as of 17:40, 10 September 2024
Line 1,931:		Line 1,931:
	<li>https://web.archive.org/web/20131226002253/http://www.sourcesec.com/2010/01/</li>		<li>https://web.archive.org/web/20131226002253/http://www.sourcesec.com/2010/01/</li>
	<li>https://regmedia.co.uk/2016/11/07/dlink_hnap_captcha.pdf</li>		<li>https://regmedia.co.uk/2016/11/07/dlink_hnap_captcha.pdf</li>
	<li>http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug/</li>		<li>http://web.archive.org/web/20201105010446/http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug/</li>
	<li>http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/</li>		<li>http://web.archive.org/web/20200615050158/http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/</li>
	<li>https://fccid.io/KA2</li>		<li>https://fccid.io/KA2</li>
	<li>https://fccid.io/KA2CHG020A1</li>		<li>https://fccid.io/KA2CHG020A1</li>

Ikramer at 17:43, 12 March 2024

2024-03-12T17:43:00Z

← Older revision		Revision as of 17:43, 12 March 2024
Line 1,941:		Line 1,941:

	</div>		</div>

			[[Category:Documentation]]
			[[Category:Pentesting]]

JPDoe: Minor: Bug fixes. Finalization before returning the equipment.

2020-06-19T12:55:56Z

Minor: Bug fixes. Finalization before returning the equipment.

Show changes

JPDoe at 12:13, 18 May 2020

2020-05-18T12:13:29Z

← Older revision		Revision as of 12:13, 18 May 2020
Line 1,944:		Line 1,944:
	<li>https://www.sparkfun.com/tutorials/215</li>		<li>https://www.sparkfun.com/tutorials/215</li>
	</ul>		</ul>

	~~[[Category:Documentation]]~~

JPDoe: 'Final' version: Added "Syntaxhighlighting", "Bootlog", "Bootloader", "UART pin assignment", remove errors, cleanup, and more..

2020-04-25T19:35:22Z

'Final' version: Added "Syntaxhighlighting", "Bootlog", "Bootloader", "UART pin assignment", remove errors, cleanup, and more..

Show changes

JPDoe: Added link to "WPA/WPA2 PSK deauthentication attack".

2020-04-25T16:12:24Z

Added link to "WPA/WPA2 PSK deauthentication attack".

← Older revision		Revision as of 16:12, 25 April 2020
Line 458:		Line 458:

	<h4>Deauthentication Attack</h4>		<h4>Deauthentication Attack</h4>
	<p style="text-align: justify">The [[WPA/WPA2 PSK deauthentication attack with aircrack-ng\|attack]] in this examination was carried out using the tool [[aircrack-ng]]. Since the setup was already in a working condition, the client, in this case the motion sensor, was forced to deauthenticate from the access point, in this case being the hub. The goal is to force the motion sensor to no longer associate with the access point and ultimately causing reauthentication using aireplay-ng. Furthermore, it is possible to capture the new authentication handshake.		<p style="text-align: justify">The [[WPA/WPA2 PSK deauthentication attack with aircrack-ng\|attack]] in this examination was carried out using the tool [[aircrack-ng]]. Since the setup was already in a working condition, the client, in this case the motion sensor, was forced to deauthenticate from the access point, in this case being the hub. The goal is to force the motion sensor to no longer associate with the access point and ultimately causing reauthentication using aireplay-ng. Furthermore, it is possible to capture the new authentication handshake. Through this WPA/WPA2-PSK was obtained and using [[John the Ripper]] or [[Hashcat]] it was attempted to crack the password with a suitable word list. More about this process can be found in the article [[WPA/WPA2 PSK deauthentication attack]].</div>

	~~<h4>Brute-Force PSK</h4>~~
	Through this WPA/WPA2-PSK was obtained and using [[John the Ripper]] or [[Hashcat]] it was attempted to crack the password with a suitable word list.</div>

	<span style="font-size: 50px; line-height: 50px; padding-left: 10px">⚒</span>		<span style="font-size: 50px; line-height: 50px; padding-left: 10px">⚒</span>

JPDoe: Minor fix: Wrong content

2020-04-25T13:37:16Z

Minor fix: Wrong content

← Older revision		Revision as of 13:37, 25 April 2020
Line 935:		Line 935:

	<p style="text-align: justify">The Bootlog contains messages which are issued by the bootloader, kernel, OS, or applications via standard output (stdout) or standard error (stderr) streams during the booting phase of the device, which presents the first wave of information to be processed as it already defines entry points and influences subsequent analysis steps. The information contained in the bootlog can be system status; available firmware images; kernel version and command-line; busybox version; processor and board information; memory and storage types used; network interfaces and configuration; protocols or applications running; firmware and hardware version; MTD device partitions and file systems. These are just a few examples, but the developers can implement ridiculous things. From printing configurations and custom developer messages to clear-text credentials, much information can be leaked this way, which makes up a large part of the results of this case study.</p>		<p style="text-align: justify">The Bootlog contains messages which are issued by the bootloader, kernel, OS, or applications via standard output (stdout) or standard error (stderr) streams during the booting phase of the device, which presents the first wave of information to be processed as it already defines entry points and influences subsequent analysis steps. The information contained in the bootlog can be system status; available firmware images; kernel version and command-line; busybox version; processor and board information; memory and storage types used; network interfaces and configuration; protocols or applications running; firmware and hardware version; MTD device partitions and file systems. These are just a few examples, but the developers can implement ridiculous things. From printing configurations and custom developer messages to clear-text credentials, much information can be leaked this way, which makes up a large part of the results of this case study.</p>

	~~<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #a7d7f9; background-color: white; calc(100% - 12px); overflow:auto;">~~
	~~<div style="font-weight:bold;line-height:1.6;">ⓘ</div>~~
	~~<div class="mw-collapsible-content">~~
	~~<div style="font-size: 12px !important">~~
	~~<nowiki>~~
	~~## Booting image at 9f2b0000 ...~~
	~~Image Name: Linux Kernel Image~~
	~~Created: 2018-01-03 8:34:42 UTC~~
	~~Image Type: MIPS Linux Kernel Image (compressed)~~

	~~Starting kernel ...~~

	~~Linux version 2.6.31 (root@minlee-Mint17) (gcc version 4.3.3 (GCC)) #1 Wed Jan 3 16:27:59 CST 2018~~
	~~args: console=ttyS0,115200, root=31:08, rootfstype=squashfs, init=/sbin/init~~
	~~CPU revision is: 00019374 (MIPS 24Kc)~~

	~~squashfs: version 4.0 (2009/01/31) Phillip Lougher~~
	~~JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.~~

	~~Creating 12 MTD partitions on "ath-nor0":~~
	~~0x000000000000-0x000000010000 : "u-boot"~~
	~~0x000000010000-0x000000020000 : "ART"~~
	~~0x000000020000-0x000000030000 : "MP"~~
	~~0x000000030000-0x000000040000 : "config"~~
	~~0x000000040000-0x000000050000 : "log"~~
	~~0x000000050000-0x000000130000 : "bk_uImage"~~
	~~0x000000130000-0x0000002b0000 : "bk_rootfs"~~
	~~0x0000002b0000-0x000000390000 : "uImage"~~
	~~0x000000390000-0x000000780000 : "rootfs"~~
	~~0x000000050000-0x0000002b0000 : "bk_firmware"~~
	~~0x0000002b0000-0x000000780000 : "firmware"~~
	~~0x000000780000-0x000000800000 : "mydlink"~~

	~~nf_conntrack version 0.5.0 (512 buckets, 2048 max)~~
	~~TCP cubic registered~~
	~~IPv6 over IPv4 tunneling driver~~
	~~Bridge firewalling registered~~
	~~VFS: Mounted root (squashfs filesystem) readonly on device 31:8.~~
	~~init started: BusyBox v1.21.1--LSDK-10.1.432 (2018-01-03 16:30:16 CST)~~
	~~starting pid 135, tty '': '/etc/rc.d/rcS'~~
	~~QCA953x Watchdog Timer enabled (30 seconds, nowayout)~~

	~~wifi0: Atheros: mem=0xb8100000~~
	~~VAP device ath1, ath0 created~~

	~~Please press Enter to activate this console.~~

	~~starting pid 170, tty '/dev/ttyS0': '/bin/login'~~
	~~MotionSensorDLink login: root~~
	~~Password:~~
	~~</div>~~
	~~</div>~~
	~~</div>~~

	<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #a7d7f9; background-color: white; calc(100% - 12px); overflow:auto;">		<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #a7d7f9; background-color: white; calc(100% - 12px); overflow:auto;">

JPDoe at 15:14, 23 February 2020

2020-02-23T15:14:19Z

← Older revision		Revision as of 15:14, 23 February 2020
Line 458:		Line 458:

	<h4>Deauthentication Attack</h4>		<h4>Deauthentication Attack</h4>
	<p style="text-align: justify">The attack in this examination was carried out using the tool [[aircrack-ng]]. Since the setup was already in a working condition, the client, in this case the motion sensor, was forced to deauthenticate from the access point, in this case being the hub. The goal is to force the motion sensor to no longer associate with the access point and ultimately causing reauthentication using aireplay-ng. Furthermore, it is possible to capture the new authentication handshake.		<p style="text-align: justify">The [[WPA/WPA2 PSK deauthentication attack with aircrack-ng\|attack]] in this examination was carried out using the tool [[aircrack-ng]]. Since the setup was already in a working condition, the client, in this case the motion sensor, was forced to deauthenticate from the access point, in this case being the hub. The goal is to force the motion sensor to no longer associate with the access point and ultimately causing reauthentication using aireplay-ng. Furthermore, it is possible to capture the new authentication handshake.

	<h4>Brute-Force PSK</h4>		<h4>Brute-Force PSK</h4>