Jailbreak SOHO Routers

Download as ppt, pdf, or txt
Download as ppt, pdf, or txt
You are on page 1of 18

JAILBREAKING SOHO ROUTERS

Dennis Little @ CPLUG | 2010 Aug 10

Thank you!

Jim Capp @ Anteil - Asus router loan for demos http://www.Anteil.com


Open

source programming & integration


digital voice solutions Relationship Management software

Asterisk

Customer

Thank you!

tapestry technologies, LLC food sponsor http://TapestryTech.com


Expertise:
DoD

STIG (Security Technical Implementation Guide) Training

Security

Technology

Management Partner full-service technology acquisition, integration and management services

Terms

Firmware a term often used to denote the fixed, usually rather small, programs and/or data structures that internally control various electronic devices Wikipedia.org TFTP trivial file transfer protocol; used to load firmware to a lot of routers/devices with little RAM JTAG troubleshooting port useful for fixing bricked (ie: corrupted) devices, converter required

Alternative firmware WHY?

Extend functionality beyond stock firmware


OpenVPN

server and client endpoint

Advanced

QoS service, MAC and port-based

VLAN

SSH

server

Alternative Firmware WHY?


Advanced

wireless functionality AP, client bridge, repeater, WDS proxy

SIP

More

advanced port-forwarding and triggering (origination lock-out) traffic graphing

Network

Alternative Firmware WHY?


Dynamic

DNS sane updates

Hotspot

portal / captive portal power control / boost (dont burn

Transmit

out!)
Site

survey & Rx/Tx antenna selection

Compatible Hardware

Demo of 3 different models in this talk


Wireless-G

router: WRT54G (v1.1) WRT54GL is a known good candidate, regardless of version access point: EOC-1650 requires activation of DD-WRT (~$30 US) router: Asus RT-N16

Wireless-G

Wireless-N

WRT54G / WRT54GL

~$60 shipped, hard to find in brick and mortar 1 WAN, 4 LAN Not all versions of WRT54G are compatible! WRT54GL v1.0 / 1.1 compatible BCM5352 200 MHz RAM: 16MB FLASH: 4MB 100 mW max (?)

Senao / Engenius EOC-1650

~$50 shipped, hard to find brick and mortar Wireless AP with internal 7dBi panel and 5 dBi external SMA omni antenna (selectable), 300 PoE injector included, 200 mW max radio Requires purchase of DD-WRT Professional Atheros AR2315 180 Mhz RAM: 32MB Flash: 8MB

Asus RT-N16

~$95 shipped Wireless N router 1 WAN, 4 LAN, 2 USB BCM4718A 500 MHz RAM: 128 MB Flash: 32 MB

Alternative Firmware

We will cover:
Tomato
http://www.PolarCloud.com/tomato

OpenWRT
http://www.OpenWRT.org

DD-WRT
http://www.dd-wrt.com

Alternative Firmware

Also available
FreeWRT

http://www.FreeWRT.org meant to be an appliance development kit (ADK) especially designed for embedded system developers and advanced users.

Tomato PolarCloud.com

Simple replacement for Linksys, Buffalo, BCMxxx Extends Linksys WRT54GL GPL firmware License ? authors permission? Simpler of the 3 with some powerful features

Linksys WRT54G v1-4, GS v1.-4, GL, Buffalo G54/G54s, Asus WL500G

OpenWRT OpenWRT.org

GPL license Latest version: Backfire (v10.03)

Very large HCL (hardware compatibility list)


Perhaps a bit more complicated, as many functions as command-line only

DD-WRT DD-WRT.com

Nice HCL database search and compatibility Lots of functionality, 99% GUI-driven Controversial - GPL; does not follow GPL 100%, accusations of stolen code, encrypted GUI code Commercial version available

HCL Am I compatible?

Tomato http://www.polarcloud.com/tomatofaq OpenWRT http://wiki.openwrt.org/toh/start DD-WRT http://www.dd-wrt.com/site/support/routerdatabase

Demo Time!

GUI of Tomato, OpenWRT and DD-WRT

You might also like