lms@fe.up.pt
07/10/05, 10:25
This message is in MIME format.
--=_14so3jrahahw
Content-Type: text/plain;
charset=ISO-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hello all,
Today i discovered a pseudo backdoor [thru a default password] while trying=
to
reset the password on a Planet Technology Corp FGSW2402RS switch.
Allthough i dont consider this to be a real problem since the only access s=
eems
to be thru the serial port, i would like to share this with the community s=
ince
it isnt documented *anywhere* and Planet Technology Corp doesnt even reply =
to
emails asking for support on their products.
So...we start with a common ASCII analisys of the firmware [revision 1.2]:
root@leonardo-root ~/planet# strings FGSW-2402RS_ISP_1.2.txt
....
admin
[^_^]
ISPMODE
....
root@leonardo-root ~/planet#
Admin is the obvious login and ISPMODE is the password used for uploading a=
new
firmware to the equipment.
If we connect to the equipment and send admin as the login and "[^_^]" as t=
he
password we get the same login prompt again (as if the password had failed)=
and
the password has now been reset to "".
Best regards,
+-------------------------
| Lu=EDs Miguel Silva
| Security Consultant
| Centro de Inform=E1tica Correia Ara=FAjo
| Faculdade de Engenharia da
| Universidade do Porto
--=_14so3jrahahw
Content-Type: application/pgp-keys
Content-Description: PGP Public Key
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.7 (GNU/Linux)
mQGiBEJ54SIRBADAP8EoAbhyKi2KL6uBEELULwp5ZzzpZAw8Ws ZM8mcO8oR1Nil4
mRR4JChbGz/wYSkbohT+aQa/Y+0+7kvxrDOyGp09uYL/BJn2FaM3sIgiymMsQtws
B6V3CJvy3/Zu0zv/mbFvAdQ8xvXI5OVxCrp+0TDtjX6wMew15/b6WW80swCgof0f
hiDPYobvBQ7hxCLx+4Do7v0EAIlujL3WKdw6tPcETXS3f98aid Jc6xW6WmkoHjAD
S46blE42n6FQMAzlNZhEtPIMbprvG11n9otIm8wp3l8TR+JcyI QYPcs49ANqGkPn
LkaFTn5wksgRmviNjF2DjCJ0ZGoU9Q63ABVeOhKyxB45g+1CPr 5dVLZiUTb3ow1/
3ZIwA/49D7LQofEfCLrVpylmvcdy5aB0N5KdsRprlL2BVnrs64Wzg3NO Ye5VUgx5
ijX1bSUtygb5If3ZyS4Bhg5M9qQ9qaowLBQCwz8DXC7uziCMFm K9bTk65S82EjLa
mEZtGpAIMsoLl5XH7HQuIan08Bsj0izjS6VCSjhh/FGifmeTKrQWQ1NJUlQgPGNz
aXJ0QGZlLnVwLnB0PohbBBMRAgAbBQJCeeEiBgsJCAcDAgMVAg MDFgIBAh4BAheA
AAoJEAgMJjFz7arDguEAn0nxaAN79mFWG3DsoSlsvFDFbhtNAK Cbhwj8q1wuRPq+
uvOP5tPoEPgY6rkCDQRCeeE2EAgAsDmqBdsgpuhl1bqTnaQXi3 RyVZAmlGygD2mL
0nFmQ2RKvzr0XnwVMYdaWe7A0PoeopMnBERHuSOQ63Rwlj3Umf D5EjTeVjls1RvK
kM/cwaI7WO0Q/UY1hEufuq5v47HnWAxPThRmk0HH5JuwD/6T5xV1HCjPzCtqMyWN
XbkICUoBl4bL07y5zxCRv2+MicMZ1RJtqcLLzy7arNkXT5B2Fz Z639NXw4+b8taT
FKaTPaM0EIZASdmPiSbJDHShJU1dxgLD4GfKUZnm+aMZfzeYtd ScTXfnENBZQ2Wq
H4h7cSFyrcLgKhJhc1OYQN9r11pwC+J2/v3CFqwciK6D5wLeCwADBgf/R4h04HFT
VQCwwUoMFcVVh5IGneEZ69YUz32A7pdsY66PZwYFVMdRPYyYvn SJWOoWaWnbTAB+
fFk6zXIJ9Pkg7uYvcGylQyR7kNkPNG50WNgv185V7+0z8qR3Nt QGDsrVs6KtGRdd
iLx+PjJrxNfPJ4o9tU6Il1Fy2bRwofbQB2s2Z3D22lEnRN9za1 qDaqrTQJ0O0WqS
3PTZWgS0F3vKBC4zoBt/SNLPet/Ir0St0Bj/DOafC1jdsTOxTOFemSUXyNaALIqR
Fiu7TsJolxfP0g7LEFKdlb5kI+9W8ygZynqZJ4wLkW/U/hwQ8qen/pdEEA4+fR+v
1gvi2D1geoMrPYhGBBgRAgAGBQJCeeE2AAoJEAgMJjFz7arD9+ EAn3LiGxtXm7uz
eH5AmShOriB3wtH6AJwOyQjQj2j4ztKzBPPM70rMtn8NPA==
=xFjz
-----END PGP PUBLIC KEY BLOCK-----
--=_14so3jrahahw--
--=_14so3jrahahw
Content-Type: text/plain;
charset=ISO-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hello all,
Today i discovered a pseudo backdoor [thru a default password] while trying=
to
reset the password on a Planet Technology Corp FGSW2402RS switch.
Allthough i dont consider this to be a real problem since the only access s=
eems
to be thru the serial port, i would like to share this with the community s=
ince
it isnt documented *anywhere* and Planet Technology Corp doesnt even reply =
to
emails asking for support on their products.
So...we start with a common ASCII analisys of the firmware [revision 1.2]:
root@leonardo-root ~/planet# strings FGSW-2402RS_ISP_1.2.txt
....
admin
[^_^]
ISPMODE
....
root@leonardo-root ~/planet#
Admin is the obvious login and ISPMODE is the password used for uploading a=
new
firmware to the equipment.
If we connect to the equipment and send admin as the login and "[^_^]" as t=
he
password we get the same login prompt again (as if the password had failed)=
and
the password has now been reset to "".
Best regards,
+-------------------------
| Lu=EDs Miguel Silva
| Security Consultant
| Centro de Inform=E1tica Correia Ara=FAjo
| Faculdade de Engenharia da
| Universidade do Porto
--=_14so3jrahahw
Content-Type: application/pgp-keys
Content-Description: PGP Public Key
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.7 (GNU/Linux)
mQGiBEJ54SIRBADAP8EoAbhyKi2KL6uBEELULwp5ZzzpZAw8Ws ZM8mcO8oR1Nil4
mRR4JChbGz/wYSkbohT+aQa/Y+0+7kvxrDOyGp09uYL/BJn2FaM3sIgiymMsQtws
B6V3CJvy3/Zu0zv/mbFvAdQ8xvXI5OVxCrp+0TDtjX6wMew15/b6WW80swCgof0f
hiDPYobvBQ7hxCLx+4Do7v0EAIlujL3WKdw6tPcETXS3f98aid Jc6xW6WmkoHjAD
S46blE42n6FQMAzlNZhEtPIMbprvG11n9otIm8wp3l8TR+JcyI QYPcs49ANqGkPn
LkaFTn5wksgRmviNjF2DjCJ0ZGoU9Q63ABVeOhKyxB45g+1CPr 5dVLZiUTb3ow1/
3ZIwA/49D7LQofEfCLrVpylmvcdy5aB0N5KdsRprlL2BVnrs64Wzg3NO Ye5VUgx5
ijX1bSUtygb5If3ZyS4Bhg5M9qQ9qaowLBQCwz8DXC7uziCMFm K9bTk65S82EjLa
mEZtGpAIMsoLl5XH7HQuIan08Bsj0izjS6VCSjhh/FGifmeTKrQWQ1NJUlQgPGNz
aXJ0QGZlLnVwLnB0PohbBBMRAgAbBQJCeeEiBgsJCAcDAgMVAg MDFgIBAh4BAheA
AAoJEAgMJjFz7arDguEAn0nxaAN79mFWG3DsoSlsvFDFbhtNAK Cbhwj8q1wuRPq+
uvOP5tPoEPgY6rkCDQRCeeE2EAgAsDmqBdsgpuhl1bqTnaQXi3 RyVZAmlGygD2mL
0nFmQ2RKvzr0XnwVMYdaWe7A0PoeopMnBERHuSOQ63Rwlj3Umf D5EjTeVjls1RvK
kM/cwaI7WO0Q/UY1hEufuq5v47HnWAxPThRmk0HH5JuwD/6T5xV1HCjPzCtqMyWN
XbkICUoBl4bL07y5zxCRv2+MicMZ1RJtqcLLzy7arNkXT5B2Fz Z639NXw4+b8taT
FKaTPaM0EIZASdmPiSbJDHShJU1dxgLD4GfKUZnm+aMZfzeYtd ScTXfnENBZQ2Wq
H4h7cSFyrcLgKhJhc1OYQN9r11pwC+J2/v3CFqwciK6D5wLeCwADBgf/R4h04HFT
VQCwwUoMFcVVh5IGneEZ69YUz32A7pdsY66PZwYFVMdRPYyYvn SJWOoWaWnbTAB+
fFk6zXIJ9Pkg7uYvcGylQyR7kNkPNG50WNgv185V7+0z8qR3Nt QGDsrVs6KtGRdd
iLx+PjJrxNfPJ4o9tU6Il1Fy2bRwofbQB2s2Z3D22lEnRN9za1 qDaqrTQJ0O0WqS
3PTZWgS0F3vKBC4zoBt/SNLPet/Ir0St0Bj/DOafC1jdsTOxTOFemSUXyNaALIqR
Fiu7TsJolxfP0g7LEFKdlb5kI+9W8ygZynqZJ4wLkW/U/hwQ8qen/pdEEA4+fR+v
1gvi2D1geoMrPYhGBBgRAgAGBQJCeeE2AAoJEAgMJjFz7arD9+ EAn3LiGxtXm7uz
eH5AmShOriB3wtH6AJwOyQjQj2j4ztKzBPPM70rMtn8NPA==
=xFjz
-----END PGP PUBLIC KEY BLOCK-----
--=_14so3jrahahw--