Exibir código-fonte para Router RTA04N Backdoor

 Responsáveis: 
 * [[Raphael Bastos - Coffnix|Raphael Bastos aka coffnix]]
 * [[Usuário:Ewerson_Guimarães_-_Crash|Ewerson Guimarães aka Crash]]
 * [[Usuário:Gabriel_Murillo_Lanzi|Gabriel Lanzi aka Glanzi]]

Who put the backdoor in my router?

[[Image:Router_RTA04N.jpg|thumb|550px]]

= Research Information =

This is a INDEPENDENT research conduced by two freaks: 

* Raphael Bastos(Coffnix) - That efectvitly found the backdoor. 

* Ewerson Guimarães (Crash): Continue the research, did more device tests and contact with vendors.


= Abstract =

For quite some time we have been seeing espionage cases reaching countries, governments and large companies.

A large number of backdoors were found on network devices, mobile phones and other related devices, having as main cases the ones that were reported by the media, such as: TPLink, Dlink, Linksys, Samsung and other companies which are internationally renowned. 

This article will discuss a backdoor found on the modem / router XXX, equipment that has a big question mark on top of it, because there isn’t a vendor identification and no information about who’s its manufacturer and there are at least 7 companies linked to its production, sales and distribution in the market. Moreover, some of them never really existed.
Which lead us to question on the research title: “Who put the backdoor in my modem?”

= Detailed Outline =

In a recent research on a RTA04N device, supplied by GVT (Brazilian ISP) we have found some intriguing facts:

The vendor’s website does exist, but has only one screen with its logo, without any other links to other areas such as manuals, support and firmware


= The device =

Router GVT from Belo Horizonte-Minas Gerais / Brazil.

Strange default SSID and Password based on MAC Address and S/No.:

== Router 01 ==

Click to enlarge:

[[Image:Router01_frente.jpg|Router 01 frente|800px]]
[[Image:Router01_verso.jpg|Router 01 verso|800px]]

== Router 02 ==

Click to enlarge:

[[Image:Router02_frente.jpg|Router 02 frente|800px]]
[[Image:Router02_verso.jpg|Router 02 verso|800px]]


== Internal ==

Click to enlarge:

[[Image:Router_internal_front.jpg|600px]]

[[Image:Router_internal_verso.jpg|600px]]


= Legal =

Consulting the approved register in ANATEL ( Brazilian National Telecomunication Agency):

Regulate, and supervise grant. Thus can be summarized the main duties of Anatel, developed to fulfill the mission of "promoting the development of telecommunications in the country in order to give it a modern and efficient telecommunications infrastructure capable of providing adequate services to society and diversified prices just around the national territory.

http://pt.wikipedia.org/wiki/Ag%C3%AAncia_Nacional_de_Telecomunica%C3%A7%C3%B5es

We can see more one company in the process, BAYTEC Technology:

[[Image:Router_anatel.png|600px]]


http://sistemas.anatel.gov.br/sgch/HistoricoCertificado/Homologacao.asp?NumRFGCT=217112&idtHistoricoCert=9349313 (25/03/14)

How we can see, this device was approved at end of 2012 and until recent days it is distributed by GVT.

How many people received thos device only in Brazil?

= More strange stuffs.. =
== BayTech ==

'''Address:''' Rua Aluisio Azevedo - 40 - Rocha - Rio de Janeiro-RJ / Brazil - CEP: 20960-050

[[Image:BayTech.png|800px]]

== Observa Telecom ==

In the device manger you can see Observa Telecom but....

[[Image:Observa.png|600px]]

The device has the mac started by E4:C1:46 referring to the company: Objectivo y Servicios de Valor Anadido – which in the end, refers directly to ObservaTelecom

https://code.wireshark.org/review/gitweb?p=wireshark.git;a=blob_plain;f=manuf;hb=HEAD

[[Image:Mac.png|400px]]

The vendor’s website “exist”, but has only one screen with its logo, without any other links to other areas such as manuals, support and firmware.

Of course, they dont reply emails...

[[Image:Observa2.png|400px]]

https://www.nic.es

Of course, he dont reply (11)emails...

[[Image:Observa3.png|400px]]

http://simbiotika.com/empresa/OBJETIVOS-Y-SERVICIOS-DE-VALOR-A%C3%91ADIDO-SL



== GVT (Global Village Telecom)  ==

[[Image:GVT.png|100px]]

This device is distributed by GVT. A big Brazilian Internet Service Provider player.

According to GVT technical support, this modem/router is not supported by them. Are you serious? Dont belive? Take a look at:

http://www.gvt.com.br/PortalGVT/Atendimento/Area-Aberta/Documentos/Lista-de-Modens


== Hex dump ==

Consulting the BayTec site was possible found the device firmware.

Opening its firmware in hexadecimal we can see that its made by TPLINK.

[[Image:Hex.png|600px]]

=== Firmware download ===

http://www.baytec.com.br/Firmware_RTA04N_GVT_006.rar


=== Default Password ===

The router/modem has two default users created, one is admin and the other user, both with password gvt12345. According to the manual '''(pages 12 and 71)''':

http://www.baytec.com.br/RTA04N_User_Manual_V0.1.pdf 

[[Image:Man_router1.png|600px]]

[[Image:Man_router2.png|600px]]


Thus, we have two lines of thought:

1 - GVT replaces the original firmware for a proprietary firmware.

2 - The firmware has already been shipped with GVT settings.

And last but not least, when backing it up, as indicated in the manual, we can get the following information:

[[Image:Config.png|400px]]

We can clearly see the flags indicated on lines 548, 555 and 562, with a special emphasis on  line 562 which has its value setted as 0x1.

Thus, you can login with admin user using either passwords, furthermore, every user setted with the flag N=”BACKDOOR” V=”0x1” is not shown in the modem/router user list in web admin interface.

To be sure, we searched for D590airocon password on google and it hasn’t returned any results:

[[Image:Google_router.png|800px]]

To validate our theory, we bought the same model modem/router. 

We found that the backdoor password is composed of: 

* Last 4 digits of the MAC addr + airocon string

'''I think that the MAC Address was choose because it’s sent over the network, facilitating the device invasion.'''


=== Airocon ===

Searching for the airocon string, we have found a company in which the site no longer exists:

[[Image:Airocon.png|500px]]

[[Image:Airocon2.png|600px]]

http://ma.bizdirlib.com/business_directory/Airocon_Inc


= Exploring the backdoor =

After running nmap against the router it was possible to login with the password D590airocon

on SSH and telnet in a limited shell.

[[Image:Routercmd001.png|400px]]

Login with normal admin user ( admin:gtv12345)

[[Image:Routercmd002.png|500px]]

[[Image:Routercmd003.png|800px]]

The commands “sh” ans login show dont works.

Login with backdoor user: (admin:4_last_mac_chras+airocon)

[[Image:Routercmd004.png|200px]]

You can see that the prompt is different after execute sh command.

And the amount of commands was increased:

[[Image:Routercmd005.png|700px]]

The “login show” command shows the backdoor (which is not shown on the web admin interface)

[[Image:Routercmd006.png|450px]]

In this shell is possible to have full access to the device’s functionality.


Taking a closer look at the device’s memory it was possible to find some interesting information:

[[Image:Hex01.png|600px]]

'''Redirection link to Chinese company:'''

[[Image:Hex02.png|600px]]

'''Even after reset it was possible to retrieve the device’s previous user name:'''

[[Image:Hex03.png|600px]]

'''The device saves neighbour network names:'''

[[Image:Hex04.png|600px]]

'''Sensitive data about GVT credential services:'''

[[Image:Hex05.png|600px]]



Furthermore, the admin page for the backdoor user is completely different from the common admin page. 

When accessing the following return error 404 file not found (index.html)


Which obviously does not give access to anything. However, trying to force filenames we could identify some files in the router root directory:

/logo.htm

/banner.htm

/submit.htm

/logout.htm

/authentication.htm

/ping.htm

/adsl-diag.htm


'''Ping screen for normal user:'''

[[Image:Ping_normal.png|800px]]

'''Ping screen for backdoor user:'''

[[Image:Ping_backdoor.png|400px]]



Finally, the next question is: “Who put the backdoor in the modem?”

* GVT? 

* Realtek?

* ObervaTelecon? 

* Airocon? 

* China Unicon? 

* Tp-Link?

* Baytec?


[[Categoria:Hacking Projects]]
[[Categoria:HackingDocs‏‎ ]]
[[Categoria:Embarcados]]