D-Link blunder: Firmware encryption key exposed in unencrypted image

guest · Jul 22, 2020

D-Link blunder: Firmware encryption key exposed in unencrypted image
July 22, 2020
https://www.bleepingcomputer.com/ne...-encryption-key-exposed-in-unencrypted-image/

Security researchers have demonstrated a method to decrypt proprietary firmware images embedded in D-Link routers.

Companies encrypt firmware images in their devices to prevent their reverse engineering by competitors and threat actors, and to prevent their customers (or better yet malware) from flashing the device with customized firmware.

“Manufacturers encrypt firmware generally to try to keep people from analyzing the binaries therein. Also, if done correctly, encrypting firmware images can prevent unauthorized, modified firmware images from being able to be flashed on a device,” security researcher Nick Starke explained in an interview with BleepingComputer.
Click to expand...

Analyzing D-Links encrypted firmware image
At the beginning of his analysis, Starke had downloaded the latest version of the D-Link firmware (1.11B02) from their support website and proceeded to use Binwalk to analyze it.

"Bingo, a uImage header, and accompanying filesystem. We can extract this using binwalk -eM DIR3040A1_FW102B03_uncrypted.bin. Looking at the filesystem, the first thing I did is look for certificates," explains Starke in his blog post.
Keys embedded in older firmware
After further analysis, his suspicions were correct, and both the decryption and encryption keys were found embedded in the binary.
“[...] If you can find the last unencrypted image, you can generally find the password and thus decrypt any subsequent encrypted images,” Starke further told BleepingComputer.
Click to expand...

The same technique has been used earlier this month by another security researcher Rick Sanchez who did an in-depth static analysis of the decryption algorithm in a multi-part blog post.
Sanchez, who had initially discovered this flaw, relied on purchasing a physical D-Link device, which can cost up to $200, as explained in Part 1 of his post.
Click to expand...

Log in or Sign up

D-Link blunder: Firmware encryption key exposed in unencrypted image

guest Guest

Log in or Sign up

D-Link blunder: Firmware encryption key exposed in unencrypted image

guest Guest

Useful Searches