4

Today I analyzed my home router.

I connected a keyboard to the router's USB port, which is usually used for mass storage devices. However, I pressed the key combination to reboot a Linux system from TTY (<Ctrl>-<Alt>-<Del>) multiple times. Afterwards the router actually rebooted.

Now, for me this is a strong indication I can blindly access a TTY with the keyboard. If I knew a username and a password I'd most likely be able to login.

To prevent this, the router manufacturer could disallow USB Keyboards.
But else what could they do to prevent this behaviour? Is it sufficiant to disable all TTYs? Can I build a Linux without a login possibility?

  • 1
    The threat model is a hacker, who wants to hijack the router, that was provided by his ISP – 0xAffe Aug 14 at 8:36
  • That's a threat for the ISP, not for the person whom the router was given to. – MechMK1 Aug 14 at 8:39
  • Yes it is. But what does that have to do with my question? – 0xAffe Aug 14 at 8:40
  • Let us continue this discussion in chat. – MechMK1 Aug 14 at 8:40
  • 2
    If someone has sufficient physical access to plug in a keyboard, they can also power-cycle it by unplugging it, hit the reset button to reset the admin password, or even take it apart and steal all of the existing data from the flash. What possible attack do you think you'd stop by disabling the keyboard? – Joseph Sible Aug 14 at 15:22
1

But else what could they do to prevent this behaviour?

Several possibilities:

  • Disable HID drivers in kernel.
  • Disable TTY support on kernel
  • Disable getty on TTY.
  • ...

Is it sufficiant to disable all TTYs?

Should be, yes.

Can I build a Linux without a login possibility?

For sure. Most embedded firmware are built with Yocto or Buildroot. Using these tools you can do what you want. One can build a system that will only launch a custom init system that only implements what is needed.

  • Would removing the password from the passwd file be sufficient, assuming the image is read only? – Ryuu Aug 14 at 14:34
  • usually, password aren't stored in passwd file but in /etc/shadow file. Removing password from here means "no password" and, as a consequence, is a bad idea... – binarym Aug 21 at 10:09
  • Right. I currently remove root from both of these files for production units. Trying to log in with root results in bad login as the user doesn't exist. This seems good enough for me, but I'm not sure if there are loopholes. – Ryuu Aug 21 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.