This document provides an overview of how to hack into a city's Wi-Fi network by embedding a device into routers. It discusses the architecture and tools needed, including the operation system (Linux or VxWorks), hardware components like the system on chip and flash memory, and firmware structure. It also describes tools for analyzing and modifying firmware, like Binwalk and Reaver, which can exploit vulnerabilities in WPS to hack Wi-Fi passwords. The document concludes with links to additional online materials and a demo.

1. Scary Story:
How to get free Wi-Fi in a whole City
Yurii Bilyk, 2014

2. AGENDA
• Embedded device
architecture overview
• Tools overview
• Workshop (DEMO)

3. Files
• Files Archive :
–zip : http://goo.gl/UuKK51
–7zip : http://goo.gl/Q7mcnI
• FMK : http://goo.gl/pWZzNk
• Binwalk : http://goo.gl/U1TODl

4. Operation Systems

5. Operation Systems
Linux – Kernel 2.4 or 2.6
VxWorks – Real time OS
ZyNOS – Zyxel proprietary OS

6. Linux
Busybox tools
uClibc compiler
/proc File System

7. Hardware Design

8. Hardware
SoC – System On Chip
Flash, DRAM, Wi-Fi, Ethernet
Serial Console
JTAG Interface

9. SoC
MIPS Architecture
No Floating point operations
Embedded USB controller
32 bit CPU

10. Flash
Serial, Parallel
NAND, NOR Flash
MTD instead of FTL

11. Serial Console
Additional functions:
recovery, debug, boot opt, etc
Software Debug
Works with OS/Loader

12. JTAG
Works directly with SoC
Full access to the Flash and
Hardware
Hardware Debug options

13. Firmware Structure

14. Firmware
Boot Loader
Kernel
File System
Tag (Header)

15. Flash MTD
Spitted into chunks (partitions)
Boot, Kernel, FS, Settings, Logs

16. Kernel
Compressed
Usually with enabled debug
via serial port
Linux 2.4 or 2.6

17. File System
CRAMFS
SQUASHFS
JFSS2
Compressed, uses MTD
etc

18. Musthave Set of Tools

19. Tools
Firmware unpackers
Static analysis (Decompile)
Dynamic analysis (Debug)

20. Tools
Firmware Mod Kit, Binwalk
IDA, strings, etc
GDB, QEMU, On Device

21. WPS Tools
WPS Vulnerabilities:
• only 8 digit pin
• pin can be divided into 2 parts
• last digit is control sum
Reaver/WASH – tool to hack WPS
Aircrack-ng – tool to hack Wi-Fi

22. DEMO TIME

23. WEB Materials
• http://pudeev.livejournal.com/
• http://www.devttys0.com/
• http://robocraft.ru/blog/electronics/404.html
• http://wiki.openwrt.org/
• http://routerpwn.com/