dynalink.Backdoor.txt

`I was playing with a   
Dynalink RTA 230 (http://www.dynalink.co.nz/products/rta230.htm), a linux   
based mips-cored adsl router. Looking at embedded linux system, i've found   
something like a backdoor:  
  
# cat /etc/passwd  
admin:xxxxx(obscured)xxxxx:0:0:Administrator:/:/bin/sh  
userNotUsed:YNf8oSCwK/0/Y:0:0:Technical Support:/:/bin/sh  
  
Then forced the pass with John:  
  
root@sbongaz:~/john-1.6/run# ./john passwd -show  
userNotUsed:userNotU:0:0:Technical Support:/:/bin/sh  
  
the first user is the administration account also used by http config center;   
the second entry in passwd is not visible or modificable from the user config   
center. Luckly access to the http config center and telnet shell is blocked   
(not enabled by default) from outside the lan.  
  
Many other adsl routers use the same chip/os, but 'ive no hardware to test it:  
Us Robotics 9105 (without wireless) and 9106 (with wireless)  
Siemens SE515 (to be confirmed)  
Buffalo WMR-G54 (to be confirmed ; it might be a different chipset, but the   
firmware format looks the same)  
  
For further references, take a look at   
http://skaya.enix.org/wiki/BroadCom96345  
`