Slashdot Mirror
Hacking the Free "La Fonera" Wireless Router
wertarbyte writes, "FON is still giving away their wireless routers for free in Germany and Austria until Wednesday — under the premise that the devices will be connected and used as FON access points. The router, called 'La Fonera,' is a variant of OpenWRT, but locked down to prevent modification, including a signed firmware image to prevent the upload of new software. It is, however, possible to get shell access by connecting to a serial port present on the circuit board. And now two students from Germany have discovered vulnerabilities in the CGI scripts used to configure the device, and successfully activated an SSH daemon on the device by exploiting them, giving owners a root shell on their router. They also provide a detailed description of the procedure and 'ready-to-use' perl scripts to open up your router."
Its a violation of a pretty neat little system. These things are free (or about as close you can get to it) so its not like its some propriety item they bought and are trying to get more features out of. They are defrauding a company for free wireless routers.
Maybe Im crazy but I think the FON system is very clever and if peope werent abusing it, it might take off interesting ways. Instead it "doodzz free wireless routers here!!!" Shame really.
First at all, it isn't called "La Fonera". "La" in Spanish is just the "The" article, making it the Fonera, a Fonera, or how you want to call it.
It is free too here in Spain, but obtaining it's a really strange scheme that looks a lot like a scam to get private info from people. For example, it was offered for free for the readers of a well known digg-like web and they recommended to use the same user and password to request it as the people had in the web page?! WTF!? And a month later they bought part of the page!!!!
Extremely strange.
And what to say of the Fonera using hidden DNS servers property of the FON makers or scripts allowing free access for them with root privileges to your private network?
--
Superb hosting 200GB Storage, 2_TB_ bandwidth, php, mysql, ssh, $7.95
Anyone remember the CueCat?
You can't give geeks a free gift then cry when they use it for something other than you intended. That business model has been proven unworkable.
Software patents delenda est.
Also, the only way to access your wired network from the wireless is to allow ALL wireless users to have that access. Well, okay, you could do things like SSH out to a machine on the Internet, SSH back in, and set up port forwarding that way, but nobody would ever do that :). And your own wireless access is treated the same as everybody else's-- you have to log in every time. Annoying in combination with Firefox2's ability to resume sessions-- it loads the Fon login redirection page for every tab you had open.
They've been promising a firmware fix which would allow two SSIDs with different configurations for a long time, but last I checked it still isn't out.
The upshot of this is that I thought I would be getting a nifty solution which would let me share my access while covering my own needs. Instead I really have to run two routers, one for me, and one for everybody else. And despite the fact that I live in a pretty densely populated area, in about six months the number of people who have signed on to the Fon router, besides me, is zero. Oh, correction: the buddy who told me about Fon came by and tried to sign in with his account, which he is supposed to be able to do as a "Linus" user. That didn't work either.
In summary... it's more work and their system is not transparent or secure (oh yeah, there's no encryption on the wifi connections). It's a nifty idea, but I can't really recommend it.
for the amount of work you just put in to crack your "free" router, you could have just gone out and gotten a WRT54GL or a Buffalo Airstation and stuck dd-wrt on it.
...if they had used a secure OS like Windows CE, we would be left pounding sand.
I live in Austria and I use inode. They meter me during the day and I hit the limit every month.
So I'm wondering how people are going to use this thing.
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
The Muhblog has instructions how to gain SSH access to the box:
http://mrmuh.blogspot.com/
An ancient Jewish proverb.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
The way they inject the code requires that you send a tell-tale string to Fon. The SSID is changed remotely by FON after it has been entered into the web interface and the router has been rebooted. The SSID is what contains the injected code, so FON will see that you're hacking your router. Since you have a contractual obligation to use the router as supplied by FON, that will certainly get you into hot water.
Got an early version at a HispaLinux convention. It cost me some cash, but it was still cheaper than I could get it otherwise, so I bought it. Coincidentally, there was a WiFi security talk at the convention, and I used the chance to ask them what they thought about the whole FON thing. They were extremely unimpressed and thought it couldn't be made secure.
Based on a cursory examination, I determined the system was insecure. Suppose I enable the router, and somebody comes near and tries to connect. To connect, they try to connect to my wireless network, and the AP authenticates them against the FON RADIUS server.
Now, the problem is that I'm in control of the router, so I can easily fetch their username and password. SSL wouldn't help because at best you have User AP RADIUS, as my understanding is that the AP isn't acting as a router here. The user isn't talking to the RADIUS server directly, the AP does on his/her behalf. So there's no way of stopping me from sniffing people's passwords.
After I get passwords I can easily find some other FON AP, use somebody else's credentials, and have reasonable chances that the person getting in trouble for downloading/uploading something illegal won't be me.
I voiced my concerns on the forum, but the replies weren't satisfying, so now I reflashed it with new firmware and there's no FON-related stuff left on it.
I guess you have a valid point here. Then again, there may be some of us who feel a value calculation like yours is less impressive than the joy of finding a way.
605413? Yes, it's a prime.
I posted a little WIKI after the limited price FON Linksys routers came out the first time here: http://truthcankill.pbwiki.com/fonrouter Yes they prob changed hardware and have better coding, but this is not new, somthing for cheap or free is going to get hacked!
The poster is incorrect in saying this offer is only available in Germany and Austria. I noticed that the web site he pointed to was de.fon.com. I changed the "de" to an "en" and got the English version of the site — which will ship a router to a U.S. for 5 bucks.
But here's some findings that go well with this article:
The reality behind FON's hype
and much more at:
tech.am
(I am in no way connected with this site, apart from the fact that I occasionally enjoy reading it)
(I have none left myself)
605413? Yes, it's a prime.
in the current FONERA firmware,
things such as opening up the POP SSL ports (993 and 995).
FONERA only allows access to ports 80 and 445 to the internet even on the *private SSID*, making it useless for me as the sole router.
Also, even is the router gives the public and private clients different IP addresses to theoretically prevent the public from browsing on my private LAN, well they are on the same subnet and I can type my private LAN ips from the public network and get access!
This thing then NATs my NAT, making it even more difficult for me to sandbox it properly.
Hopefully, open-wrt will make it more useful as a mini mail server or something like a mini Asterisk server.
Artificial intelligence is no match for natural stupidity
I'm in the US, so I checked out the http://en.fon.com/ page like someone else suggested. I signed right up. The router is $5 plus tax and shipping ($14.10 total) until Nov 8, then it's going to $30, supposedly. It's got Linksys guts in it, so I expect it to be a fairly decent consumer-level piece.
I'm not interested in hacking the device or anything, but I am interested in using it and promoting the service. The more of these there are in the wild, the more opportunities there are for me, as a registered user, to get online with them for free. Alternatively, I could just get the 50% of the $3 day fee, if I actually lived somewhere urban. Throwing one of these onto a separate subnet in an urban office would probably generate at least a little revenue, plus provide a limited source of advertising through the customizable log-in page.
In general, hacking direct access to the serial port takes a pretty high level of user to accomplish, and in the end it saves an outlay of what? $30-$50? Even with the CGI backdoor, how many people outside of the geek community even know what to do when presented with a shell interface? I think it's very cool to reverse engineer things, but I don't think it's a threat to the business model at all. I'd compare it to the amount of WRT54G's in place globally vs. the ones that actually run DD-WRT. And that's an easy/useful hack. The bonus of hacking is that it gets press. If not for this article, I'd have never heard of Fon.com.
They also provide a firmware for your existing WRT54G/GS so you can start up with them for free. Buffalo routers are supported too. https://en.fon.com/downloads/
What's FON?: http://en.fon.com/info/whats_fon.php
Often in Error, Never in Doubt.
Most people in the U.S. can't use Fon's service anyway. Between this and handing out stock options to blogging pundits in return for a kind word, they seem to be a pretty shady company.
The router is $5 plus tax and shipping ($14.10 total) until Nov 8, then it's going to $30, supposedly. It's got Linksys guts in it, so I expect it to be a fairly decent consumer-level piece.
You told me it had Sony guts!
http://snltranscripts.jt.org/91/91ssabra.phtml
called http://www.fondoo.net/ it seems to have been set up on the premise of allowing users to share their connections with Fon. Pretty specialised focus for an ISP, most don't seem to let you share your connection, but they probably don't give a damn if you do. I guess if you care about doing the right thing (and want to get a FON router)then this is the ISP to go for.
An article on the BBC News website (http://news.bbc.co.uk/1/hi/technology/4721723.stm ) states that in the UK "the person installing the network, be they a home user or a business, has ultimate responsibility for any criminal activity that takes place on that network, whether it be launching a hack attack or downloading illegal pornography".
This has always been a stumbling block for free access in the UK. I hope those using services/schemes such as Fonera in the UK know the risks..
So two students found a bug on their webserver.
Should take FON a minute to fix it and then they can see which users are trying to hack into the router. Remember, they know the MAC-address of the router they sold you.
This will be useless tomorrow.
inode converted all accounts to 24 hour flat from this month on. seems you didnt get the info mail they sent out.