Compromising OpenWrt Supply Chain (flatt.tech)

Article summary

A security engineer discovered a vulnerability in the OpenWrt supply chain, specifically in the sysupgrade.openwrt.org service, which allowed for command injection and SHA-256 collision attacks. The engineer was able to exploit these vulnerabilities to compromise the service and potentially force users to upgrade to malicious firmware. The issue was reported to the OpenWrt team, who fixed the vulnerabilities within three hours. The engineer's write-up of the exploit provides a detailed look at the vulnerabilities and how they were exploited.

Main themes

• OpenWrt vulnerability
• Supply chain security
• Command injection
• SHA-256 collision
• Open source security
• Vulnerability disclosure

What commenters say

• The OpenWrt team's quick response to the vulnerability report is a testament to the benefits of open source software and responsible disclosure.
• The use of truncated hashes is not a secure practice and can lead to vulnerabilities like the one discovered in OpenWrt.
• Some commenters believe that the write-up of the exploit is well-done and provides a valuable learning experience, while others think it highlights the risks of using open source software.
• The vulnerability in OpenWrt is not unique and highlights the broader issue of security vulnerabilities in ISP-provided routers and devices.
• The cost of security analysis and the potential earnings of security researchers are debated, with some arguing that $40k per month is a reasonable price for security analysis and others disagreeing.
• The ability to brute-force a 12-character SHA-256 collision in a short amount of time is impressive and highlights the power of modern computing hardware.