Post

RyotaK
@ryotak.net

[PSA] If you're using OpenWrt router and have used the Attended sysupgrade, firmware-selector.openwrt[.]org or CLI upgrade previously, I recommend you to re-flash your firmware. Due to a security issue, it was possible to pollute the firmware images delivered to these tools. (1/2)

RyotaK
@ryotak.net

If you're interested in the technical details, I wrote the blog post here: flatt.tech/research/pos... For the further details, please check out the announcement from the OpenWrt team: lists.openwrt.org/pipermail/op... (2/2)

flatt.techCompromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command InjectionIntroduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After ac...

8 reposts17 likes

No replies yet.