Questions about router firmware update and security

[redscrox]

Hello everybody, first question here but I've lurked for a long time.

I own a D-Link router and I always had a lot of problems with its wireless signal. The router has been discontinued and on D-Link website they only left a couple of firmware versions (not latest betas, which they had time ago). I usually don't install betas, so I never bothered to try them.

Yesterday, out of rage, I looked for those beta firmwares but could not find them on D-Link support site, as I said. Then i just found them on a file hosting site through a google search. I found the latest beta and I updated the firmware through the firmware upgrade module in control panel.

It went all fine but then I became paranoid and I regretted it. I scanned the file after download but I trusted it because I just wanted to solve my problems. After few hours, I came to conclusion that it was better to use only files from official website, so i downloaded an old firmware from D-Link site and downgraded the firmware. So here my questions:

1) Is it possible (even if highly unlikely) that I could have uploaded on my router a "malware/spyware-like" kind of software with the firmware, since I don't really trust the source (I repeat, maybe only paranoid since everything worked later)? I noticed in the update process there's a step called "firmware verification", does it check only integrity or anything else?

2) Even if it did happen (well, what is done is done), can I be 100% sure that after firmware downgrade (flashed with an old version, as written above) the "suspicious" firmware is definitely gone? I ask this because I noticed that both during update to newer ("suspicious") version and during downgrade to old ("safe") version, it kept all my settings without changing anything (admin password, wpa passphrase, firewall rules, and so). Let's say (ok, here I admit I'm out of reality but still :$) point 1 is true, did the firmware downgrade surely deleted everything I could possibly have installed with the previous update? Both files were .bin images.

Ok, probably I have just to stop reading all the news about hearthbleed, shellshock and so :awe: and I apologize if they are a sort of stupid questions, but I'd also like to know them to improve my future knowledge.

Thank you.

 

[VirtualLarry]

I suppose nearly anything is possible, if you installed a rogue firmware.

The chances of someone writing a rogue firmware for an outdated router, and leaving it on the internet in the rare case that someone like you would flash it, is fairly slim. Not impossible, but slim.

 

[redscrox]

I suppose nearly anything is possible, if you installed a rogue firmware.

The chances of someone writing a rogue firmware for an outdated router, and leaving it on the internet in the rare case that someone like you would flash it, is fairly slim. Not impossible, but slim.

Thank you for the answer. But what about the second question (which I think is more important)? I don't have a deep knowledge how flashing firmwares works, if I flashed it back with a previous one, should I have erased anything installed before even if it kept all the settings during all the flashing forth and back?

 

[John Connor]

It's been wiped.

 

[JackMDS]

Ok, probably I have just to stop reading all the news about hearthbleed, shellshock and so :awe: and I apologize if they are a sort of stupid questions, but I'd also like to know them to improve my future knowledge.

Thank you.

That is a very Good idea. Unless One spend time to Educate him/her self on the general Technology concerning thees stories, otherwise it does nothing short of being mere "Fear factor" agent.

Reading your OP reflects a feeling that you are familiar with OS' and software Apps upgrade but know nothing about the firmware in Wireless Routers and its Upgrade.

Unfortunately almost all the Firmware Upgrade have nothing (or very little) to do with the outside world interaction of the Router with the Internet.

The upgrade are a needed because these devices are rushed to market with No real thorough testing and then need to be fix once the consumers starting to use them.

Beside Manufacturer Firmware there are 3rd party Firmwares too (like DD-WRT, and Tomato).

I would never Flash my deives with something found on the Internet if it not coming from a site well known and widely used by advanced users and Enthusiasts.

 

[redscrox]

I would never Flash my deives with something found on the Internet if it not coming from a site well known and widely used by advanced users and Enthusiasts.

I agree (now ), that's why I started to feel dubious about it almost suddenly, I flashed it back, I didn't access sensible data in the meantime and I made this post. I rushed the upgrade, I know it, but as you correctly stated I'm enough tech educate in other fields to wonder if it was a good idea even if I don't know this topic enough.

BTW, John Connor answer calmed me down: wiped, mistake undone and lesson learned :$

 

[John Connor]

Think of the router's memory as a computer hard drive. Once you write a new OS to it the last one is gone.

 

[VirtualLarry]

Think of the router's memory as a computer hard drive. Once you write a new OS to it the last one is gone.

Unless, the rogue firmware that got on there first, does patching of the replacement firmware image in RAM, before committing it to flash, to ensure that control is maintained. It's possible.

 

[John Connor]

OP, throw the router away now. LOL! J/K

 

[azazel1024]

Unless, the rogue firmware that got on there first, does patching of the replacement firmware image in RAM, before committing it to flash, to ensure that control is maintained. It's possible.

And also ideally the firmware is signed and the router will only install properly signed firmware.

That one is a heck of a lot more likely to not exist/be broken than the firmware tweaking the bin file in RAM prior to flashing it.

Certainly still possible.

 

[redscrox]

And also ideally the firmware is signed and the router will only install properly signed firmware.

That one is a heck of a lot more likely to not exist/be broken than the firmware tweaking the bin file in RAM prior to flashing it.

Certainly still possible.

As I said, my router does a so called "firmware validation" step during every upgrade process, but I have no idea if it just checks integrity or signature or whatever.

I also have an update: yesterday I contacted D-link support and I asked them if they could send me the exact version of the firmware I downloaded. Luckily they did today.

Then under a unix shell i checked both files with cmp and it showed no differences. Finally I even did a md5 checksum verification, and the result is absolutely identical.

I have to point out that I haven't a great knowledge how what these commands do, I confess I just followed online guides. But can anybody of you (very nice people who answered my paranoid questions () ) confirms that if both files show no differences with the aforementioned methods, they are to be considered the same? Thanks (also thank you to have improved my knowledge and awareness).

 

[azazel1024]

Yes, they are the same. Other than a collision, if the md5 checksum matches, they are completely identical files.

If someone managed to generate an md5 collision just for firmware for an old D-link router, you should humor their immense cryptographic skills and install it anyway.