DD-WRT, I Know Where You Live

http://www.devttys0.com/2010/12/dd-wrt-i-know-where-you-live/

by r11t • 16 years ago

94 35 16 years ago

devttys0.com

jared314• 16 years ago

"Info Page" setting he talks about is:

Administration tab > Management sub-tab > Web Access section > "Enable Info Site"

ck23• 16 years ago

I wonder if Tomato is affected.

I randomize the two mac addresses weekly anyway.

jedsmith• 16 years ago

> I randomize the two mac addresses weekly anyway.

Why?

ck23• 16 years ago

Paranoia.

It's also a guaranteed way to get a new external IP assigned, even when renewing your DHCP lease fails to.

Pent• 16 years ago

So by visiting his blog we are essentially letting him use rebind on our connections? ;)

blinkingled• 16 years ago

My SVN build of DD-WRT has a "No DNS Rebind" setting defaulting to true. Not sure if this prevents the attack - couldn't find easy steps to reproduce in order to verify.

jpcx01• 16 years ago

Some background here would be really nice (for us non device hackers). Who exactly would have DD-WRT on their routers? Is it something you have to install manually?

edit: i should have googled before asking :-). Apparently it's a custom firmware for linksys routers. Looks like you have to go through a lot of trouble to get it installed, so I'm sure the overall userbase is pretty small.

david2777• 16 years ago

I have it installed on my Belkin router because the stock firmware doesn't support Telnet connections. It's pretty great.

reeses• 16 years ago

There was enough demand that Linksys created models just for this purpose (the WRT54GL and friends).

It's an easy upgrade for a technical person. Download custom firmware, upload to router, reboot. The same people who would upgrade their own firmware from Linksys can install dd-wrt, Tomato, hyperwrt, etc. Admittedly, that's a small slice of the population but a large number of people.

jimmyjim• 16 years ago

For what purpose exactly would you want to put custom firmware on it? Why isn't the stock firmware good enough? I've a WRT54G router -- do I have any good reason to use any custom firmware?

I'm guessing it's just for hobbyists -- "just for the fun of it" kind of thing?

johnny222• 16 years ago

If you happen to have an original wrt54gl of version 1.0 or 1.1 you can reasonably use those as well since they ran Linux

The ones that came after switched to vxWorks and really slimmed down on the ram.

Then, then introduced the wrt54GL (the L meaning Linux)

trafficlight• 16 years ago

I work for a small WISP and we install DD-WRT on all of the routers we hand out. It's much easier to manage and diagnose connection problems with DD-WRT than with the default firmware.

JonnieCache• 16 years ago

The best feature for me is the support for unusual wireless topographies. Our house is rented, so I can't go drilling holes in things to route ethernet cable. Instead I've built a wireless mesh network out of several DD-WRT routers, with the bonus of bridging this to the wired switch on each unit. This way the xbox and the kitchen computer can connect to the internet, which comes in upstairs, with no fuss. You can also do lots of fun point-to-point stuff. With a decent aerial and line of sight you can throw wifi for 2 miles or more using consumer routers.

http://www.dd-wrt.com/wiki/index.php/Linking_Routers

a close second is the SNMP server, allowing me to use this OSX dashboard widget to get a graph of incoming/outgoing bandwidth usage at the router:

http://www.apple.com/downloads/dashboard/networking_security...

If anyone is wondering which device is generally considered the best balance of price/spec for running these firmwares, its widely agreed to be the Buffalo WHR-HP-G54, which can be had for around £40/$60

EDIT: oh yeah and of course its also an openVPN server. Forgot about that. And if you get one with a USB port you can plug in a HDD and run rsync on it...

jberryman• 16 years ago

For those not familiar with the whole router firmware hacking thing, here is the backstory

http://www.wi-fiplanet.com/tutorials/article.php/3562391/The...

Also in addition to DD-wrt there is openwrt which I've got running on my router, and probably a number of others.

frou_dh• 16 years ago

DD-WRT seemed decidedly "bloated" after I found out about Tomato. Maybe that is unfair or ignorant on my part, but do check out Tomato if you are considering DD-WRT.

http://www.polarcloud.com/tomato

drivebyacct23• 16 years ago

Only if you're fortunate enough to have a supported device. :(

bconway• 16 years ago

Both OpenWRT and Tomato USB (http://tomatousb.org/) feature broader device support (via a 2.6 kernel). I prefer the latter.

djacobs2• 16 years ago

Why are the only routers supported using 802.11G? I got one of the Buffalo 300N routers and was looking forward to trying this instead of DD-WRT.

nuclear_eclipse• 16 years ago

I assume it's because the developers of Tomato don't have any of the newer routers to attempt supporting them. There are a few other options for the G300NH, including OpenWRT, but I've just decided to stick with DD-WRT because it seems to have the best overall feature set.

djacobs2• 16 years ago

Is there a solution to this yet? He says it affects you whether or not you have the info page enabled.

EastSmith• 16 years ago

The solution is to password protect the info page. I also checked if there is new firmware. Also, on my Buffalo I just set up SSH and stopped httpd. Didn't know how to do it, so I read here http://www.dd-wrt.com/wiki/index.php/Telnet/SSH_and_the_comm... and here http://www.howtoforge.com/ssh_key_based_logins_putty

DD-WRT, I Know Where You Live

Related Stories