Recently I had a Tablo Dual Lite OTA DVR appliance fall into my hands from a family member after its wireless started to act up. Doing what I do best, I decided to tear it apart and figure out how it works and in doing so found a few methods to gain root access into the stock firmware. One thing I did not expect to find, however, is an engineering backdoor that could be hijacked to provide an easy method for root access.
Continue readingAfter requests from the online community I am glad to announce that a downgrade method has been found for T-Mobile branded Franklin Wireless R717 Access Points on firmware 2602. In this I will go over how I found this method, how to do the downgrade, and links to the required files.
Continue readingI recently acquired a T-Mobile T9 mobile hotspot from a friend who used it with their Test Drive program, and like I do with most embedded devices I poked around. This thread will go over my software findings, and will give you the information needed to gain root access and SIM Unlock the device.
Continue readingHere we go again, this time with a new way to root the Cisco Meraki MR18. Note that this method will ONLY work on the MR18, and I am not responsible for any damaged devices if you want to try this on something else as it will not work!
If you haven’t noticed, in my spare time I really enjoy breaking into embedded devices for the fun of things. Over the past year, I have spent a ton of time rooting the Cisco Meraki MR18, and today I get the chance to publicly disclose my findings.
To start, let me note by saying I have properly disclosed this issue to Cisco Meraki months ago, but due to the fact they are no longer replying to my emails or honoring their own Bug Bounty, I have decided to publicly disclose this after waiting over 90 days since their last reply. Hopefully one of these days I will write up the process I used to find this “exploit”.
Every now and then I come across some interesting devices, one of which was the Cisco Air-OEAP602 “Access Point”. This little guy has an impressive spec sheet with a BCM4718A1 CPU running at 480Mhz, 16MB of flash, and 64MB of RAM but sadly the stock firmware lacks many standard features. Obviously as an enterprise offering it has unique things such as OfficeExtend, but what good are they if they are closed source? Time to hack this thing!
Recently I purchased a few “Smart” LEDs from a site called LimitlessLED due to positive feedback from a close friend. After all was said and done, I walked away with 3 RGB LED Bulbs, a remote control, and one of their cool WiFi Receiver Bridges. After waiting a few weeks everything showed up and was working fine out of the box, except the WiFi Bridge. Thus started my journey to figure out what in the hell was going on which ended with me converting the adapter to work from a Raspberry Pi.
I recently got my hands on a nice new NAS box that included a few QLogic quad port 4gb fibre channel cards and I decided to mess with the idea of upgrading my SAN from Ethernet to Fiber. The problem is the only real way to do this without too much pain is to use SCST. For those who are interested in setting that up, I followed this Tutorial and I had no issues getting it going on a 3.14.5 kernel… minus the init.d startup script not working, which I have a fix for. So, if you have issues with SCST not running at startup in Debian, this post is for you!
If you have a handful of servers you need to add to Saltstack for management purposes, and don’t want to spend 10 minutes per node setting it up the Saltstack minion, you normally do one of two things. One, create a script to automate the process for you or Two, streamline the process to a single command. Well I did the latter, and felt like sharing it so you don’t have to spend 5 minutes dealing with regular expressions and sed.
This past week I purchased a lovely Dell C6100 unit on ebay, come to find out it is unable to take any official dell updates for the BIOS or BCM module. As my unit had BIOS version 1.04 (from 2009) I was unable to upgrade my CPU’s to hex-cores. After some research, I found out the reason was because my “C6100” was actually a DCS model. DCS models are re-branded or resold C6100’s that are not registered under dell. You can test for a DCS node by checking the service tag on dell’s website. If it returns not found, chances are you have a DCS model. But, after spending a while on the internet I was able to update both my BIOS and BCM firmwares to the latest dell releases!