search

dangowrt / owrt-ubi-installer

OpenWrt firmware installer for the Linksys E8450 aka. Belkin RT3200
GNU General Public License v2.0
393 stars 50 forks source link

Add Warning About New Vendor Firmware? #97

Closed timedroid closed 2 years ago

timedroid commented 2 years ago

From the changelog, it appears firmware 1.2 and above only allow signed upgrades and do not allow downgrading to a previous firmware version.

The RT3200 I bought a few weeks ago came with 1.0.01.101415. I went through the out of the box setup, but did not check the box for automatic firmware upgrades. I'm assuming doing so would eventually leave one without the ability to install OpenWRT? Besides opening it up and connecting to the UART (or maybe only the JTAG).

dangowrt commented 2 years ago

I had a look at the new firmware and also the intermediate firmware (1.1.01.272918 (Unsigned)) which allows flashing the new firmware (1.2.00.273012 (Signed)) and there is no need to issue warnings. The bad news: They are using GnuPG v1.4.7 (because it's still under GPLv2 licence, newer versions of GnuPG are under GPLv3)

The good news: Linksys was kind enough to leave also the private key next to the door and use the same key for encryption and signature. See here

$ binwalk -e FW_RT3200_1.1.01.272918_PROD_unsigned.img
...
$ ls  _FW_RT3200_1.1.01.272918_PROD_unsigned.img.extracted/squashfs-root/root/.gnupg/
gpg.conf  pubring.gpg  random_seed  secring.gpg  trustdb.gpg
$ gpg --import < FW_RT3200_1.1.01.272918_PROD_unsigned.img.extracted/squashfs-root/root/.gnupg/pubring.gpg 
gpg: key 99DAC426DCF76BA1: public key "Aruba recipient <aruba_recipient@linksys.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
$ gpg --import < FW_RT3200_1.1.01.272918_PROD_unsigned.img.extracted/squashfs-root/root/.gnupg/secring.gpg 
gpg: key 99DAC426DCF76BA1: "Aruba recipient <aruba_recipient@linksys.com>" not changed
gpg: key 99DAC426DCF76BA1: secret key imported
gpg: Total number processed: 1
gpg:              unchanged: 1
gpg:       secret keys read: 1
gpg:   secret keys imported: 1

I'm pretty sure uploading the secret key to this repository would be a copyright violation. Having the script download the firmware from Linksys and use binwalk to extract the keyring, import the keys and use them to sign and encrypt the installer would probably be an option...

dangowrt commented 2 years ago

Done. Now shipping signed/encrypted images in v0.6.5.

KA2107 commented 1 year ago

@dangowrt Is there a newer stock firmware that blocks installing OpenWrt UBI using web interface?

I was able to flash UBI Installer v1.0.0 on top of Stock Firmware 1.2 (don't remember the exact version number) and then revert back to stock firmware based on your instructions (I did full backup). I returned the device since the person I bought it for did not want it.

dangowrt commented 1 year ago

I have recently tried flashing v1.0.0 installer on all publicly available and historic versions of the stock firmware, and it all worked. So up to now we are fine.