Video summary

I Hacked This Amazon Router. What I Found Should be Illegal.

Main summary

Key takeaways

Technology

Goal / Setup (Bug-hunting approach)

  • The creator buys cheap embedded routers/IoT devices specifically to find security bugs.
  • They focus on a popular Tenda router, chosen partly because of its large customer base (as suggested by review counts), implying it’s commonly used at home.

Initial Target: Undocumented Login “Backdoor Password” (No Authentication)

  • An earlier-reported issue claimed the router had an undocumented password that allowed access without authentication.
  • The claimed behavior enabled an attacker to reach the router’s web front page—enough to change settings such as:
    • Wi‑Fi password
    • IP/network configuration
  • The creator verifies that firmware is obtainable from the vendor site (normal update behavior), then begins analysis.

Firmware Analysis Workflow (Technical Method)

  1. Download firmware

    • Router firmware is downloaded from the vendor site.

  2. Extract embedded components

    • Uses binwalk to extract embedded files/components from the firmware image.

  3. Identify filesystem content

    • Finds a SquashFS filesystem inside the firmware.

  4. Locate authentication logic

    • Examines the router’s web server binary (HTTPD) to find login/password handling.
    • Uses Ghidra to reverse engineer the machine code into more readable pseudo‑C.
    • Searches within the decompiled logic for:
      • login/password checks
      • hardcoded/hidden values

Discovery: Additional (More “Nefarious”) Backdoor Credential

While analyzing the httpd login path, the creator finds:

  • A normal password check against an admin password loaded from configuration.
  • A second, separate credential described as “RZ admin” (or similarly labeled), characterized as:
    • Undocumented
    • Not changeable
    • Usable for login (described as “for free” / unauthorized access)

Confirming the linkage in the firmware

  • The creator performs string searching across the extracted SquashFS to find where the backdoor password is referenced.
  • This includes searching other binaries too (e.g., imsd).

How the Backdoor Password Is Constructed (Encoded Credential)

  • The creator finds a file such as Default.config containing the backdoor-related entries.
  • They observe a Tenda-specific pattern:
    • the credential values are Base64-encoded to become the actual login password.

Attempted verification (and why it failed)

  • They attempt to use the discovered Base64-derived password against a purchased router.
  • It does not work because they bought the wrong router version—the credential is not valid for that specific model/release.

Second Investigation: Encrypted Firmware + Different Backdoor Behavior

For another router version (US AC10 V6 / AC10 V6):

  • The firmware appears protected with an OpenSSL encryption blob.
  • This suggests Tenda may be actively hiding firmware contents.

Related public work

  • The creator references other researchers who found multiple vulnerabilities on a related Tenda model (AC18), including bugs enabling code execution.
  • The creator notes they couldn’t directly exploit those findings due to needing specific on-device conditions.

Telnet Enablement Without a Password (Feature-to-Exploit Chain)

A recon-highlighted issue for Tenda AC20:

  • Accessing an HTTP path such as /goform/..../telnet (described as /goform/tellnet) can:
    • enable Telnet without a password

What the creator observes

  • Telnet becomes “enabled,” but they still need a root password to obtain a shell.

Root Password Derivation (MAC-Based Scheme) and Failure Modes

  • A method described via Reddit claims the root password is derived from:
    • the last two parts of the router’s MAC address (obtained via ARP)
    • combined with a Tenda-specific secret string
    • then Base64-encoded
  • The creator’s attempt fails because the secret string varies per model/device family and is not known from public information alone.

Bypassing Firmware Encryption via Serial Console Output During Factory Reset

Key insight:

  • The derived provisioning value (including the secret/encoding input) is printed to the screen during setup/provisioning.
  • Since routers don’t have screens, they instead output to a serial console exposed on PCB pads.

Procedure used

  1. Factory reset
    • Hold the reset button to trigger the factory reset/provisioning flow.
  2. Capture serial output
    • Connect a serial console and stream boot/provision output to a log file.
  3. Extract the credentials
    • Search the log for markers like “step one / magical string” and locate the Base64-encoded password.

Result

  • With the correct root credentials obtained this way, they:
    • log in
    • enable Telnet as root
    • obtain a shell

Decrypting Firmware After Gaining Root

  • With root access, the creator uses a binary described as “Decrypt/D ecry firmware” to decrypt firmware contents.
  • They state they do not publish decryption keys in the video (citing legal concerns).
  • They do note they have keys and may write a blog post after clearing it with a lawyer.

High-Level Takeaway (Framing + Scope Caution)

  • The creator frames the work as educational bug hunting, not direct “don’t use them” messaging.
  • They argue Tenda has had recurring security issues over years, including frequent backdoors/vulnerabilities.
  • They caution that findings may be model/version-specific, not universally applicable across all Tenda routers.

Main Speakers / Sources

Primary source

  • The video creator/researcher (first-person narrator performing reverse engineering and exploitation)

Secondary sources referenced

  • Tenda/Tender vendor firmware download page
  • Public research reports on Tenda models (e.g., AC18/AC20)
  • A Reddit post describing the MAC-based root password derivation method

Original video