Unauthorized firmware modifications in routers are a primary vector for persistent network compromise. We perform deep binary analysis to detect backdoors, hidden services, and supply-chain implants.
Cisco / Juniper / MikroTik / TP-Link / Asus / Netgear / Ubiquiti
OpenWRT / DD-WRT / Industrial SCADA routers (Moxa, Advantech)
MikroTik RB750Gr3 β Suspicious Outbound Proxy Traffic
Router PCB β SPI flash located near CPU
Flash chip removal for direct reading
SPI programmer connected to flash chip
π Finding: Flash dump size: 16MB. MD5 hash verified against vendor checksum β mismatch detected.
π UART console output β suspicious process detected during boot
π JTAG flash extraction β extra code section outside vendor region
π What this shows:
β’ Unauthorized process (PID 1423) acting as SOCKS5 proxy on port 31337
β’ Hidden C2 firewall table rejected by kernel (iptables error)
β’ Modified init script /etc/rc.d/S95netmon (not in original firmware)
Unexpected executable region detected at offset 0x001fee00
Vendor firmware (empty region):
001fee00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Suspect firmware:
001fee00: 3c 1c 80 00 27 9c 12 34 0c 04 56 78 00 00 00 00
001fee10: 8f 99 00 10 03 20 f8 09 6e 65 74 6d 6f 6e 00 00
001fee20: 73 79 6e 63 5f 73 65 72 76 69 63 65 00 00 00 00
Decoded MIPS instructions:
001fee00: 3c 1c 80 00 β lui $gp, 0x8000
001fee04: 27 9c 12 34 β addiu $gp, $gp, 0x1234
001fee08: 0c 04 56 78 β jal 0x1159e0
001fee0c: 00 00 00 00 β nop (delay slot)
001fee10: 8f 99 00 10 β lw $t9, 16($gp)
001fee14: 03 20 f8 09 β jalr $t9
π Findings:
β’ Non-vendor executable code identified in unused flash region
β’ Region originally contained only 0xFF (empty flash)
β’ Now contains MIPS instructions β unauthorized modification confirmed
β’ MIPS function prologue detected: lui, addiu, jal, jalr
β’ Embedded strings reference undocumented services: netmon, sync_service
β’ Region absent in original vendor firmware image
During investigation, we identified evidence of exploitation using the following known vulnerabilities:
Winbox User Enumeration
Discrepancy in response size between connection attempts with valid vs. invalid username allows account enumeration.
β Used for initial reconnaissance (harvesting valid admin usernames)
SMB Service Memory Corruption
Remote, unauthenticated NULL pointer dereference via crafted SMB packets β denial of service.
β Used to crash watchdog service and maintain persistence after reboot
1. CVE-2024-54772 β harvested valid admin usernames
2. Credential brute-force / default password β gained Winbox access
3. Uploaded custom firmware package via /system package update
4. CVE-2024-54952 β crashed watchdog during flash write to bypass rollback
5. Persistent backdoor active after reboot
β’ Failed SMB connections from 45.155.205.233 (CVE-2024-54952 scanning)
β’ Winbox login attempts with usernames: admin, root, user, support
β’ /etc/rc.d/S95netmon β not present in clean firmware (our diff)
β’ Outbound connections to update.mikrotik-service[.]com (not official domain)
Filesystem extraction
Reverse engineering
Entropy analysis
Embedded strings extraction
$ binwalk firmware_dump.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 U-Boot image (32-bit MIPS) 262144 0x40000 Squashfs filesystem (version 4.0, compression: lzma) 15728640 0xF00000 RAW data (high entropy) $ entropy --binary firmware_dump.bin 0.0 - 0.5 : 15.2 MB (normal firmware code) 0.5 - 0.7 : 0.8 MB (compressed) 0.7 - 1.0 : 128 KB (HIGH ENTROPY β suspicious, warrants further analysis) $ strings -n 8 suspicious_region.bin | head -20 netmon_init sync_worker /etc/rc.d/S95netmon update.mikrotik-service.com AES_CTX_init -----BEGIN RSA PRIVATE KEY-----
π Extraction findings:
β’ Squashfs filesystem extracted successfully (347 files, 12 directories)
β’ High-entropy region (128 KB) detected at offset 0xF00000 β not present in vendor firmware
β’ Region requires further analysis (entropy suggests packing or encryption)
β’ Embedded strings reveal: netmon_init, sync_worker, suspicious domain
β’ AES_CTX_init detected β suggests cryptographic operations
β’ RSA private key embedded in suspicious region
Domains: update.mikrotik-service[.]com, sync.router-check[.]net
IPs: 45.155.205.233, 185.130.5.253
File hashes (SHA256):
firmware: 3e8c12a4f6b9d71e2c5a8b3f9e6d1c7a2b4f8e3d6c9a1b5e7f2d4c8a6b3e1f9d
suspicious_region: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c
Submit a request or ask for a confidential quote. Starting from β¬3,500
π All communication encrypted β’ PGP key available on contact page