Feb. 23, 2023, 1:31 p.m. | MalBot

Malware Analysis, News and Indicators - Latest topics malware.news

Hi Folks,


today I'm gonna take a quick look to the TP-Link TL-R483G sold in China.
I've got a chance to have a firmware and config file on Github so I decided to dig into it.

Once unpacked the firmware (standard uboot image), the references on encryption/"save configs" brings me on firmware_backuprestore.lua script file.



firmware_backuprestore.lua

by going straight to the executable, I noticied that the config encrypted file has 0x10 bytes of signature (by reading the typical initialize variables can …

china dig encrypted encryption file firmware github industrial link lua malware analysis router script signature standard tp-link uboot

CyberSOC Technical Lead

@ Integrity360 | Sandyford, Dublin, Ireland

Cyber Security Strategy Consultant

@ Capco | New York City

Cyber Security Senior Consultant

@ Capco | Chicago, IL

Sr. Product Manager

@ MixMode | Remote, US

Corporate Intern - Information Security (Year Round)

@ Associated Bank | US WI Remote

Senior Offensive Security Engineer

@ CoStar Group | US-DC Washington, DC