Feb. 23, 2023, 1:31 p.m. | MalBot

Malware Analysis, News and Indicators - Latest topics malware.news

Hi Folks,


today I'm gonna take a quick look to the TP-Link TL-R483G sold in China.
I've got a chance to have a firmware and config file on Github so I decided to dig into it.

Once unpacked the firmware (standard uboot image), the references on encryption/"save configs" brings me on firmware_backuprestore.lua script file.



firmware_backuprestore.lua

by going straight to the executable, I noticied that the config encrypted file has 0x10 bytes of signature (by reading the typical initialize variables can …

china dig encrypted encryption file firmware github industrial link lua malware analysis router script signature standard tp-link uboot

Information Security Engineers

@ D. E. Shaw Research | New York City

Technology Security Analyst

@ Halton Region | Oakville, Ontario, Canada

Senior Cyber Security Analyst

@ Valley Water | San Jose, CA

Cloud Security Engineer

@ City National Bank of Florida | Miami, FL, United States

Principal Security Engineer

@ VIANT | New York City

Associate Detection & Response Analyst

@ Rapid7 | VA Arlington 22203