Detecting Persistent Threats on DrayTek Devices
Reverse engineers DrayTek router firmware to uncover dynamic module persistence mechanisms and presents an open-source memory integrity detection tool.
Summary
Targeting Edge Security Appliances
Threat actors increasingly compromise network perimeter devices such as VPN concentrators, routers, and firewalls. Many edge devices run proprietary, closed-source firmware that lacks visibility and integrity verification mechanisms.
Reverse Engineering DrayTek Firmware
Analyzing proprietary firmware across hundreds of thousands of Internet-exposed DrayTek routers revealed that the underlying RTOS kernel supports dynamic module loading. Uploaded code modules persist across reboots and firmware upgrades.
Developing Malicious Modules for Persistence
Researchers demonstrated how chaining newly discovered vulnerabilities with custom kernel modules establishes stealthy, durable persistence within edge routing infrastructure.
Memory Integrity Verification and Tooling
To counter persistent edge compromises, researchers built and released an open-source inspection module that validates loaded RTOS memory modules, restoring visibility for defenders.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Creator Stage·21 min
Craig Heffner
Breaks down practical software and hardware techniques for decrypting obfuscated and encrypted IoT firmware without requiring advanced cryptography math.
Creator Stage·25 min
O. Gianatiempo · G. Aznarez
Discloses two unauthenticated remote code execution vulnerabilities in Draytek routers (CVE-2024-51138 and CVE-2024-51139) that enable full edge device takeovers.