bk99.de entertain the web since 1997

bk99.de
Own project · NetworksOwn post

La Fonera: a free router, a single quote and the way to SSH

Summary

In February 2007 a La Fonera sat on my desk, the small Wi-Fi router of the Fon community, and I wanted SSH access to it. Fon had locked the device down: settings came via SSH from a Fon server, and only signed firmware could be installed. This post from my old blog explains how tinkerers opened the device anyway, why a single quote was enough and what it teaches about shell code.

The note from 2007

There was not much in my old blog. Under the heading “Nicest router in the blog ;-)” and the subtitle “Equipping the Fon with ssh access” I pointed to three pages where the work had already been done, and closed with the sentence: “Only one thing left to say, once again a gem of new hardware in my room.” This post catches up on what was behind the links. Only Stefan Tomanek’s page survives in the Web Archive; it did not save the two blogs bingobommel.blogspot.com and blog.blase16.de.

What the Fonera was

Fon was a community whose members shared part of their home Wi-Fi with others and in return could use the others’ access points when travelling. La Fonera was the router for it: Fon gave it away on condition that you connected it and let others use it. It provided two networks, a public one with the prefix FON_ and a private, WPA-protected one for your own household.

Technically the FON2100 model was a small MIPS computer: an Atheros AR2315 at 183 MHz, 16 MiB of RAM, 8 MiB of flash, 802.11b/g Wi-Fi and a single network port. RedBoot served as boot loader, and the firmware was a derivative of OpenWrt. For tinkerers it was an ideal toy, if you could get in.

Locked down by remote control

Fon had deliberately locked the Fonera. Settings such as network name or WPA passphrase were made not on the device but on the Fon website. At boot and regularly afterwards the Fonera opened an SSH connection to download.fon.com on port 1937, reported its MAC addresses and firmware version and received shell commands in return, which the script /bin/thinclient then executed. New firmware could only be installed if Fon had signed it.

This was compatible with the GPLv2: Fon published the source code but did not have to hand over the key needed to run your own firmware on the device. Devices like this were a topic in the debate about the GPLv3, which addressed such locks under the term tivoisation.

A single quote opens the device

Stefan Tomanek and Michael Kebe found the way in through their own network name. Fon built a line of shell code from the name entered on the website, put it in single quotes and, for safety, replaced every single quote in the name with \'. On the router this produced, for example:

iwconfig ath0 essid FON_'YOURPUBLICESSID'

The protection was useless, because inside single quotes the shell does not treat a backslash as an escape character. The bash manual says so explicitly: a single quote may not occur between single quotes, even when preceded by a backslash. A single quote in the network name therefore ended the string, and everything after a newline was a new command. You can try this in any shell:

$ echo 'foo\'bar'
>

The shell waits for another quote, because the string already ended after foo\. Since the web form rejected such characters via JavaScript, the two sent the name with the Perl module WWW::Mechanize. Their script shellfon.pl entered a network name that opened the firewall for port 22 and started the SSH server dropbear. After a reboot the Fonera fetched its settings and thereby ran their commands.

echo -e '/usr/sbin/iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT\n/etc/init.d/dropbear' | perl shellfon.pl email passwort

Cat and mouse with Fon

Fon closed the hole on 8 November 2006. The two had prepared for that and looked for ways in via the local web interface. grammofon.pl could open the delivery firmware 0.7.0-4: connect the device directly to the computer, without a network it answered at the link-local address 169.254.255.1, and the password was admin. Because the exploited form field was short, the script assembled the commands on the router in pieces.

As soon as the Fonera reached the internet, it updated itself to 0.7.1-1 and grammofon stopped working. The new version also had a hole, which fondue.pl used. With 0.7.1-2 on 3 January 2007 that one was closed too; a successor called kolofonium had been announced. That was roughly the state of affairs when my Fonera arrived. Which route I took in the end is not recorded in my note.

Later a different route became established: via the RedBoot boot loader, with or without a serial console, and a full OpenWrt instead of the Fon firmware. There was even a dedicated tool for the installation, fon-flash.

What it teaches

The Fonera hole is a textbook case of shell code built from external input, and it has not aged. If you must put values in single quotes, replace every single quote with the sequence '\'', i.e. end the string, an escaped quote, start a new string. In bash, printf %q does this reliably. Better still, do not build shell code at all and pass values as arguments or via configuration files.

The basic principle is also remarkable: a device in your own network that regularly fetches commands from a vendor server and executes them unchecked. Back then Stefan Tomanek recommended commenting out the line . /tmp/.thinclient.sh and collecting the received scripts to see what Fon was sending. Today the same principle is called cloud management and sits in many routers, cameras and smart plugs. My approach then as now: run devices that allow it with OpenWrt, like my access points and my NAS.

Numbers at a glance

  • The note “Nicest router in the blog” was in my old Plone blog, last modified on 4 February 2007.
  • The La Fonera FON2100 had an Atheros AR2315 at 183 MHz, 16 MiB of RAM and 8 MiB of flash.
  • The Fonera fetched its configuration via SSH on port 1937 from download.fon.com.
  • Fon closed the first hole on 8 November 2006; firmware 0.7.1-2 of 3 January 2007 closed the hole used by fondue.pl.
  • In bash, a single quote ends a single-quoted string, even when preceded by a backslash.

References

Remarks

  • This post is based on my short note and above all on the archived version of Stefan Tomanek’s page from January 2007; the hardware details come from the archived device page in the OpenWrt wiki.
  • The Web Archive did not save the photos from my gallery at the time.

Original note in the Web Archive

Own project · 2006

OpenVPN over Wi-Fi: a 266 MHz router at full load

In December 2006 I tested how much my home-built router based on a WRAP board could handle when the Wi-Fi was secured only by OpenVPN. With AES-256, OpenVPN used about 90 percent of the 266 MHz CPU and throughput averaged around 800 kB/s. This post from my old blog shows the measurement, why a small computer hit its limit here and how WireGuard and kernel offload solve the problem today.

Own project · 2026

120,314 emails from 26 years: My mailbox moves into its own archive

In September 2026 I merged Outlook, Thunderbird, Evolution and Cyrus mail from 26 years into a local mail archive running Stalwart and Roundcube. In the end there were 120,314 searchable emails, including more than 11,000 that had long been considered deleted. This post shows why Message-IDs do not detect duplicates, what Thunderbird really does when you delete something and how an archive can stay safe without any cloud.

Own project · 2016

Freifunk in Meerane: my own Gluon site, my own gateways and why I shut it down

From 2015 to 2016 I ran a small Freifunk network in Meerane, with my own Gluon firmware, two gateways of my own and signed updates for the routers. In the end there were six to ten access points with up to ten users per device on a daily average, too few for the effort, and I discontinued the project. This post shows what a Gluon site defines, how mine was built, why the traffic went through a paid VPN back then and what has changed in Gluon and in the law since.