const {P,H2,H3,Callout,Code,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/FIRMWARE" date="2026-08-07" title="The finding is often in /etc" lede="Default passwords, Wi-Fi PSKs, cloud URLs, update keys in world-readable files. You do not need Hex-Rays to read a config. You need to look."/>
<P>After unpack, analysts sprint to the biggest stripped ELF. Meanwhile <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>/etc/shadow</span> is still <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>admin:admin</span>, and the update HMAC sits in <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>update.conf</span> next to a comment that says “do not ship.” We have shipped reports where the decompiler found nothing and the tar found everything.</P>
<Callout>Configs in the image are what the vendor shipped. They are in-scope for an authorized firmware review. They are not a license to log into a customer’s deployed fleet.</Callout>
<H2>Where we look, every time</H2>
<Ul items={[
'/etc/passwd, shadow, dropbear and ssh host keys',
'wpa_supplicant, hostapd, vendor wifi JSON',
'cloud endpoints, device certs, API tokens in plain JSON',
'crontab, init scripts that curl | sh',
'NVRAM defaults: a file that looks like a dump of factory env'
]}/>
<H3>NVRAM is not mystical</H3>
<P>On a lot of gateways, “NVRAM” is a partition plus a userspace tool that prints key=value. The factory defaults are often a file in the squashfs. If that file contains the same WPS PIN for every SKU, that is a finding. If it is empty and the values live only on-device, write “not in image.” Empty is allowed. Fiction is not.</P>
<H2>A 20-minute inventory</H2>
<Code lang="sh">{`# after unsquashfs / unblob
find squashfs-root -type f | wc -l
grep -RInE 'password|passwd|psk|secret|api[_-]?key' squashfs-root/etc | head
find squashfs-root -name '*.key' -o -name '*id_dropbear*'
ls -l squashfs-root/etc/dropbear 2>/dev/null`}</Code>
<P>Then read the hits. Most are false. The ones that are not go in the register with path and a quote. Do not paste a live customer token into a slide. Redact in the PDF; keep the original path in the archive they own.</P>
<H2>What is not a config finding</H2>
<P>An example password in a README the vendor never installs. A test key under <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>/usr/share/doc</span>. Say so. Inflating the count with documentation strings is how you lose the next engagement.</P>
<Related items={[
['post-firmware.html','Unpacking firmware'],
['post-fw-boot.html','The boot chain is the map']
]}/>
</>;
}
window.Article=Article;
mountPost();