 |
FON Boards The Fonero meeting point
|
| View previous topic :: View next topic |
| Author |
Message |
AustinTX FON-FRIENDS

Joined: 24 Feb 2006 Posts: 2680 Location: Austin, Texass
|
Posted: Mon Jul 31, 2006 00:59 Post subject: |
|
|
| dioid wrote: | | Ok, I only see two MAC addresses on my FON basic 0.6.6 router, but they seem to correspond to LAN MAC and Wireless MAC in your case. Could the nvram setting for il0macaddr be some old residue from when you ran FON basic (if you ever did)? You could also match the mac addresses with output from ifconfig to check that they're the ones you're really using. | It's still a mystery to me. That wierd MAC address loaded in "NVRAM il0macaddr" does not grep up in any of the text ifconfig spits out. Nor does it correspond with any MAC addresses of the other wireless devices in the house or the two other routers
| dioid wrote: | I get a new chilli.conf about once per day from FON but the only thing in it that changes are the numbers on the uamserver line, it looks something like this:
| Ahh, cool. This is slightly different from what I had. Good to keep up to date.
| dioid wrote: | | So I think that this last line (where I changed some numbers) is some kind of identification of your router so they can see that it's up and running when you log in to it from the wifi interface. It might be that it's only used for Bill's to get their share of the fee or for the travel log. | Oh, boy I hope not. Payment should not depend on entering a unique login page url. That's just dumb. I could craft a shortcut on my desktop to launch the browser into my friend's or my own Bill login page and make sure all payments go to him or myself!
I'll be on the lookout for this, but hopefully it's just some randomized string to ensure unique httpS sessions...  _________________ Well, as Revolutions go, this one has certainly been revolting!
Linus || WRT54GL @ 228Mhz || DD-WRT v24 Beta (01/15/07) std
My background: ISP NOC Tech, DSL - ISDN - Dialup - Web Hosting
[ El Fon Blog ][ RSS Feed ][ austintx@elfonblog.cjb.net ] |
|
| Back to top |
|
 |
Strolls Fonero A
Joined: 28 Jul 2006 Posts: 35
|
Posted: Mon Jul 31, 2006 01:05 Post subject: |
|
|
| AustinTX wrote: | | Strolls wrote: | | I note that two of those (password?) fields are the same - 9vy1YR4qHb9UMOtZzfGBk.. appears twice. | Yeah, perhaps someone used the same password, but who knows. However, | Code: | 9vy1YR4qHb9UMOtZzfGBk..
9vy1YR4qHb9UMOhtZzGBk.. | don't actually match...  |
Ooops... my bad. They're amazingly close, tho'!
Anyway, if they did match, this would surely indicate matching passwords - that's how /etc/passwd works.
It looks like they're hashing in a standard manner, but both usernames & passwords, which is unusual.
Basically these are easy to crack using a dictionary or precompiled-dictionary attack, but only if users use common words as their passwords. The tendency of users to do this is why most Unix systems these days use the "shadow" /etc/passwd- file, which is only accessable to root. Storing the passwords like this is practically impossible to brute-force, however, so you can leave hashed passwords lying around and users will still be safe if they've chosen good strong passwords.
Stroller. |
|
| Back to top |
|
 |
Strolls Fonero A
Joined: 28 Jul 2006 Posts: 35
|
Posted: Mon Jul 31, 2006 01:18 Post subject: |
|
|
| dioid wrote: | ...I get a new chilli.conf about once per day from FON but the only thing in it that changes are the numbers on the uamserver line... | Code: | ...
uamserver https://login.fon.com/1743c93b9e54b45ff731229e978f70ee/cp/index.php |
So I think that this last line (where I changed some numbers) is some kind of identification of your router so they can see that it's up and running when you log in to it from the wifi interface... |
That's intriguing.
I take it that this is altered by /bin/thinclient??
Stroller. |
|
| Back to top |
|
 |
dioid Fonero C
Joined: 10 Jul 2006 Posts: 109 Location: Linköping, Sweden
|
Posted: Mon Jul 31, 2006 01:29 Post subject: |
|
|
| Strolls wrote: | | dioid wrote: | ...I get a new chilli.conf about once per day from FON but the only thing in it that changes are the numbers on the uamserver line... | Code: | ...
uamserver https://login.fon.com/1743c93b9e54b45ff731229e978f70ee/cp/index.php |
So I think that this last line (where I changed some numbers) is some kind of identification of your router so they can see that it's up and running when you log in to it from the wifi interface... |
That's intriguing.
I take it that this is altered by /bin/thinclient??
Stroller. |
No, in fact not by /bin/thinclient but by /etc/init.d/chillispot which is started from /etc/init.d/S56redirect and is constantly running on the router, but sleeping most of the time. It checks that chilli is up and running every 10 seconds, and if not it will restart it. Then approximately once per day it will run the function radconfig in that script that downloads chilli.conf and checks if it is different from the one in /etc and if so replaces it with the new version.
Even if you didn't check if it changed yourself it will write its action to /var/log/chilli_loop.log each line ending in NO RELOAD means it loaded chilli.conf and found no difference and thus didn't replace it. Each line ending in RELOAD means it downloaded and replaced. Then there are lines for START when you reboot and RESTART if it didn't find chilli running and restarted it. _________________ status: Linus
setup: TP RJ-45 10Mbit ethernet connection in wall » WRT54GL with FON ))
firmware: FON Firmware (Beta 0.6.6)
link: Static IP ethernet 10><10 Mbit/s
ISP: visit.se
wlan devices: Fujitsu-Siemens Amilo A7640W laptop, Dell Latitude D420 laptop
 |
|
| Back to top |
|
 |
AustinTX FON-FRIENDS

Joined: 24 Feb 2006 Posts: 2680 Location: Austin, Texass
|
Posted: Mon Jul 31, 2006 01:35 Post subject: |
|
|
| Strolls wrote: | | Anyway, if they did match, this would surely indicate matching passwords - that's how /etc/passwd works. | I wouldn't read too much into it. I mixed the lines up before I peppered them with random characters, so I may have just duplicated one instead of moving it. Also, can we be sure that /etc/passwd and these strings are encrypted with the same method?  _________________ Well, as Revolutions go, this one has certainly been revolting!
Linus || WRT54GL @ 228Mhz || DD-WRT v24 Beta (01/15/07) std
My background: ISP NOC Tech, DSL - ISDN - Dialup - Web Hosting
[ El Fon Blog ][ RSS Feed ][ austintx@elfonblog.cjb.net ] |
|
| Back to top |
|
 |
Strolls Fonero A
Joined: 28 Jul 2006 Posts: 35
|
Posted: Mon Jul 31, 2006 01:53 Post subject: |
|
|
| AustinTX wrote: | ...The message I am still recieving on the social router page is:
MYSTERY SOLVED: fon's complaint was that I had not clicked "here" and downloaded the latest firmware, which it only allows me to do after entering my Linus username and clicking a checkbox that I agree to their TOS (.pdf). But I had allready downloaded the firmware. It never occurred to me until now to download it again... |
Ummm... are you sure this isn't because you were sending the fonrev=0 message back? If you've downloaded the firmware before, I don't see how downloading again should make any difference... unless FON are giving you a couple of days in which to update. I'll bet if you continued sending back your fonrev=0 heartbeat then you'd soon see that message again.
Stroller. |
|
| Back to top |
|
 |
dioid Fonero C
Joined: 10 Jul 2006 Posts: 109 Location: Linköping, Sweden
|
Posted: Mon Jul 31, 2006 02:02 Post subject: |
|
|
| AustinTX wrote: | It's still a mystery to me. That wierd MAC address loaded in "NVRAM il0macaddr" does not grep up in any of the text ifconfig spits out. Nor does it correspond with any MAC addresses of the other wireless devices in the house or the two other routers |
It's not 00:90:4c:5f:00:2a is it? According to startup scripts for FON 0.6.6 it checks if it is that MAC address and if so changes to et0macaddr + 2, apparently that's some kind of default MAC address for the wifi chip. Perhaps DD-WRT just doesn't change it.
| AustinTX wrote: | | dioid wrote: | | So I think that this last line (where I changed some numbers) is some kind of identification of your router so they can see that it's up and running when you log in to it from the wifi interface. It might be that it's only used for Bill's to get their share of the fee or for the travel log. | Oh, boy I hope not. Payment should not depend on entering a unique login page url. That's just dumb. I could craft a shortcut on my desktop to launch the browser into my friend's or my own Bill login page and make sure all payments go to him or myself!
I'll be on the lookout for this, but hopefully it's just some randomized string to ensure unique httpS sessions...  | You're correct, it would be stupid to use it for accounting. I've experimented with using some old chilli.conf and it will still let me in and everything looks as usual in my Travel log and it lists me as logged in. This might be the real heartbeat though, they'll see that you actually use the chilli.conf they send to you. So it will be a little bit more cumbersome to fake it, especially if /usr/sbin/chilli_radconfig is something specific for the FON firmware and not available in e.g. DD-WRT.
But on the other hand, maybe we're just paranoid and they don't care about heartbeat at all. This thinclient is just a way to implement the remote management and chillispot script downloading chilli.conf is a way to update uamallowed (sites you can visit without logging in).
Well, good thing you finally got the "my Social router" fields editable and it turned out to have nothing to do with a heartbeat function. _________________ status: Linus
setup: TP RJ-45 10Mbit ethernet connection in wall » WRT54GL with FON ))
firmware: FON Firmware (Beta 0.6.6)
link: Static IP ethernet 10><10 Mbit/s
ISP: visit.se
wlan devices: Fujitsu-Siemens Amilo A7640W laptop, Dell Latitude D420 laptop
 |
|
| Back to top |
|
 |
AustinTX FON-FRIENDS

Joined: 24 Feb 2006 Posts: 2680 Location: Austin, Texass
|
Posted: Mon Jul 31, 2006 02:14 Post subject: |
|
|
| Strolls wrote: | | Ummm... are you sure this isn't because you were sending the fonrev=0 message back? If you've downloaded the firmware before, I don't see how downloading again should make any difference... unless FON are giving you a couple of days in which to update. I'll bet if you continued sending back your fonrev=0 heartbeat then you'd soon see that message again.Stroller. | I'd been sending fonrev=1 since last night with no luck. The very instant I checkmarked "I agree" and clicked to download the software, the message dissapeared and I was able to enter local users. Clearly, they wanted to document that I had downloaded the software after agreeing to their terms. _________________ Well, as Revolutions go, this one has certainly been revolting!
Linus || WRT54GL @ 228Mhz || DD-WRT v24 Beta (01/15/07) std
My background: ISP NOC Tech, DSL - ISDN - Dialup - Web Hosting
[ El Fon Blog ][ RSS Feed ][ austintx@elfonblog.cjb.net ] |
|
| Back to top |
|
 |
AustinTX FON-FRIENDS

Joined: 24 Feb 2006 Posts: 2680 Location: Austin, Texass
|
Posted: Mon Jul 31, 2006 02:17 Post subject: |
|
|
| dioid wrote: | | It's not 00:90:4c:5f:00:2a is it? According to startup scripts for FON 0.6.6 it checks if it is that MAC address and if so changes to et0macaddr + 2, apparently that's some kind of default MAC address for the wifi chip. Perhaps DD-WRT just doesn't change it. | That's it. Mystery solved, I guess. DD-WRT doesn't use it, but it does leave that value in the NVRAM variable.
| dioid wrote: | This might be the real heartbeat though, they'll see that you actually use the chilli.conf they send to you. So it will be a little bit more cumbersome to fake it, especially if /usr/sbin/chilli_radconfig is something specific for the FON firmware and not available in e.g. DD-WRT.
| Shhhh! In the unlikely event that fon is following this conversation, we should just stick to discussion on ways to break this Big Brother crap, not ways to make it harder!  _________________ Well, as Revolutions go, this one has certainly been revolting!
Linus || WRT54GL @ 228Mhz || DD-WRT v24 Beta (01/15/07) std
My background: ISP NOC Tech, DSL - ISDN - Dialup - Web Hosting
[ El Fon Blog ][ RSS Feed ][ austintx@elfonblog.cjb.net ]
Last edited by AustinTX on Mon Jul 31, 2006 22:29; edited 1 time in total |
|
| Back to top |
|
 |
dema Fonero Pub A

Joined: 09 Jun 2006 Posts: 188 Location: Lamporecchio (pt) - ITALY
|
Posted: Mon Jul 31, 2006 17:47 Post subject: |
|
|
Now , let's say the final script for heartbeat to be included in dd-wrt.
step 1 )
Enable JFFS2 in the administration--->management
Enable cron in the administration managment
step 2)
Download the source of fonbasic 0.6.6 in a computer. Decompress the tar.bz2 archive.Copy the file FONbasic/package/base-files/default/etc/dropbear/key into the /tmp directory of the wrt54gs. To do this I advise you to put the key in a web site and retrieve with the wget command within the console.
step 3)
execute the following command from the console | Code: | | echo "mode='start' wlmac='the mac you registered your hot spot' mac='the mac you register your hotspot -2' fonrev='1' firmware='0.6.6' chillver='1.0-1' thclver='1.0'" | ssh -T -p 1937 -i /key openwrt@download.fon.com |
Let's explain this above.
Well is pretty self explanatory indeed....Uhmmm let's see .
To get the correct wlmac you can give a | Code: | | nvram show | grep chilli_radiusnasid |
To get the mac use this trick : open the windows calculator , switch it to advanced (or scientific I don't remember ) chose exadecimal and type the last two numbers of mac address . Suppose it's AE . Subtract 2 and the result will be AC. Put the first 10 mumbers of wlmac in mac and change only the last 2 numbers.
The rest you can copy exactly the code.
Whatch the result on the console screen. It should give you this | Code: | rm -f /tmp/.thinclient.sh
exit |
step 4)
Go to user_zone in the internet , you should get rid of | Code: | | Attention! We have detected that your router is operating with the FON Advanced software. We are not psychics, but if you were capable of installing FON Advanced, we predict with 99% certainty that you will be able to successfully download FON Basic. You will need it to configure the following parameters: |
now assign the name to your hotspot and configure your landing page which should be visible prior to login (replace the martin varsavsky page)
step 5)
from the console execute the following command
| Code: |
echo "mode='cron' wlmac='the mac you registered your hot spot' mac='the mac you register your hotspot -2' fonrev='1' firmware='0.6.6' " | ssh -T -p 1937 -i /key openwrt@download.fon.com |
you should see the custom commands fon send you to change your ssid and your uamallowed chilli parameters.
step 6)
Build a script to be executed by cron inside the router.
type this | Code: |
echo " echo "mode='cron' wlmac='the mac you registered your hot spot' mac='the mac you register your hotspot -2' fonrev='1' firmware='0.6.6' " | ssh -T -p 1937 -i /key openwrt@download.fon.com" > /tmp/hb.sh |
verify with should give you the string you typed before.
make hb.sh executable with
type this in the console | Code: |
echo ' 9 * * * * root /tmp/./hb.sh > /tmp/test.txt' >> /tmp/crontab |
verify that crontab has been change with cat /tmp/etc/crontab should looks likes this | Code: | PATH=/sbin:/bin:/usr/sbin:/usr/bin
9 * * * * root /tmp/hb.sh > /tmp/test.txt |
Send and kill to cron daemon and restart cron | Code: |
killall -9 crond; crond |
BEWARE IF DD-WRT BUILD IS EARLIER THAN JUNE 2006 CHANGE CROND TO CRON
step 7)
check you syslog for the correct functioning of heartbeat script.
-------------------------------------------------------------------------
now , maybe i forget something , and do not blame for this. I just tried to gather some conclusions to this thread. I tried this in my 3 routers . Two of them have a similar process running to an attached linux server. One router have exactly the same setup described above. _________________ status: Linus
setup: ADSL2MUE linksys » Linksys WRT54GL
firmware: dd-wrt v23 sp2 09/15/06 std nokaid FON compliant
link: 1024><256 kbit/s
ISP: NGI Milano - Italy
wlan devices: apple mac book
callme on skype
Proud member of the "Borat" english speakers |
|
| Back to top |
|
 |
Larvitz Fonero Reg
Joined: 31 Jul 2006 Posts: 1
|
Posted: Mon Jul 31, 2006 21:25 Post subject: |
|
|
| dont work for me...message in userarea dont disappear |
|
| Back to top |
|
 |
AustinTX FON-FRIENDS

Joined: 24 Feb 2006 Posts: 2680 Location: Austin, Texass
|
Posted: Mon Jul 31, 2006 21:40 Post subject: |
|
|
| Larvitz wrote: | | dont work for me...message in userarea dont disappear | Paste that message in here, please. _________________ Well, as Revolutions go, this one has certainly been revolting!
Linus || WRT54GL @ 228Mhz || DD-WRT v24 Beta (01/15/07) std
My background: ISP NOC Tech, DSL - ISDN - Dialup - Web Hosting
[ El Fon Blog ][ RSS Feed ][ austintx@elfonblog.cjb.net ] |
|
| Back to top |
|
 |
dema Fonero Pub A

Joined: 09 Jun 2006 Posts: 188 Location: Lamporecchio (pt) - ITALY
|
Posted: Mon Jul 31, 2006 22:24 Post subject: |
|
|
Hey guys , checking my logs here's what I found starting from this afternoon.
| Code: | Fatal error: Call to undefined function: str_pos() in /home/openwrt/bin/logger.
php on line 9
rm -f /tmp/.thinclient.sh
exit
|
Maybe is worth to advise "chicos" @ FON headquarter ? _________________ status: Linus
setup: ADSL2MUE linksys » Linksys WRT54GL
firmware: dd-wrt v23 sp2 09/15/06 std nokaid FON compliant
link: 1024><256 kbit/s
ISP: NGI Milano - Italy
wlan devices: apple mac book
callme on skype
Proud member of the "Borat" english speakers |
|
| Back to top |
|
 |
AustinTX FON-FRIENDS

Joined: 24 Feb 2006 Posts: 2680 Location: Austin, Texass
|
Posted: Mon Jul 31, 2006 22:28 Post subject: |
|
|
| dema wrote: | | Maybe is worth to advise "chicos" @ FON headquarter ? | Would it be equally worthwhile to notify them that I always get an error when I log out of their "Socialist Homepage"?
http://en.fon.com/lib/tools/action.php?action=LOGOUT
| Quote: | Warning: Cannot modify header information - headers already sent by (output started at /mnt/nfs/web/web_production/lib/user/User.php:1) in /mnt/nfs/web/web_production/lib/tools/action.php on line 1246
|
_________________ Well, as Revolutions go, this one has certainly been revolting!
Linus || WRT54GL @ 228Mhz || DD-WRT v24 Beta (01/15/07) std
My background: ISP NOC Tech, DSL - ISDN - Dialup - Web Hosting
[ El Fon Blog ][ RSS Feed ][ austintx@elfonblog.cjb.net ] |
|
| Back to top |
|
 |
dema Fonero Pub A

Joined: 09 Jun 2006 Posts: 188 Location: Lamporecchio (pt) - ITALY
|
Posted: Mon Jul 31, 2006 22:34 Post subject: |
|
|
And maybe guys @ FON are too much busy to ship out routers.
Here the email I sent them on 24/07/2006 still unanswered
| Quote: |
Hola,
I have 3 FON spot up and running since mid june 2006. None of them are
settled up with your firmware , but two with a modification of DD-wrt
and one is self made with a linux host.
I noticed that none of them are in the FON map . Maybe this is due to
lack of your heartbeat ? If this is the case , I can install a script
for heartbeating my routers with your servers, but I won't install
your firmware , since I want full control on my own machines.
I checked the source and know howto build the script , but a feedback
from some of your tech fellows would be highly appreciated.
Waiting yr kind reply .
Cheers
Anton |
_________________ status: Linus
setup: ADSL2MUE linksys » Linksys WRT54GL
firmware: dd-wrt v23 sp2 09/15/06 std nokaid FON compliant
link: 1024><256 kbit/s
ISP: NGI Milano - Italy
wlan devices: apple mac book
callme on skype
Proud member of the "Borat" english speakers |
|
| Back to top |
|
 |
dema Fonero Pub A

Joined: 09 Jun 2006 Posts: 188 Location: Lamporecchio (pt) - ITALY
|
Posted: Tue Aug 01, 2006 11:50 Post subject: |
|
|
I need to amend what i wrote yesterday .
Infact all that I wrote is correct , but when you reboot everything get cancelled.
Now I thought at two solutions .
1)enable jffs partition , but with dd-wrt normal , you have no space to write.
2)compile a startup script and execute with rc_startup , but it shouldn't be good , because everytime you need to download the rsa key.
Conclusion : I'm confused
My actual setup is to make the script executed in a cron base by a linux box behind the fon router. But I'm aware that wouldnt be the ideal configuration for everybody.
I think that time has come for us to compile a custom image of dd-wrt , disabling all the stuff we don't need , freeing the memory and make it available as OPENFON firmware.
This is a little beyond my skills but I'm sure that some hacker here can get this task and make it grow.
How does it sound to you ? _________________ status: Linus
setup: ADSL2MUE linksys » Linksys WRT54GL
firmware: dd-wrt v23 sp2 09/15/06 std nokaid FON compliant
link: 1024><256 kbit/s
ISP: NGI Milano - Italy
wlan devices: apple mac book
callme on skype
Proud member of the "Borat" english speakers |
|
| Back to top |
|
 |
fulbrich Fonero B

Joined: 06 Jun 2006 Posts: 92 Location: NRW, Germany
|
Posted: Tue Aug 01, 2006 12:29 Post subject: |
|
|
| dema wrote: |
1)enable jffs partition , but with dd-wrt normal , you have no space to |
Hello,
I just would like to mention, that I donated some Euro in june and asked BS for a "V23SP1_standard version" without KAID compiled in. Now I have enought space to write to jffs. _________________ Tschüs,
Frank
---------------------------------
status: former Linus quitted 04.July.2006 due to legal concers.
setup: - » -
firmware:
|
|
| Back to top |
|
 |
Ross Fonero Pub B
Joined: 09 Feb 2006 Posts: 387
|
Posted: Tue Aug 01, 2006 12:51 Post subject: |
|
|
| Dema, I received your e-mail but I'm not sure how to reply, I was waiting for some input from co-workers. I'm working to help Fonero's get their hotspots running with the official firmware, not work around it. |
|
| Back to top |
|
 |
dioid Fonero C
Joined: 10 Jul 2006 Posts: 109 Location: Linköping, Sweden
|
Posted: Tue Aug 01, 2006 17:09 Post subject: |
|
|
| dema wrote: | Hey guys , checking my logs here's what I found starting from this afternoon.
| Code: | Fatal error: Call to undefined function: str_pos() in /home/openwrt/bin/logger.
php on line 9
rm -f /tmp/.thinclient.sh
exit
|
Maybe is worth to advise "chicos" @ FON headquarter ? |
If you did, it helped. It started yesterday afternoon and ended today about lunchtime, for me. _________________ status: Linus
setup: TP RJ-45 10Mbit ethernet connection in wall » WRT54GL with FON ))
firmware: FON Firmware (Beta 0.6.6)
link: Static IP ethernet 10><10 Mbit/s
ISP: visit.se
wlan devices: Fujitsu-Siemens Amilo A7640W laptop, Dell Latitude D420 laptop
 |
|
| Back to top |
|
 |
dema Fonero Pub A

Joined: 09 Jun 2006 Posts: 188 Location: Lamporecchio (pt) - ITALY
|
Posted: Tue Aug 01, 2006 17:09 Post subject: |
|
|
| Ross wrote: | | Dema, I received your e-mail but I'm not sure how to reply, I was waiting for some input from co-workers. I'm working to help Fonero's get their hotspots running with the official firmware, not work around it. |
Ross I'm not trying to trick FON. I'm trying to make dd-wrt working with FON .
This sounds so different to me. I love dd-wrt , I think brainslayer is doing a superb work with this piece of firmware and I love FON project too.
For the masses is good for you to tweak "your" firmware ( indeed is not yours , it's openwrt with some scripts made by you ) , but in a free world i want to be free to act as I please.
And because the thought is free , I discuss with other in this forum.
You see Ross , my mail was about maps , because I found strange not to find my 3 hotspots ( yes 3 and only one with your discounted router payed 25 euro + 25 freight ) that are up and running with uptime of 99% since mid june 2006.
I think I have contributed enough to FON project.
Honestly. _________________ status: Linus
setup: ADSL2MUE linksys » Linksys WRT54GL
firmware: dd-wrt v23 sp2 09/15/06 std nokaid FON compliant
link: 1024><256 kbit/s
ISP: NGI Milano - Italy
wlan devices: apple mac book
callme on skype
Proud member of the "Borat" english speakers |
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
|