Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2626 Thanks!
[Music]
we welcome Hal for defeating planned
obsin for Cisco maraki switches thank
you very
[Applause]
much
people maybe
it's
this is ah here we go perfect uh thank
you all for coming I know it's very
early um but uh we'll get down to
business here uh so quick agenda for
this talk um going to give you some
background on how I got involved in this
uh we'll talk about who are moroi their
business model and I'll have a short
political Manifesto um don't worry it's
only about the first third of the talk
then we're going to get into talking
about mari's firmware internals um the
devices that I researched um the custom
firmware that I've come up with and some
future work and
Kudos so the background here it was 2019
and like every aspiring home labber I
wanted 10 GB networking but I wanted it
on the cheap I didn't want to pay for a
proper switch um so I knew there was a
modded firmware available for the maroi
ms220 switch and I found an ms-42 which
is a larger version of the U ms220 on
eBay for £50 and this was before the UK
left the EU so it was like yes don't
even have to pay vat um and uh or duties
and and uh yeah so just you know blindly
assumed it would apply to the hardware
and bought it but now we have to go back
let's talk about maraki they were
founded in 2006 by some MIT graduates um
they were acquired by Cisco in 2012 and
they make networking equipment that's
Cloud managed so if you want to buy a a
switch or an access point a router um IP
camera from them they'll happily sell
that to you um and this is my opinion
only but they're not very good at GPL
compliance um and we'll come back to
that later so mari's business model is
that you have a network that you want to
manage but managing Network assets is
hard so uh maraki will kindly punch a
hole through your knat and make a tunnel
to their Cloud so that you can manage
all your devices through their Cloud so
you buy the hardware you pay a license
to them and you get a dashboard where
you can see all your network assets and
manage them and you look like this cool
llama after you've done that um except
well if you're a Mari customer you
probably know this but to you know to to
hackers it might come as a surprise that
um licenses cost money and Mari is not
going to let you manage uh your
equipment for free but they're really
really really benevolent and so if you
ever uh you know become out of
compliance because you forgot to pay
your invoice or something you've got 30
days uh before they pull the plug on
your network um and that means that all
your devices will not only stop being uh
managed but they'll stop passing packets
and so better pay up within 30 days
because maraki is the captain now I want
to read this quote it's from their
website Cisco maraki may find it
necessary to discontinue products for a
number of reasons including product line
enhancements market demand Technology
Innovation or if the product simply
matures over time and needs to be
replaced by something functionally
richer a few moments later did someone
say Hardware refresh moroi decide to end
of life your hardware and now not only
are you no longer able to purchase the
hardware that you have in your network
but you may no longer be able to
purchase licenses for that Hardware
which means you need to buy new
hardware well what if you say forget the
cloud maybe I'll just manage it myself
maroi say that's the neat part you don't
so the tldr here is that you don't own
your devices what you've got is an
expensive lease and in my opinion moroi
sales salvate at the thought of
deprecating existing products because it
means they get to sell you new ones it
also removes the secondary market for
resale if you purchase a device which is
previously claimed in the moroi
dashboard and the previous owner has not
released that device in the dashboard
you'll be unable to add it to the
dashboard and manage it yourself now
this is maybe not a problem for
legitimate resellers but if you ever
purchase a moroi device say from a
company that's gone bankrupt and the
previous IT department you know was laid
off then the device will still be
claimed in maro's dashboard and you'll
have bought a
break so here's my political Manifesto
moment we need some Sim loog reg
regulation for these devices networking
devices these days typically run Linux
and since Linux is GPL you can request
the source code from the vendor and
build your own firmware but as vendors
are moving towards more secure devices
you may not be able to actually run your
firmware on the device leaving you with
a brick other vendors have or are
considering subscription model similar
to what maraki does and there's no
reason for these devices to become e-w
we need to remember the second R and the
three Rs reuse there's no reason for
these devices to become E-Waste if we
have regulation that says we should be
able to run our own software on them
they shouldn't be locked to the vendor
now that's my political Manifesto slide
over let's get into the actual technical
details so Mari firmware has a boot
process like everything uh the boot
loader varies depending on which
Hardware we're talking about um the MS
20 switch which is sitting here in front
of me is a myip and it uses red boot
maro's newer switches use Arm and they
use uboot when you have UB boot the
environment is compiled into uboot and
there's Auto boot enabled with no delay
so there's no easy way to break into the
system through uboot and a console for
x86 devices they use core boot with a
loader called miles which stands for
Mari intermediate loader for embedded
systems it's based on Pho and it
basically just looks for a fit image
loads the kernel and jumps to it let's
talk about fit images maroi Hardware
sometimes has a two-stage boot process
the first stage will be a boot kernel
that's their term not mine it handles
initializing Hardware it's typically
stored on SPI and it's what the boot ROM
of the uh Asic will read from and it
handles setting up UB reading from nand
it even supports lvm and ext4 and it'll
load in K exac into the second stage
firmware which maraki calls A Part the
part is the real maraki firmware which
manages the hardware connects to mari's
Cloud pulls the configuration and
applies it the ruds is always compiled
into the colonel image both in the boot
kernel and the part there's no separate
partition on flash for
that maroi switch firmwares um because
they're xmit people they developed
something really nice called click
router which replaces a lot of typical
Network functions in Linux I myself am
not a fan but maroi use it in all their
products they also have a monolithic
binary on switches called switch brain
which manages the switch configuration
it basically reads the configuration
file that it pulls from mari's cloud
servers and applies it using click
there's a tunnel created back to the
maraki cloud called M tunnel I think
it's Loosely based on IPC but I haven't
really dug into it too much because they
use TLS seert pinning for everything
even fetching the configuration over M
tunnel and especially when downloading
and upgrading firmware so if you're
thinking about man in- the- middling
mari's configuration or firmware upgrade
process forget that now because it will
fail the target devices that I looked at
in my research are the ms220 which I
have the temp Port version here in front
of me the ms210 and 225 series and the
ms120 series the reason that I looked at
these is because they're what I have
available uh I don't have a a nice
corporate sugar daddy who has a data
center that runs moroi equipment um so I
don't get this stuff for free I have to
buy it and search for deals uh just a
quick overview of all of them they're
all pretty similar they have uh gigabit
Ethernet ports and some of them have SFP
plus ports and stacking as well uh but
yeah they have a variety of bootloaders
red boot on the old stuff you boot on
the new stuff they have different
vendors so it's vessi which is now owned
by microchip on the ms220 series there's
broadcom used on the ms210 and 225 and
Marvel is used on the ms120 series moroi
loves the 3.8 kernel I've yet to see
anything newer on their switch series
and Asic management is typically via
kernel modules or via user space
binaries of particular note none of
these are open source they're provided
by the vendor through their SDK so even
if you manage to get the GPL source code
from maraki you won't be able to run a
Mainline kernel because all the Asic
goodness happens in close Source things
and of course they all run click and one
thing to note about the ms120 series it
has secure
boot so let's talk about secure boot on
maroi devices moroi calls this well
Cisco calls this the ACT which stands
for anti-counterfeit technology maraki
lingo is Tam trusted authentication
module it's based on the microchip smart
Fusion 2 which is a small fpj which is
either available in a surface mount or
BGA package it's included in all their
new product designs since around 2018
this includes Ms switches and MX routers
it's used to implement a hardware route
of trust and it's used as part of the
secure boot chain as well as part of the
update process so when uh maroi device
with a tam requests a configuration or
an update it also provides a secret from
The Tam to maroi servers to prove his
authenticity um they basically followed
the microchip white paper on how to
implement this and uh yeah it they
they've done their homework uh uboot is
a binary that's signed and verified by
the boot ROM or the secondary payload
loader and uboot then handles verifying
the signature of the fit image and
um that's what it looks like in boot so
a OT applet runs ubot applets are not
subject to GPL um ubot developers have
been pretty clear on this for several
decades I think um so yeah basically uh
during the boot process uh it the fpj
has both an a andb firmware and it has
signature lists the signature lists are
converted into an ftt during uh uboot
initialization and then that's used to
verify the fit image that it then boots
and this applies both to devices that
have a single stage boot process and a
two-stage boot process
so my hackey solution here moroi devices
run Linux so let's obtain the GPL source
code from them let's build our own
firmware step three is up to your
imagination and step four is profit
although this is open source so no um I
call this post meros it's a play on
words from post Market OS which you may
know from phones it's post maroi OS uh
it's an open source firmware the most
mature Target is the ms220 because
that's what I've been working on for the
longest there is a pre-alpha for the
ms210 and 225 series because the ms210
and 225 are actually the same Hardware
inside um it's based on build rout just
because that's what I'm familiar with
you flash it via SPI because nand tools
are expensive and nand is hard to work
with um and it uses the vendor kernel so
we're stuck on 3.18 because that's the
kernel modules that I have and um I
don't have access to rebuild those and
there's local management via SSH and
your standard busy box
CLI um ms120 there may eventually be a
firmware or not depends if we can manage
to find some holes in their secur boot
implementation so future work um data
sheets are really hard to come by and
none of the vendors want to give them to
you unless you give them lots and lots
and lots of money and promise never to
share them with anyone else so if anyone
knows of a random server where I can
find them I would be really really
grateful um I know vendors like broadcom
and Marvel are not eager to give up that
information uh Mainline or open wrt
support may be possible on the smaller
ms220 series um because uh microchip has
an SDK which includes uh
support for the lton 26 which is the
Asic used in the smaller switches which
actually has a very recent kernel
however the Jaguar 1 chip which is used
in the uh 48 Port versions uh there's no
data sheet and there's no support in
microchips SDK so it's unclear if there
will ever be support uh for open WT or
Mainline kernels another possibility is
creating a Franken firmware um the BCM
56160 which is in the ms210 and 225
series is used in other switching
products from other vendors such as AIS
and quanta um so you know we could
potentially just lift components from
their firmwares and run them on Mari
hardware and then have a more
traditional switch um so I want to give
some Kudos here I'm not the only person
working on giving Mari devices a second
life um Leo L has some notes on the ms20
which inspired uh my work Riptide wave
93 and Clayface are both working on open
wrt support for other moroi devices and
it's great to see other people in the
community working to prevent E waste I
want to give some negative Kudos here
too maroi G GPL is really really hard to
get um they don't provide a written
offer with their products as far as I
know they don't mention any GPL software
used in their dashboard and there's no
officially documented way to contact
them to request a GPL source code so if
you have a maroi product whether you're
interested in open source or not please
email open Min source atari.com and ask
them for the GPL source code for your
product however you may wait a long long
long time I've waited over a year for
certain products for them uh to provide
the source code um so yeah not very cool
of them since they're using GPL software
and uh making it difficult to get the
source code but you know I can see why
cuz it's late stage
capitalism and we've been here before
after Cisco bought lyus in the early
2000s it also became very hard to get
GPL source code for their products and
it took a lawsuit from the free software
Foundation to change that so um yeah
hope it doesn't end up in court again
and that they see the light of uh
contributing back to the community but
we'll see so I have a very short demo
and uh I hope the demo Gods will uh
shine on me although I did have some uh
pre-preparation so uh this is SSH from
the presentation laptop to the switch is
is running right here um there's nothing
really too exciting to show you here um
because it's all pretty basic um but
uh so there you can see all the ports on
the switch um I'm plugged into Port 4 so
you know got a gigabit link there and um
I also wrote a a a Damon to query uh the
poe uh and configure it so you can uh
see the status of the poe ports I don't
have any Poe devices here so there's not
really much to show uh but yeah that's
uh that's basically what I've got so
thank you so much for your time and
attention this morning um I'm available
for questions off to the side and yeah
if you uh own a maroi device or work for
someone who deploys maroi devices please
email them and ask for the source code
and throw it up on GitHub um I think we
can work together to show them the light
and uh yeah thanks very much for your
attention thank you
[Applause]
[Music]
h