Atheros Powerline Toolkit

Posted on  by 

Qualcomm atheros open powerline toolkit windowsAtheros

For more information on the AR7420 or other solutions from Qualcomm Atheros contact your local representative: Qualcomm Atheros, Inc. T +1 408.773.5200 f +1 408.773.9940 Qualcomm Atheros KK-Japan t +81 3.5501.4100 f +81 3.5501.4129 Qualcomm Atheros Intl, LLC-Taiwan t +886 2.8751.6385 f +886 2.8751.6397 Qualcomm Atheros Hong Kong Limited t +852. Qualcomm invents breakthrough technologies that transform how the world connects, computes and communicates. When we connected the phone to the Internet, the mobile revolution was born. Today, as we unlock 5G, we’re applying our mobile expertise to transform industries, create jobs, and enrich lives. So, I just botched a firmware update on one of my PowerLine couplers. The model I had trouble with is a TP-Link TL-PA4020P. However, this quick guide should work with pretty much any Atheros-based PLC device. It was confirmed working on at least a TL-WPA4220 as well. Balderdash game word generator. Steps to Reproduce. 2015 johnson 8 hp manual. Htc windows phone 8x unlock. Download manufacturer’s setup tool.

Model :
Hardware Version :
Firmware Version :
ISP :
I had a TP Link 4010 powerline which failed to update a firmwareand then apparently bricked on a reboot.
I spent a while trying to find a fix on here and came across the below solution from here.
Looking at the process involved I can imagine it would work on different versions. The only issue I had with the below guide is the need to specify a network interface card adding the switch -i enps20 on the line 'plc/plcboot -N nvm -P pib -i enps20' replacing enps20 with what ever interface is being used, Hope this saves someone time trying to find help So, I just botched a firmware update on one of my PowerLine couplers. The model I had trouble with is a TP-Link TL-PA4020P. However, this quick guide should work with pretty much any Atheros-based PLC device.

Steps to Reproduce


Download manufacturer’s setup tool
[*]Download firmware files (“nvm” and “pib” files)
[*]Refrain from directly connecting the PLC to the computer, instead leave it hooked up to a switch and other hardware.
[*]Start firmware update using the aforementioned setup tool
[*]Have a bit of bad luck

Result


“Firmware Upgrade failed” error message.
[*]Next up, “Local device not connected” error message.
[*]After unplugging and re-plugging the PLC, no lights light up.
[*]Faint hissing from the device, in normal operation it is silent.

Diagnosis

OK, keep calm. This is a modern piece of hardware, surely it wouldn’t need to be disassembled to flash a firmware. Right? Or so my hopes went as I started panicking. Looks like I’m not getting the manufacturer tool to retry the update on the (hopefully just) soft-bricked device. That piece of software only tells me that it can’t find the local device. A quick web search (“TP-Link PowerLine failed firmware fix” and similar) didn’t come up with anything good right away.
Well then, I thought, let’s see if it gives off any signs of life. I directly connected the PLC to my trusty MacBook and fired up WireShark. When the first packets started appearing I breathed a sigh of relief. The PLC still manages to get an ethernet link up. Amidst the stuff the Mac fires off when detecting a link (DHCP, MDNS, etc.) I finally found what I was looking for: Broadcast packets, “HomePlug AV” protocol, “Atheros_something” MAC, “Action Required Notification (Bootloader)”. Awesome! This thing is even politely asking me to remote-boot it. Let’s figure out how.
Armed with the right keywords to feed to my preferred search engine, I finally found “Qualcomm Atheros Open Powerline Toolkit” aka “open-plc-utils“. BSD-Licensed tools to set up Atheros-based PLC equipment. And, not really surprisingly, that includes a “plcboot” tool, which does just that – feed the PLC a firmware such that it can proceed to boot.

The Fix


Rename the .nvm and .pib files from the manufacturer firmware package to nvm and pib (The atheros utilities are picky when it comes to file names, something I only found out after head-scratchingly reading the code.)
[*]
git clone https://github.com/qca/open-plc-utils.git cd open-plc-utils make plc/plcboot -N nvm -P pib
[*]Finally, flash the firmware again, using the manufacturer tool. plcboot only performs a one-time boot when given the options above. To make the firmware permanent again, the flash needs to be rewritten. (Allegedly, plcboot can do that too, but it needs a “softloader” file, which I couldn’t be bothered to extract from the TP-Link software.)

Conclusions

I love the fact that chip manufacturers are building in sensible bootloaders, and that there is open source software available to access these. This is for example also the case with the Atmel ARM processor families of Arduino Due fame. I, for one, welcome this trend, making it increasingly hard to turn your hardware into a paperweight. On the downside, OEMs like TP-Link try to hide these as best as they can: the manual just says to return the device to the distributor for service when experiencing the symptoms I’ve encountered.
Bottom line: When a firmware update goes bad, don’t panic. It’s just a matter of finding the right tools. Also, it helps a lot having a general grasp of how things work on the inside to actually know what may or may not be possible.

Qualcomm Atheros Open Powerline Toolkit

Atheros Powerline Toolkit

Qualcomm Atheros Powerline Toolkit

  1. Adelstein, F., Stillerman, M., Kozen, D.: Malicious code detection for open firmware. In: Proceedings of 18th Annual Computer Security Applications Conference, pp. 403–412. IEEE (2002)Google Scholar
  2. Akhawe, D., Barth, A., Lam, P., Mitchell, J., Song, D.: Towards a formal foundation of web security. In: 2010 23rd IEEE Computer Security Foundations Symposium, pp. 290–304. IEEE (2010)Google Scholar
  3. Alliance, H.P.: IEEE 1901 HD-PLC Complete technical overview (2012). http://www.hd-plc.org/modules/about/hdplc.html
  4. Alliance, H.P.: HomePlug AV Specification (2014)Google Scholar
  5. Alliance, H.P.: HomePlug Powerline Networking Technology Hits Maturation as Global Broadband Standard (2016)Google Scholar
  6. Alves, F.: Vulnerability discovery in power line communications. Ph.D. thesis, Universidade de Lisboa (2015)Google Scholar
  7. Baker, R., Martinovic, I.: EMPower: detecting malicious power line networks from EM emissions. In: Janczewski, L.J., Kutylowski, M. (eds.) SEC 2018. IAICT, vol. 529, pp. 108–121. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-99828-2_8CrossRefGoogle Scholar
  8. Barth, A., Jackson, C., Mitchell, J.: Robust defenses for cross-site request forgery. In: Proceedings of the 15th ACM Conference on Computer and Communications Security, pp. 75–88. ACM (2008)Google Scholar
  9. Berger, L.T., Schwager, A., Pagani, P., Schneider, D.: MIMO Power Line Communications: Narrow and Broadband Standards, EMC, and Advanced Processing. CRC Press Inc., Boca Raton (2014)Google Scholar
  10. Bonneau, J.: The science of guessing: analyzing an anonymized corpus of 70 million passwords. In: 2012 IEEE Symposium on Security and Privacy, pp. 538–552. IEEE (2012)Google Scholar
  11. Boyko, V., MacKenzie, P., Patel, S.: Provably secure password-authenticated key exchange using Diffie-Hellman. In: Preneel, B. (ed.) EUROCRYPT 2000. LNCS, vol. 1807, pp. 156–171. Springer, Heidelberg (2000). https://doi.org/10.1007/3-540-45539-6_12CrossRefGoogle Scholar
  12. Cano, C., Pittolo, A., Malone, D., Lampe, L., Tonello, A., Dabak, A.: State of the art in power line communications: from the applications to the medium. IEEE J. Sel. Areas Commun. 34(7), 1935–1952 (2016)CrossRefGoogle Scholar
  13. Cui, A., Costello, M., Stolfo, S.: When firmware modifications attack: a case study of embedded exploitation. In: 20th Annual Network and Distributed System Security Symposium, NDSS 2013, San Diego, California, USA, 24–27 February 2013. The Internet Society (2013)Google Scholar
  14. Dudek, S.: HomePlugAV PLC: practical attacks and backdooring (2015)Google Scholar
  15. Dürmuth, M., Güneysu, T., Kasper, M., Paar, C., Yalcin, T., Zimmermann, R.: Evaluation of standardized password-based key derivation against parallel processing platforms. In: Foresti, S., Yung, M., Martinelli, F. (eds.) ESORICS 2012. LNCS, vol. 7459, pp. 716–733. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-33167-1_41CrossRefGoogle Scholar
  16. Qualcomm Atheros via Github: Qualcomm Atheros Open Powerline Toolkit (2018). https://github.com/qca/open-plc-utils
  17. GlobalData: Smart Meters, Update 2018 - Global Market Size, Competitive Landscape, Key Country Analysis, and Forecast to 2022 (2018)Google Scholar
  18. IEEE Standards Association and Others: IEEE standard for broadband over power line networks: medium access control and physical layer specifications. IEEE Std (2010), 1–1586 (2010)Google Scholar
  19. IEEE Standards Association and Others: IEEE standard for broadband over power line networks: medium access control and physical layer specifications - amendment 1: enhancement for internet of things applications. IEEE Std (2010), 1–118 (2019)Google Scholar
  20. Jennings, C., Narayanan, A., Burnett, D., Bergkvist, A.: WebRTC 1.0: Real-time Communication Between Browsers (2014)Google Scholar
  21. Kaliski, B.: PKCS #5: password-based cryptography specification version 2.0, September 2000. http://tools.ietf.org/rfc/rfc2898.txt, rFC2898
  22. Latinov, L.: MD5, SHA-1, SHA-256 and SHA-512 speed performance (2018)Google Scholar
  23. Matchen, M.: What Is Powerline Technology? (2015). https://www.tomshardware.com/reviews/network-switch-guide,4047.html
  24. Newman, R., Gavette, S., Yonge, L., Anderson, R.: Protecting domestic power-line communications. In: Proceedings of the Second Symposium on Usable Privacy and Security, pp. 122–132. ACM (2006)Google Scholar
  25. Newman, R., Yonge, L., Gavette, S., Anderson, R.: HomePlug AV security mechanisms. In: 2007 IEEE International Symposium on Power Line Communications and its Applications, pp. 366–371. IEEE (2007)Google Scholar
  26. OWASP: Information exposure through query strings in URL (2017). https://www.owasp.org/index.php/Information_exposure_through_query_strings_in_url
  27. Paruchuri, V., Durresi, A., Ramesh, M.: Securing powerline communications. In: 2008 IEEE International Symposium on Power Line Communications and its Applications, pp. 64–69. IEEE (2008)Google Scholar
  28. Puppe, A., Vanderauwera, J., Bartels, D.: HomePlug Security (2010)Google Scholar
  29. Salem, A., Hamdi, K., Alsusa, E.: Physical layer security over correlated log-normal cooperative power line communication channels. IEEE Access 5, 13909–13921 (2017)CrossRefGoogle Scholar
  30. Scholz, R., Wressnegger, C.: Security analysis of Devolo HomePlug devices. In: Proceedings of the 12th European Workshop on Systems Security, pp. 7:1–7:6. ACM (2019)Google Scholar
  31. Shiflett, C.: Security Corner: Cross-Site Request Forgeries. Shiflett.org (2004). http://shiflett.org/articles/cross-site-request-forgeries
  32. Sunguk, L.: Security issues of power line multi-home networks for seamless. Data Transmission (2011)Google Scholar
  33. Suomalainen, J., Valkonen, J., Asokan, N.: Standards for security associations in personal networks: a comparative analysis. Int. J. Secur. Netw. 4(1–2), 87–100 (2009)CrossRefGoogle Scholar
  34. Tasker, B.: Infiltrating a Network via Powerline (HomePlug AV) Adapters (2014). https://www.bentasker.co.uk/documentation/security/282-infiltrating-a-network-via-powerline-homeplugav-adapters
  35. Tiwari, A.: Electricity meters’ reading comparison: electromechanical, electronic and smart meters (2016)Google Scholar
  36. Ur, B., Bees, J., Segreti, S., Bauer, L., Christin, N., Cranor, L.: Do users’ perceptions of password security match reality? In: Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems, pp. 3748–3760. ACM (2016)Google Scholar

Coments are closed