trust everybody could potentially take over the router without the authorization and authentication but allowing it to happen uh with anyone anywhere meaning on the wan definitely takes it up a notch okay so once the standard three-way tcp connection handshake has occurred the pc wishing to have access to the usb devices connected to the router sends a signature plus NUMBER_TOKEN bytes NUMBER_TOKEN bits of what they term verify data it appears that these NUMBER_TOKEN bytes of so-called verify data serves as a connection nonce to prevent replay attacks right just some just it the the the pc gets NUMBER_TOKEN bytes NUMBER_TOKEN bits of random stuff and says you know this is how i'm going to tag this conversation upon receiving the pc's signature with its verified data the router aes encrypts um excuse me the router aes encrypts that verify data and returns it along with its own NUMBER_TOKEN bytes of random data and you know the pc probably uh decrypts the the aes encrypted verify data that it got from the from the that it sent and got from the client to verify that it matches so basically each end excuse me each end sends the other a large random nonce which they each encrypt and send back so that the other end can decrypt it and verify it so they establish a a replay proof uh verification of the two endpoints um assuming that everything works it then uh uh gets ready to uh take the next step they've exchanged this uh nonce data the the router's code then drops into having established this connection a command parsing loop a so-called while loop to uh await the pc client's commands so everything is being driven by information now being sent by the pc that is connected to the router and of course this could also be anybody anywhere on the internet in the case of this this service being exposed on the wan um and i mentioned this is a while loop there is probably a command that exits that loop that is so the the loop will will sit there accepting and processing commands from the the client that is connected to the router until a you know a hang up command is received which drops it out of the loop and terminates the connection anyway this loop waits for and receives a NUMBER_TOKEN-bit command word which causes it to jump to a function which then further handles the needs of each specific command so that's sort of a simple way of executing or implementing a a command driven protocol you you have a a two byte NUMBER_TOKEN-bit command which will which the router will receive and that causes it then to branch you know in some languages you would call it a switch function it would take if the command would cause it to call a specific subroutine to to process the rest of that command the researchers at sentinel labs found a problem in the function whose NUMBER_TOKEN-bit command is hexadecimal NUMBER_TOKENf so the receipt of that NUMBER_TOKEN bits as the command word NUMBER_TOKENf branches the code to a specific routine named software bus dispatch normal ep message out and it doesn't really matter what that does that's not germaine whatever it does fine we don't need to know or care so the client first sends uh that command then it sends four bytes which is of course NUMBER_TOKEN bits to be the maximum number of bytes to follow which
NO_SEGMENT_TOKEN