Beacon Security Enhancements

In JANOS 1.6.3 there are new security measures to harden the Beacon protocol. This has been an issue since its inception. Any action that commands or configures the JNIOR will require credentials to be supplied. Those credentials along with a valid NONCE will be evaluated by JANOS to determine if the action or configuration attempt will be allowed.

The NONCE will be supplied at the end of the ALL_INFO packet. To get a valid NONCE an ALL_INFO packet will need to be requested shortly before the NONCE will be used. In the Support Tool, for example, when someone wants to save the configuration we will request the ALL_INFO packet when displaying the new login dialog. Then when the user clicks OK with the new credentials we will have received the NONCE. The nonce is then used along with the credentials to provide the new authentication.

Here is code from the Support Tool that adds the code to extract the NONCE from the ALL_INFO packet if it exists.

        private void ParseAllInfo(ref JniorInfo jnrInfo, BinaryReader br)
        {
            jnrInfo.Gateway = ReadString(br);
            jnrInfo.PrimaryDns = ReadString(br);
            jnrInfo.SecondaryDns = ReadString(br);
            jnrInfo.DNSTimeout = IPAddress.NetworkToHostOrder(br.ReadInt32());
            jnrInfo.DHCPServer = ReadString(br);
            jnrInfo.DomainName = ReadString(br);
            if ("n/a".Equals(jnrInfo.DomainName))
                jnrInfo.DomainName = "";
 
            //stringLength = IPAddress.NetworkToHostOrder(br.ReadInt16());
            jnrInfo.Timezone = ReadString(br); // ASCIIEncoding.ASCII.GetString(br.ReadBytes(stringLength));
 
            jnrInfo.DHCPEnabled = (br.ReadByte() == 1);
 
            // if there is more information then the nonce is provided
            if (br.BaseStream.Position < br.BaseStream.Length)
            {
                jnrInfo.Nonce = ReadString(br);
            }
        }

Once the NONCE is known, the stored credentials can be used to send the security string to the SET_INFO command

        public static byte[] SetInfo(JniorInfo jnrInfo)
        {
            using (MemoryStream ms = new MemoryStream())
            using (BinaryWriter bw = new BinaryWriter(ms))
            {
                WriteString(bw, "SET_INFO");
                WriteString(bw, jnrInfo.IPAddress);
                WriteString(bw, jnrInfo.SubnetMask);
                WriteString(bw, jnrInfo.Gateway);
                WriteString(bw, jnrInfo.PrimaryDns);
                WriteString(bw, jnrInfo.SecondaryDns);
                bw.Write(BitConverter.GetBytes(IPAddress.HostToNetworkOrder((Int32)jnrInfo.DNSTimeout)));
                WriteString(bw, jnrInfo.DomainName);
                bw.Write((byte)(jnrInfo.AutoAnnounce ? 1 : 0));
                bw.Write((byte)(jnrInfo.IsNew ? 0 : 1));
                WriteString(bw, jnrInfo.Timezone);
 
                // use the NONCE and the stored jniorinfo.credentials to send the security string.
                SendSecurity(bw, jnrInfo);
 
                return ms.ToArray();
            }
        }

The Support Tool will prompt the user for the credentials every time they are needed.

                        /**
                         *  check to see if the NONCE was filled in via the ALL_INFO packet.  
                         *  This is new in 1.6.3.  if the NONCE was provided we will prompt 
                         *  for credentials.
                         */
                        var nonceAvailable = null != configureJnrInfo.Nonce;
                        if (nonceAvailable)
                        {
                            var loginDlg = new Common.LoginDialog(configureJnrInfo.IPAddress);
                            /**
                             * if the user cancelled providing the credentials then we cancel 
                             * the configuration update
                             */
                            if (DialogResult.Cancel == loginDlg.ShowDialog(this))
                                return;
 
                            /**
                             * update the saved credentials so they can be used when sending the beacon commands
                             */
                            configureJnrInfo.UserName = loginDlg.UserName;
                            configureJnrInfo.Password = loginDlg.Password;
                        }
 
                        BeaconService.Beacon.Broadcast(BeaconService.Beacon.SetInfo(configureJnrInfo), m_configSerial);

The credentials are needed when issuing a Reboot. In the support tool we ask for an updated ALL_INFO packet before displaying a reboot confirmation.

                /**
                 * request a new ALL_INFO packet is sent with a new NONCE
                 */
                BeaconService.Beacon.Broadcast(BeaconService.Beacon.RequestInfo(), jnrInfo.SerialNumber);
 
                /**
                 * confirm with the user the disire to reboot the selected jnior
                 */
                if (Interaction.MsgBox("Are you sure you want to REBOOT the selected JNIOR?", MsgBoxStyle.YesNo, "Reboot?") == MsgBoxResult.No)
                    return;
 
                /**
                 * check to see if the NONCE was filled in via the ALL_INFO packet.  
                 * This is new in 1.6.3.  if the NONCE was provided we will prompt 
                 * for credentials.
                 */
                var nonceAvailable = null != configureJnrInfo.Nonce;
                if (nonceAvailable)
                {
                    var loginDlg = new Common.LoginDialog(configureJnrInfo.IPAddress);
                    /**
                     * if the user cancelled providing the credentials then we cancel 
                     * the configuration update
                     */
                    if (DialogResult.Cancel == loginDlg.ShowDialog(this))
                        return;
 
                    /**
                     * update the saved credentials so they can be used when sending the beacon commands
                     */
                    configureJnrInfo.UserName = loginDlg.UserName;
                    configureJnrInfo.Password = loginDlg.Password;
                }
 
                /**
                 * send the reboot command
                 */
                BeaconService.Beacon.Broadcast(BeaconService.Beacon.Reboot(jnrInfo), jnrInfo.SerialNumber);

And here is the Beacon reboot code

        public static byte[] Reboot(JniorInfo jnrInfo)
        {
            using (MemoryStream ms = new MemoryStream())
            using (BinaryWriter bw = new BinaryWriter(ms))
            {
                WriteString(bw, "REBOOT");
 
                // use the NONCE and the stored jniorinfo.credentials to send the security string.
                SendSecurity(bw, jnrInfo);
 
                return ms.ToArray();
            }
        }