5 ms·
Why is the title sensationalised. There is no "injects backdoor into their chips". It's a debug console on a busybox build. One would have to be on the same l
by easytiger 7y ago
Why is the title sensationalised. There is no "injects backdoor into their chips".
It's a debug console on a busybox build. One would have to be on the same lan to exploit it.
- crooked-v 7y agoThough, "on the same LAN" becomes much more of a problem when you consider insecure 'smart' lightbulbs and appliances everywhere.
- Polylactic_acid 7y agoYep, how many people actually have a lan where every single device that ever connects is fully secure and trusted.
- jay_90 7y agoThe US Govt?
- marta_morena 7y agolmao
- kevin_thibedeau 7y agoTheir contractors. The government itself can't be bothered to follow its own security policies.
- kryogen1c 7y agovLAN segmentation is a best practice for this exact reason
- dahfizz 7y agoEveryone savvy enough to browse HN ought to, at the very least...
- blattimwind 7y agoIT laypeople: LAN segmentation is a security feature Security people: Uhm...
- colincooke 7y agoThis "debug console" is on networked IP cameras (many of which are open to the web) and available through a hardcoded password. I don't see a convincing argument for malicious intent, more so a dangerous level of incompetence from a company who should know better. Unfortunately Xiongmai is not an outlier for subpar security practices on IOT products, doesn't make it any less bad though
- throwaway5752 7y agoThe old "the 's' in IoT stands for 'security'" holds true. Hanlon's razor has been dangerously stressed lately.
- microcolonel 7y agoXiongmai has a history of oopsies this big or bigger, going back several years at least. Their software usually turns out to be spyware, whatever their intent may be.
- deleted 7y ago[deleted]
- dahfizz 7y agoI would like to point out that this is not specific to IOT. I deal with lots of servers and enterprise networking gear at my job and many of them come with hardcoded passwords on ipmi / networked admin consoles. The difference is that your average Joe doesn't even know he has to configure these devices, let alone how to configure them.
- catalogia 7y agoMalice should be the default assumption in some scenarios. If a man with a covered face dressed in all black is discovered inside a bank vault, it should be assumed he was there to burglarize it. Maybe he was actually a ninja haplessly teleported through space and time by a powerful evil mage and landed in the bank vault through pure coincidence, but probably he's a burglar. This isn't a court of law. We aren't morally obliged to feign naivety. If this wasn't meant to be a back door, they're free to explain their actions. But until they've done so to my satisfaction, I for one will assume malice.
- a_t48 7y agoSo...Hanlon’s Razor? :)
- cjbprime 7y ago> One would have to be on the same lan to exploit it. For what it's worth, DNS rebinding attacks are commonly used against embedded devices, and remove this restriction.
- upofadown 7y agoYeah, if you don't want to lose the protection provided by a firewall, then all you have to do is avoid running any web browsers on any devices on the LAN... This should be a huge scandal. For some reason we tend to give browsers a free pass when it comes to security.
- qeternity 7y agoHad never heard of DNS rebinding before. Very cool. I presume this is only useful for extremely target attacks given the strict timing requirements?
- cjbprime 7y agoNo, people use it to scan entire LANs from the outside, untargeted exploration.
- dahfizz 7y agoNope, it would be pretty straightforward to set up a stateful dns server that serves the "real" ip on first request from a new client, and then ever subsequent request returns a local IP. That one dns server would enable an attack on anyone who visits the malicious site.
- corford 7y agoSpeaking of rebinding attacks... does anyone know why cloudflare's 1.1.1.1 resolver doesn't enforce this? It's the only "big" public one I know of that happily resolves RFC1918 IPs.
- cjbprime 7y agoProbably because things would break in subtle and confusing ways if they did. E.g. you have a build server and chose to use live DNS to point at it artifacts on an internal network because it was simpler to just edit a single zone file.
- taneq 7y agoIf a consumer device ships with a “debug console” that gives the manufacturer (or any attacker who knew about it) root, that’s a vulnerability. If it happens on purpose, and they don’t tell you about it, then that’s the very definition of a backdoor.
- SahAssar 7y agoI've worked on security for IoT devices, and "would have to be on the same lan" is not at all uncommon as an attack scenario. In fact at the company I worked at I worked hard to get our customers to understand that just because a network is "local" does not make it "secure".
- deleted 7y ago[deleted]