I think they ran their own SSH server on the router for the SSH connect-back from Telia's server. SSH password auth sends the password to the server [router her

I think they ran their own SSH server on the router for the SSH connect-back from Telia's server. SSH password auth sends the password to the server [router here]. This is encrypted over the network, but the server [router] decrypts it, so then you have that password, shared between all the routers. I'm not sure if libssh being vulnerable was relevant to their attack or not, perhaps that's just an aside, given they physically own the router anyway. SSH pubkey auth would have avoided the problem I guess. Not sure if it would have helped their attitude though.