4 ms·
The term "backdoor" is motivation-neutral - while this is a backdoor, you don't have enough information to establish intent, so I'm surprised at this conclusion
by geofft 6y ago
The term "backdoor" is motivation-neutral - while this is a backdoor, you don't have enough information to establish intent, so I'm surprised at this conclusion:
> While most vulnerabilities seem unintentional (i.e. coding mistakes), one of them stands out. The hardcoded password is a deliberate backdoor.
It certainly could be, and there are good arguments that it probably is, but it also could be something they put in for testing and forgot to take out. (It could be quite literally a backdoor they deliberately added during testing but didn't intend to ship in production.) Certainly there's no shortage of US-based companies that have done this and have offered that rationale for why their production products have backdoors.
It's also not a backdoor that the Chinese government (or whoever) can particularly easily exploit, since it listens on your local network. Unless you're connecting it directly to the internet or forwarding the admin port from the public internet with no further authentication, it's not accessible to outside attackers.
If they had an automatic firmware update mechanism that connected to a server on the internet, that would be much more easily accessible (but also, we generally don't call automatic update mechanisms "backdoors").
- dathinab 6y ago> It certainly could be, and there are good arguments that it probably is, but it also could be something they put in for testing and forgot to take out. No, because you will find stuff like this in nearly all of their products. It's fully intentional. > It's also not a backdoor that the Chinese government (or whoever) can particularly easily exploit, since it listens on your local network. Network isolation is well known to not be a reasonable security measure. Especially in home networks. I mean think about it many people have ton's of not necessary supper secure/trustable devices in their home network like: TV setup boxes, the TV itself and most of IoT. Furthermore especially vendor provided routers are known to often not be so secure and well maintained taking often way to long to get security patches or not even get them at all. Sure this is probably not build intentionally by the Chinese government to spy on US people. In a certain way it's worse, as it shows how Chines companies put backdoor by default in all kind of things "just in case" they are needed by anyone.
- nitrogen 6y agoNetwork isolation is well known to not be a reasonable security measure. Especially in home networks. Just think about the fact that every Android app gets full local network access by default, and there's no native way to disable that permission.
- nucleardog 6y ago> Network isolation is well known to not be a reasonable security measure. Network isolation is effective. What you're describing is just a poor implementation / not really isolated.
- vel0city 6y agoThey didn't say it is not effective but that it is unreasonable for most consumers. Most consumers aren't running smart switches and somewhat advanced access points with multiple VLANs and configuring the firewall to control traffic flows between the VLANs. They're running an ISP provided router/modem/combo unit with no VLAN support at all.