22 ms·
Walmart router, others on Amazon, eBay have hidden backdoors to control devices
- sigmaprimus 6y agoIm not sure why but reading this article raises my internal BS skepto-meter. The story explains that the companies in question have access to RPC functions similar to those that an ISP might use but that they are not ISPs. Then later on the article states that one of the companies described itself as an ISP. The story also questions why there is a GUI for running remote commands and why a device would need to scan for nearby networks. I can think of a few legitimate reasons for both but no reason a decent backdoor would have a server side backdoor GUI. Just my opinion but I get the feeling this whole situation was created by IP theft in the form of firmware duplication. It seems these companies have used a very insecure firmware possibly made intentionally bad to trap or setup these Chinese manufacturers. If these are in fact intentional backdoors they were made with an incredible amount of effort to look like sloppy 0day exploits. I should add that I don't doubt that these vulnerabilities are real, just the intent behind them. If I was having my products manufactured in China, I might provide a similar bad firmware for the factory too, then patch the devices before providing them to my customers to prevent IP theft.
- bmcn2020 6y agoHey there - author of the article here. The research team behind this has a lot of unanswered questions as well, and a lot of...(like you) conjectures about how this may have arisen. Normally, one should not attribute to malice what can simply be attributed to stupidity or probably laziness here. Even then, however, it's a bit too suspicious though. Of course, we asked the manufacturers behind these devices for comment and -- surprise! -- no comment. In past experience with Chinese vendors, we've had similar results. Of course, we'll update with any information we get. Thanks for reading!
- sigmaprimus 6y agoI would start by examining the getWifi.sh file a bit closer, chances are it's part of either a WPS or Network Bridge scheme. Having thought about this story for a while now, I also think it is worth investigation, I might purchase an extender off Amazon. The one part of the story I can't reconcile is how the Chinese IP attacker managed to find the device. I doubt this could have occured just from random port scanning so there must be a call home, possibly by loading a hidden image on the "Backdoor GUI"? The story was well written, just not sure it made me thristy enough to drink the koolaid...or maybe it did! :P
- jml7c5 6y agoRandom attacks are much more frequent than one might expect. If you are unlucky enough to have a device that accepts the default telnet user/pass of 'root'/'xc3511' and you leave it open to the internet, you can expect it to be compromised in less than five minutes. [0] [0]: https://isc.sans.edu/forums/diary/An+Update+On+DVR+Malware+A+DVR+Torture+Chamber/22762 https://isc.sans.edu/forums/diary/An+Update+On+DVR+Malware+A...
- bmcn2020 6y agoIf you are thirsty enough to test it yourself, please let us know if you find anything!
- robotnikman 6y agoOverall its a good idea to avoid buying electronics from walmart unless its something simple like a cable I've also heard that products such as TV's are usually lower quality compared to sold elsewhere; usually the manufacturer creates a model speficially for walmart, using lower quality parts, display panels which don't pass QA and are binned, SoC's which may have issues, etc
- milesvp 6y agoNot sure about Walmart in general, but this is a known thing for big box black friday electronics. These items will typically have different SKUs than their equivalent normal priced electronics and often have at the minimum reduced feature sets, like fewer HDMI ports, anything really that can get the BOM lowered is likely to be removed from the electronics. I haven't heard if they go as far as to use SoC with known issues, but certainly I can see them getting binned chips that fall with "acceptable" parameters, where acceptable is quite low.
- triangleman 6y agoHugged to death?
- lights0123 6y agohttps://web.archive.org/web/20201123181545/https://hfet.org/walmart-exclusive-wi-fi-router-contains-backdoor-to-control-devices/ https://web.archive.org/web/20201123181545/https://hfet.org/...
- ChuckMcM 6y agoThis is so utterly predictable. People flock to "free" services and give away all their data to do so. People buy "cheap" printers, and sign up for extortionate ink programs to do so. We have a car maker to "takes back" software options sold when the car was new on re-sale of that car. No we have people buying "cheap" Wi-Fi routers which are subsidized by their ability to be used by third parties for nefarious purposes. Caveat Emptor only goes so far. The ability to fleece people through technology has been known and exploited for a long time, I wonder if we will ever see a consensus backlash against it.
- deeeeplearning 6y ago>Caveat Emptor only goes so far This is key. The general public has a very basic understanding of tech generally and even less about what can be done with their data.
- judge2020 6y agoIt's because people often value their time more than money. Free services win because everyone can start using it and depending on it in 5 minutes, instead of having to pay for and download a comparable product, or worse, maintain an OSS alternative on a home server. The only time a consumer chooses to pay for something is when it's as entrenched into their minds as MS Office is, or when their employer/school demands it (also MS Office). HP's ink is so successful since you can now just have it show up at your door when you're low on ink instead of having to make a trip to best buy. The extortionate price of unit-sold cartridges is only extra motivation. And Tesla is only big because they have an appealing product; if other car manufacturers could offer the same (EV) range, software experience, and minimalistic design, they'd blow Tesla out of the water with superior service and build quality. Now this cheap Wi-Fi router isn't something people are buying because it's comparatively better or offers some features, it's just a cheap Chinese wifi router that some corporate Wal-Mart manager decided to stock since it would be high-margin and, as far as they know, offered basic wifi functionality. Your argument would work for any other (high end) router like Nest WiFi, Netgear, etc.
- iso1631 6y agoReview from 2 years ago: https://mashable.com/shopping/oct-11-deal-walmart-jetstream-wifi-routers/?europe=true https://mashable.com/shopping/oct-11-deal-walmart-jetstream-... "WiFi routers always seem to make you sacrifice something, don't they? You're either paying for speed and spending an ungodly amount of money, or opting for the budget pick and waiting forever for things to load. You shouldn't have to make that choice. One bright spot on the WiFi landscape could come from an unlikely place: Walmart. The big box store is gearing up to save you money and headaches by launching a line of store-exclusive routers that minimize cost and maximize performance." The cheap end were $35.
- jimbob45 6y agoIt’s funny that China spent so many years and many millions of dollars trying to rehabilitate their image as a manufacturer of non-working items and now that their items work...they’re avoided because of security holes instead.
- justaman 6y agoWhen will the world realize this for what it is. An act of war in the information age.
- 23B1 6y agoVery hard to get anyone to react in Low Intensity Conflict :( https://en.wikipedia.org/wiki/Low-intensity_conflict https://en.wikipedia.org/wiki/Low-intensity_conflict
- cortesoft 6y agoIs the 'backdoor' the admin portal with default credentials and a poorly thought out default network policy? The article seems to imply this is a malicious tool, but it seems more likely to me that this is just another poorly designed router instead.
- dahfizz 6y agoThere is more info in this article[1]. They say that this is separate from the admin page. It is basically a root shell on a web page exposed to the network. [1] https://cybernews.com/security/walmart-exclusive-routers-others-made-in-china-contain-backdoors-to-control-devices/ https://cybernews.com/security/walmart-exclusive-routers-oth...
- armatav 6y agoWell if you read the article; "The Jetstream and Wavlink routers showcase a simple GUI (or user-friendly interface) for its backdoors that is different from the interface presented to router admins."
- cortesoft 6y agoThe article posted does not have those details.
- vsareto 6y agoI don't like cybernews.com or their video, so here's the researcher's page with details: https://james-clee.com/2020/04/18/multiple-wavlink-vulnerabilities/ https://james-clee.com/2020/04/18/multiple-wavlink-vulnerabi...
- djanogo 6y agoFor those thinking Walmart/Cheap router customers are more gullible, the Asus routers which are highly rated and used by tech savvy users (flashing custom ROM's) require accepting Trend Micro(TM) EULA's for most of the features on the box. Even QOS settings require user to accept specific EULA to share data with TM). Traffic monitor of your LAN also requires EULA. The app that comes with Asus router is littered with button which if you accidentally click will make you accept EULA.
- kube-system 6y agoThat's kind of an apples and oranges comparison. An EULA is merely a legal construct. There are a lot of instances someone might want to sign an EULA to share data, yet wouldn't want a device with a backdoor root shell.
- gentleman11 6y agoReminds me of razer keyboards: their eula makes you agree that they can receive data about keyboard inputs. Gaming brands are pretty scary as a whole for this stuff
- mmaunder 6y agoThese guys are working way too hard to push the intentional-backdoor angle and tying it into a broader China narrative.
- xapata 6y agoPlease explain your skepticism.
- vsareto 6y agoRead this: https://james-clee.com/2020/04/18/multiple-wavlink-vulnerabilities/ https://james-clee.com/2020/04/18/multiple-wavlink-vulnerabi... >Low and behold, there was my super secret password in plain text, with the admin username in plain text, on a page that requires no authentication of any kind to view. It is so fucking dumb that there is no other explanation other than an intentional backdoor. If anyone quotes Occam's Razor, you've been asleep for the past 5 years or so.
- untog 6y agoIf I was making an intentional back door I wouldn't make anything that stupid. The super-secret password is "password123". Maybe you have more faith in developers than I do because this sounds exactly like a dumb mistake/cutting corners to me.
- mynameisvlad 6y agoI don't think you understand, "password123!" was the password the researcher set. In the CVE, it details the call it executes to retrieve the password from nvram.
- untog 6y agoAhh I misread. Even still. Directly injecting the password in the source of a JS file for the purposes of checking authentication? That screams naive error to me.
- Spivak 6y ago
- crispyambulance 6y agoI can see how the backdoor allows access to the router and makes the router itself part of the botnet. But where do they get... > This backdoor would allow an attacker the ability to remotely control not only the routers, but also any devices connected to that network. How do you gain "control" of a device (presumably a PC) merely by having access to the router it is connected to? Is it just that we're assuming that a typical home network will be a soft target of PC's? What about windows defender firewall, and all that stuff?
- knicholes 6y agoI have the same question. Maybe if there's a process running with an open port on the network and has a known vulnerability, then someone can gain access to the system once they're on the network?
- colechristensen 6y agoIf you can control the router you can inject vulnerabilities into normal traffic.
- goatinaboat 6y agoHow do you gain "control" of a device (presumably a PC) merely by having access to the router it is connected to? ARP spoofing, DNS spoofing, UPnP...
- deleted 6y ago[deleted]
- colechristensen 6y agoThe base assumption should always be that your network is breached and your devices vulnerable. With so much poorly supported “smart” devices on the market, a great deal of your life is easily compromised once somebody is inside your network. There’s no great promise that your PC is secure unless you’re rather well brushed up on security best practices.
- javajosh 6y ago
- ronnier 6y agoI bought a small x86 board with dual gig network cards and put openwrt on it. If you haven’t looked at openwrt lately, it’s really good, clean UI, right to the point. Best thing I’ve done for my network besides running pihole. I recommend it.
- nicolaslem 6y agoSame thing for me with IPFire. It's my goto distribution for x86 routers as it focuses a bit less on low-end hardware.
- heavyset_go 6y agoOpenWRT is absolutely fantastic. It's one of my favorite open source projects out there. I won't buy home networking equipment if I can't put OpenWRT on it.
- dsr_ 6y agoAh, that's why NewEgg put every WavLink device on sale yesterday.
- javajosh 6y agoAm I the only one who thinks that Wal-Mart should be absolutely slammed for doing this? Like, they are a corporation actively participating in the material worsening of our national security. I don't even want to think about a threat model that includes undermined router hardware! If they can't be patched remotely those things need to be recalled, destroyed, and Wal-Mart fined significantly. (When I say slammed I mostly mean "pay big fines", maybe jail time if the flaw was known, and it should result in real reputational damage to Wal-Mart and its willingness to sell anything with a network connected computer in it. At the very least, if the buy cost is even less than the china price, that difference is coming from somewhere. Wal Mart should have spotted that.)
- kortilla 6y agoIt doesn’t sound like the back door was put in for Walmart to use. So no, Walmart shouldn’t be slammed for this vulnerability anymore than for the vulnerabilities in the PCs they sell.
- heavyset_go 6y agoIf Walmart sold products that were contaminated with lead, and people got sick, they would still be held liable even if they didn't manufacture the products themselves.
- javajosh 6y agoThis, exactly.
- waffle_ss 6y agoThere’s a vote button for expressing that sentiment
- cogman10 6y agoSeems analogous the child labor and slave problem. Walmart keeps on getting caught selling unethically produced goods. We need stronger laws to punish them when that happens. It doesn't seem to be enough to allow them to self govern. Ditto for the likes of Amazon.
- outworlder 6y agoThe last time I was in the market for a 'cheap' router, I settled on Mikrotik. Very cheap, and incredible features. Configuration should not be a mystery for the average HN poster. Mine is router only, no wifi, but I have heard good things about wifi versions too. Not sure what to recommend for non tech-savvy users though. The overwhelming majority of routers in the market that are targeted to consumers are hot garbage. Some TP-Link models? Maybe... Google(if are ok with your most important device being from them)? Are Linksys still good? My last one was a WRT54G. It was ok out of the box, pretty good with custom firmware (that takes it outside the end-user territory once again).
- merlinscholz 6y agoFor normal consumers, at least in Germany, AVM's FritzBox is the standard. They are such a solid product that about half of the big ISPs provide branded versions of them to their customers.
- mattbee 6y agoYes, Zen in the UK supply them, and I was surprised how good they are. The web & mobile app UI are well-designed, and it's updated automatically every couple of months.
- second--shift 6y agoMikrotik fan checking in here - my "cheap" recommendation to anyone is the current hAP lite - USB powered, sub $30 shipped to your door. Web fig is as simple as can be; the most basic model still has all the features in 'Advanced' mode though.
- nucleardog 6y agoEven for non-technical users, the MikroTik routers ship set up how a consumer would expect it I think. The configuration after a reset/as shipped (at least on all my old models) is a local network at 192.168.88.0/24 with NAT and DHCP set up, wireless enabled and bridged to lan, etc. Only time it's going to get a bit dicey is if they want to customize the configuration (e.g., forward ports). But for 90% of people that's not going to be an issue.
- calibas 6y agoWow, the investigation couldn't even figure out which company was actually making the Jetstream routers. They believe it's Winstars Technology Ltd but they're not sure. Sounds shady when whoever's making it is apparently distancing themselves from their own product.
- nojs 6y agoAll the (three?) articles about this gloss over whether/how this is remotely exploitable or whether you need to be on the local network. This would seem to be evidence that it is: > Basically, the first IP address you see there – 222.141.xx.xxx, which comes from China – was trying to upload a malicious file on the router using the vulnerabilities. Since when does a router respond to the whole world on port 80 by default?
- swiley 6y agoMore of a missing door than a "back door."
- syntaxing 6y agoI get uncomfortable how this is probably true with all these smart TVs as well (especially the budget TVs). I set up piHole to try to prevent this but nothing stops it from phoning home via a direct IP. It sucks because all our electronics get poisoned since good brands get squashed out by these low cost alternatives that consumers love at the expense of privacy that no one cares about anymore. Also, another crazy thing is ISP provided routers. I was unable to change the DNS on my modem/router, let alone change the security settings.
- 1vuio0pswjnm7 6y agoWhat gateway is the TV using? You can put your own router in front of the ISP one, and set your computers including your TV to use your router as the gateway, not the ISP one. Relying 100% on a third party router (where you do not control the OS) is similar relying 100% on a third party DNS provider (many PiHoles are set up to use third party DNS providers). This is willingly delegating 100% control to a third party. Some of that control can be retained if desired by using own router (with OS you can fully control), or in the case of DNS by using own DNS that you can fully control.
- syntaxing 6y agoI had to put a router in between. So the setup is piHole -> Secondary Router with PiHole as router-wide DNS --> ISP router/modem. I'm kind of tempted to just straight up buy my own modem.
- 1vuio0pswjnm7 6y agoIf the ISP charges you a monthly fee for the modem/router (you are "leasing" the modem), and you have been a long-term customer, you may have already paid the full price of the modem; yet you do not own it. Let's say the customer connects their own Wifi router to the ISP modem/router via Ethernet cable. There is no need for the ISP modem/router's Wifi AP. Does the ISP modem/router allow the customer to disable it?
- api 6y ago
- voltagex_ 6y agoIt's not the AliExpress routers that worry me (although Walmart should have negotiated for better firmware), it's all the "name brand" routers that are running a 2.6.34brcm Broadcom kernel that'll never see another firmware update.
- perlin 6y agoWhat specifically about this firmware version worries you?
- voltagex_ 6y agoI probably shouldn't have picked that one in particular, it's just front of mind at the moment. That one might be better updated than others - but if it is, they don't seem to update the version number making tracking difficult, a lot of the vendors will stop providing updates to old devices. The other problem is that if you have a Mediatek, Broadcom, Ralink, Hisilicon vulnerability (all have their own kernel forks and driver forks) then every device downstream using that kernel or driver is vulnerable, and not all devices will get fixed. Even if the vendor or upstream fixes it, who upgrades their router firmware?
- voltagex_ 6y agoWhile Wavlink bears a lot of responsibility for these problems, I bet this is a Mediatek or Ralink board support package that is security swiss cheese.
- jimbob45 6y agoJust spitballing here but would it be possible to write more secure firmware for these routers, wipe the firmware, install your own, and the sell the routers under your own brand?
- mlindner 6y agoWow, looks like China state funded operation to create a botnet. Nice research.
- ksec 6y agoI am starting to wonder if there is a Startup / Business to be made where the Router is a simple Whitebox with excellent support of OpenWRT.
- mensetmanusman 6y agoDon’t buy network devices from China.
- contingencies 6y agoIllogical response. The logical response is to use multiple layers of network security provided by different vendors and hardware/software stacks so that there is no single point of trust and you mitigate the impact of a breach. That way you don't need to struggle with the heavy burden of maintaining illogical beliefs such as mystical associations of 'western' supply chains being 'clean', whereas 'backdoors' are being actively created by 'bad actors' affiliated with 'the other' motivated by 'reasons' against your specific person because 'nothing better to do' despite 'vast scope' and 'international supply chain conspiracy'. Uhuh.
- Bayart 6y agoBuy network devices from China, put OpenWRT on it.
- tapper 6y agoThis is why we need OpenWrt!
- ngcc_hk 6y agoChinese
- imchillyb 6y agoChina is not our friend. China is not our friend. China is not our friend... I hope that by repeating this often enough and loud enough that peoples, politicians, and companies will get the hint. Government sponsored, or not, it doesn't matter. The anti-world behavior exhibited by China and its populace clearly shows they are not a friend to anyone by themselves. Trade with China should be reconsidered on a global scale.
- titzer 6y agoStallman was right.
- leric 6y agoThat why you can't use Huawei
- solotronics 6y agoIt's kind of a pain in the ass but a solution is to set these devices all in their own L2/L3 network segment with separate routing (via a different VPN) out to public.
- kburman 6y agoI connected a chinese router to internet and within a day I was seeing DNS request for qq.com and baidu.com. And there were no devices attached to it and nor anyone use any of these sites. I was really concerned at this in time what other that it might be doing I'm not even aware of.
- ronlobo 6y agoWondering if Huawei routers have backdoors backed in as well...
- AndyMcConachie 6y agoCan someone explain what the actual backdoor is without me having to wade through pounds and pounds of narrative text that doesn't actually explain anything? I started watching the video, but it just looks like self-congratulatory nonsense.
- choicenotchance 6y agoAnyone have any info on this affecting Sony Bravia smart TVs? I recently purchased some.