3 ms·
Im not sure why but reading this article raises my internal BS skepto-meter. The story explains that the companies in question have access to RPC functions sim
by sigmaprimus 6y ago
Im not sure why but reading this article raises my internal BS skepto-meter.
The story explains that the companies in question have access to RPC functions similar to those that an ISP might use but that they are not ISPs. Then later on the article states that one of the companies described itself as an ISP.
The story also questions why there is a GUI for running remote commands and why a device would need to scan for nearby networks. I can think of a few legitimate reasons for both but no reason a decent backdoor would have a server side backdoor GUI.
Just my opinion but I get the feeling this whole situation was created by IP theft in the form of firmware duplication. It seems these companies have used a very insecure firmware possibly made intentionally bad to trap or setup these Chinese manufacturers.
If these are in fact intentional backdoors they were made with an incredible amount of effort to look like sloppy 0day exploits.
I should add that I don't doubt that these vulnerabilities are real, just the intent behind them.
If I was having my products manufactured in China, I might provide a similar bad firmware for the factory too, then patch the devices before providing them to my customers to prevent IP theft.
- bmcn2020 6y agoHey there - author of the article here. The research team behind this has a lot of unanswered questions as well, and a lot of...(like you) conjectures about how this may have arisen. Normally, one should not attribute to malice what can simply be attributed to stupidity or probably laziness here. Even then, however, it's a bit too suspicious though. Of course, we asked the manufacturers behind these devices for comment and -- surprise! -- no comment. In past experience with Chinese vendors, we've had similar results. Of course, we'll update with any information we get. Thanks for reading!
- sigmaprimus 6y agoI would start by examining the getWifi.sh file a bit closer, chances are it's part of either a WPS or Network Bridge scheme. Having thought about this story for a while now, I also think it is worth investigation, I might purchase an extender off Amazon. The one part of the story I can't reconcile is how the Chinese IP attacker managed to find the device. I doubt this could have occured just from random port scanning so there must be a call home, possibly by loading a hidden image on the "Backdoor GUI"? The story was well written, just not sure it made me thristy enough to drink the koolaid...or maybe it did! :P
- jml7c5 6y agoRandom attacks are much more frequent than one might expect. If you are unlucky enough to have a device that accepts the default telnet user/pass of 'root'/'xc3511' and you leave it open to the internet, you can expect it to be compromised in less than five minutes. [0] [0]: https://isc.sans.edu/forums/diary/An+Update+On+DVR+Malware+A+DVR+Torture+Chamber/22762 https://isc.sans.edu/forums/diary/An+Update+On+DVR+Malware+A...
- bmcn2020 6y agoIf you are thirsty enough to test it yourself, please let us know if you find anything!