6 ms·

Read this: https://james-clee.com/2020/04/18/multiple-wavlink-vulnerabilities/ https://james-clee.com/2020/04/18/multiple-wavlink-vulnerabi... >Low and behold,

Read this: https://james-clee.com/2020/04/18/multiple-wavlink-vulnerabilities/ https://james-clee.com/2020/04/18/multiple-wavlink-vulnerabi... >Low and behold, there was my super secret password in plain text, with the admin username in plain text, on a page that requires no authentication of any kind to view. It is so fucking dumb that there is no other explanation other than an intentional backdoor. If anyone quotes Occam's Razor, you've been asleep for the past 5 years or so.

untog 6y ago
If I was making an intentional back door I wouldn't make anything that stupid. The super-secret password is "password123". Maybe you have more faith in developers than I do because this sounds exactly like a dumb mistake/cutting corners to me.
- mynameisvlad 6y ago
  I don't think you understand, "password123!" was the password the researcher set. In the CVE, it details the call it executes to retrieve the password from nvram.
  - untog 6y ago
    Ahh I misread. Even still. Directly injecting the password in the source of a JS file for the purposes of checking authentication? That screams naive error to me.
Spivak 6y ago
From that article I honestly think the answer is incompetence. I've seen almost the exact same mistakes from really junior devs who are out of their conceptual league. They don't know what a session is or how auth is supposed to work or cookies and they have this web server that serves JS and templated HTML so they just use that. And it "works."
kps 6y ago
> If anyone quotes Occam's Razor You probably mean Hanlon's Razor¹, which has been used so much it no longer cuts². ¹ https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor ² https://www.brainyquote.com/quotes/ian_fleming_539058 https://www.brainyquote.com/quotes/ian_fleming_539058
- vsareto 6y ago
  I knew it was one of those stupid razors that people post smugly about
- ebg13 6y ago
  See also "Hanlon's Handgun" from https://news.ycombinator.com/item?id=21691282 https://news.ycombinator.com/item?id=21691282
JeremyNT 6y ago
I disagree completely. This is exactly the kind of thing somebody might slip into a local debug build while testing. This researcher isn't doing anything that complicated to find this page, and the page needs no authentication at all so it's not restricted to e.g. authentication via a secret that's held by the manufacturer. If you want to make a backdoor, at least put some effort into it. This doesn't have the features I'd expect in a good backdoor.
- vsareto 6y ago
  Or maybe someone told the developer to implement a backdoor and this was the only way they thought they could do it? Can someone explain what we get by assuming the Chinese are just so inept at technology (they aren't) that we give them the benefit of the doubt that this is a naive mistake here?
  - Ekaros 6y ago
    To me it is the most logical option. It really comes down to what we pay for. If we order the cheapest possible unit price from China(or anywhere else in the world), we can't really expect them to care or even have the best people work on it. As clearly we don't either. Just look at IoT crap produced around the world. Are they inept, or is security an after thought? On other hand I believe that companies like Huawei are capable of very special things just like western counterparts.
  - mr_toad 6y ago
    > Can someone explain what we get by assuming the Chinese are just so inept at technology (they aren't) that we give them the benefit of the doubt that this is a naive mistake here? Hardware manufacturers in general have a pretty poor reputation for security & software engineering, Chinese or otherwise. It’s not like Cisco has been vulnerability free.
  - JeremyNT 6y ago
    This has nothing to do with this being a Chinese device, and everything to do with it being a low cost consumer device. The incentives for quality code here are incredibly weak, and the incentives for caring about security are basically zero. What damage does this vulnerability cause to Jetstream as a brand? It's not like they're going to lose many sales from people who read tech news sites. If you need to get something working at the cheapest price point possible, you cut all the corners you can - especially in the ways that don't manifest until outside the return period. Paying senior developers and doing external code audits are luxuries you can't really afford.
dchichkov 6y ago
It is not necessarily an intentional backdoor. This simply could be an unmodified engineering sample code with no security. It is a hard problem to solve. It is of advantage to China to flood US and European markets with cheap AND insecure hardware.

untog 6y ago

If I was making an intentional back door I wouldn't make anything that stupid. The super-secret password is "password123". Maybe you have more faith in developers than I do because this sounds exactly like a dumb mistake/cutting corners to me.

mynameisvlad 6y ago
I don't think you understand, "password123!" was the password the researcher set. In the CVE, it details the call it executes to retrieve the password from nvram.
- untog 6y ago
  Ahh I misread. Even still. Directly injecting the password in the source of a JS file for the purposes of checking authentication? That screams naive error to me.

Spivak 6y ago

From that article I honestly think the answer is incompetence. I've seen almost the exact same mistakes from really junior devs who are out of their conceptual league. They don't know what a session is or how auth is supposed to work or cookies and they have this web server that serves JS and templated HTML so they just use that. And it "works."

kps 6y ago

> If anyone quotes Occam's Razor You probably mean Hanlon's Razor¹, which has been used so much it no longer cuts². ¹ https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor ² https://www.brainyquote.com/quotes/ian_fleming_539058 https://www.brainyquote.com/quotes/ian_fleming_539058

vsareto 6y ago
I knew it was one of those stupid razors that people post smugly about
ebg13 6y ago
See also "Hanlon's Handgun" from https://news.ycombinator.com/item?id=21691282 https://news.ycombinator.com/item?id=21691282

JeremyNT 6y ago

I disagree completely. This is exactly the kind of thing somebody might slip into a local debug build while testing. This researcher isn't doing anything that complicated to find this page, and the page needs no authentication at all so it's not restricted to e.g. authentication via a secret that's held by the manufacturer. If you want to make a backdoor, at least put some effort into it. This doesn't have the features I'd expect in a good backdoor.

vsareto 6y ago
Or maybe someone told the developer to implement a backdoor and this was the only way they thought they could do it? Can someone explain what we get by assuming the Chinese are just so inept at technology (they aren't) that we give them the benefit of the doubt that this is a naive mistake here?
- Ekaros 6y ago
  To me it is the most logical option. It really comes down to what we pay for. If we order the cheapest possible unit price from China(or anywhere else in the world), we can't really expect them to care or even have the best people work on it. As clearly we don't either. Just look at IoT crap produced around the world. Are they inept, or is security an after thought? On other hand I believe that companies like Huawei are capable of very special things just like western counterparts.
- mr_toad 6y ago
  > Can someone explain what we get by assuming the Chinese are just so inept at technology (they aren't) that we give them the benefit of the doubt that this is a naive mistake here? Hardware manufacturers in general have a pretty poor reputation for security & software engineering, Chinese or otherwise. It’s not like Cisco has been vulnerability free.
- JeremyNT 6y ago
  This has nothing to do with this being a Chinese device, and everything to do with it being a low cost consumer device. The incentives for quality code here are incredibly weak, and the incentives for caring about security are basically zero. What damage does this vulnerability cause to Jetstream as a brand? It's not like they're going to lose many sales from people who read tech news sites. If you need to get something working at the cheapest price point possible, you cut all the corners you can - especially in the ways that don't manifest until outside the return period. Paying senior developers and doing external code audits are luxuries you can't really afford.

dchichkov 6y ago

It is not necessarily an intentional backdoor. This simply could be an unmodified engineering sample code with no security. It is a hard problem to solve. It is of advantage to China to flood US and European markets with cheap AND insecure hardware.