7 ms·

Am I the only one who thinks that Wal-Mart should be absolutely slammed for doing this? Like, they are a corporation actively participating in the material wors

Am I the only one who thinks that Wal-Mart should be absolutely slammed for doing this? Like, they are a corporation actively participating in the material worsening of our national security. I don't even want to think about a threat model that includes undermined router hardware! If they can't be patched remotely those things need to be recalled, destroyed, and Wal-Mart fined significantly. (When I say slammed I mostly mean "pay big fines", maybe jail time if the flaw was known, and it should result in real reputational damage to Wal-Mart and its willingness to sell anything with a network connected computer in it. At the very least, if the buy cost is even less than the china price, that difference is coming from somewhere. Wal Mart should have spotted that.)

kortilla 6y ago
It doesn’t sound like the back door was put in for Walmart to use. So no, Walmart shouldn’t be slammed for this vulnerability anymore than for the vulnerabilities in the PCs they sell.
- heavyset_go 6y ago
  If Walmart sold products that were contaminated with lead, and people got sick, they would still be held liable even if they didn't manufacture the products themselves.
  - javajosh 6y ago
    This, exactly.
    - waffle_ss 6y ago
      There’s a vote button for expressing that sentiment
  - cogman10 6y ago
    Seems analogous the child labor and slave problem. Walmart keeps on getting caught selling unethically produced goods. We need stronger laws to punish them when that happens. It doesn't seem to be enough to allow them to self govern. Ditto for the likes of Amazon.
    - lotsofpulp 6y ago
      Define unethically produced goods. I consider the labor laws in most US states to quality as unethical.
      - cogman10 6y ago
        Sort of "You know it when you see it" situation. I can come up with examples of unethical production, I doubt I could come up with a solid definition of unethical which covers all definitions of an unethically produced good. For now, it's easy enough to say "Goods produced by slave and child labor". From there, I think it is healthy to expand the law and regulations to capture missed or current unethical production practices. For example, production which produces a lot of CO2. Or production which pollutes the local environment. You could even go so far as saying "production where anyone in a company is making more than 10x anyone else". Some may disagree with my examples of what are unethical. Which is fine. I think there are sections, though, that nobody should disagree with (and if you do, you're a monster).
  - wil421 6y ago
    One thing can kill you. One cannot.
    - heavyset_go 6y ago
      You can certainly prove damages in court for both.
    - cyberlurker 6y ago
      Botnet made of cheap IoT being used for DDoS ransom on a hospital. Someone can easily die.
    - rasz 6y ago
      2014 https://www.techdirt.com/articles/20140511/06390427191/michael-hayden-gleefully-admits-we-kill-people-based-metadata.shtml https://www.techdirt.com/articles/20140511/06390427191/micha... Michael Hayden: "We Kill People Based on Metadata"
  - jimmaswell 6y ago
    Would they really though?
  - floatingatoll 6y ago
    Only if Walmart failed to apply a level of diligence sufficient to protect against lead exposure risk, a known risk with laws in place demanding appropriate care and notification and recalls. What is the industry-accepted, “will pass muster by a judge and jury”, level of due diligence that is considered minimally acceptable when purchasing Internet-connected devices from a supplier for resale to consumers? The current answer as I understand is, simply, “no level of due diligence is expected with regards to network functionality, as the relevant UL/CE standards for ‘networking’ only concern themselves with RF interference at most”. Should all computer resellers of any business size, whether Walmart nationwide or PC Hand-Me-Downs in a single city, be required to hire specialists to disassemble device firmwares for auditing purposes? Should this burden be placed on importers? Is this even legal under the DMCA? Should the UL certification be found at fault here, since clearly they did not audit nor certify the device’s preinstalled firmware?
    - donmcronald 6y ago
      The importer should be liable.
- whoknew1122 6y ago
  It's not the same thing. A PC can be patched. Patching the router requires firmware update, which requires cooperation from the vendor (which seems unlikely given the vendor intentionally implemented the vulnerabilities in the first place). Yes, Walmart should be slammed for this. It's the Walmart's responsibility to protect its customers by sourcing secure electronics--especially when they're advertising the router as a Walmart exclusive. They're explicitly aligning themselves with the vendor. But Walmart won't be slammed for this. Because the people who buy cheap routers from Walmart typically aren't the most tech savvy bunch.
  - kortilla 6y ago
    > A PC can be patched. Patching the router requires firmware update, which requires cooperation from the vendor You’re not realistically patching Windows without Microsoft’s cooperation.
    - Shared404 6y ago
      I think they were talking about hardware wise. You can remove Windows and replace it with Linux or *BSD or what have you and then patch that yourself on commodity hardware. Meanwhile, the router both A) Comes with an OS that you may or may not be able to patch, and B) You may or may not be able to replace it with something you can.
- wegs 6y ago
  Someone within US jurisdictions ought to be liable. As far as I can tell, that's the company who imported and sold it. If Amazon and Walmart are liable, I won't need to worry about fake Sandisk memory cards, fake medicines, fake clothing, and other fake products there. I'd love that. Maybe I just had a really bad 6 months with Amazon, but it seems everything that comes is a fake or a scam. I'd gladly pay 10% more for real products than 10% less for 50-50. Right now, I switched to mostly buying off-brands direct from China for a lot of products, since I get the same thing as Amazon, but at a lower price and with an honest label. Or buying direct from manufacturers if I want something real. I got screwed once doing even that, though. I ordered a brand-name headset. They did... fulfillment by Amazon. The headset is barely usable, so I'm assuming Amazon did commingled products. Or perhaps I got a defective copy. In either case, not worth fighting for 50 bucks.
  - heavyset_go 6y ago
    > In either case, not worth fighting for 50 bucks. Contact your state's AG, they usually have a consumer protection office that handles complaints like this.
  - kortilla 6y ago
    > won't need to worry about fake Sandisk memory cards, fake medicines, fake clothing, and other fake products there. Fake and flawed (a vulnerability) are not in the same category. The first is fraud, the second is just standard flaws in the product.
- DEADBEEFC0FFEE 6y ago
  They chose the product to sell. That are absolutely part of the problem. Consumers buying cheap shite is also a problem.
mountainb 6y ago
Sure, find some customers and sue on their behalf; this is a product liability issue. However, you would have to show actual damages to collect much. If the router the plaintiff purchased was never compromised, it might be tough to claim significant damages. Even the purported harm to privacy would have to be demonstrated. There may be other crimes related to selling compromised hardware, but that might require actual knowledge or constructive knowledge that the products were compromised. So for example, if you buy a defective helmet for your kid from Walmart, the kid gets into an accident, and the kid dies, you sue Walmart for damages commensurate to the death of the child. For the router, you have to show the compromise that resulted from the vulnerability and the damages that ensued. If there was no compromise and just the potential for compromise the damages may be quite limited. So Walmart might have some good faith defenses and it might be challenging to show enough damages. There may also be some fines that the FTC could levy related to this because of the deceptive trade practices associated with selling a fatally defective product that could pose serious risks to privacy.
floatingatoll 6y ago
No, but Walmart should begin preparing to turn over a complete list of all identifiable purchasers of these devices when the FBI asks for it, and if we had a functioning US government, they should be compelled to issue a recall with refund for them.
- deleted 6y ago
  [deleted]
canada_dry 6y ago
> actively participating in the material worsening of our national security It's really just a symptom of the race-to-the-bottom that Wal-Mart has been strongly championing for a couple decades. Everything must be manufactured in China at the lowest BOM cost possible. And, of course, it's us consumers that fuel this race.

kortilla 6y ago

It doesn’t sound like the back door was put in for Walmart to use. So no, Walmart shouldn’t be slammed for this vulnerability anymore than for the vulnerabilities in the PCs they sell.

heavyset_go 6y ago
If Walmart sold products that were contaminated with lead, and people got sick, they would still be held liable even if they didn't manufacture the products themselves.
- javajosh 6y ago
  This, exactly.
  - waffle_ss 6y ago
    There’s a vote button for expressing that sentiment
- cogman10 6y ago
  Seems analogous the child labor and slave problem. Walmart keeps on getting caught selling unethically produced goods. We need stronger laws to punish them when that happens. It doesn't seem to be enough to allow them to self govern. Ditto for the likes of Amazon.
  - lotsofpulp 6y ago
    Define unethically produced goods. I consider the labor laws in most US states to quality as unethical.
    - cogman10 6y ago
      Sort of "You know it when you see it" situation. I can come up with examples of unethical production, I doubt I could come up with a solid definition of unethical which covers all definitions of an unethically produced good. For now, it's easy enough to say "Goods produced by slave and child labor". From there, I think it is healthy to expand the law and regulations to capture missed or current unethical production practices. For example, production which produces a lot of CO2. Or production which pollutes the local environment. You could even go so far as saying "production where anyone in a company is making more than 10x anyone else". Some may disagree with my examples of what are unethical. Which is fine. I think there are sections, though, that nobody should disagree with (and if you do, you're a monster).
- wil421 6y ago
  One thing can kill you. One cannot.
  - heavyset_go 6y ago
    You can certainly prove damages in court for both.
  - cyberlurker 6y ago
    Botnet made of cheap IoT being used for DDoS ransom on a hospital. Someone can easily die.
  - rasz 6y ago
    2014 https://www.techdirt.com/articles/20140511/06390427191/michael-hayden-gleefully-admits-we-kill-people-based-metadata.shtml https://www.techdirt.com/articles/20140511/06390427191/micha... Michael Hayden: "We Kill People Based on Metadata"
- jimmaswell 6y ago
  Would they really though?
- floatingatoll 6y ago
  Only if Walmart failed to apply a level of diligence sufficient to protect against lead exposure risk, a known risk with laws in place demanding appropriate care and notification and recalls. What is the industry-accepted, “will pass muster by a judge and jury”, level of due diligence that is considered minimally acceptable when purchasing Internet-connected devices from a supplier for resale to consumers? The current answer as I understand is, simply, “no level of due diligence is expected with regards to network functionality, as the relevant UL/CE standards for ‘networking’ only concern themselves with RF interference at most”. Should all computer resellers of any business size, whether Walmart nationwide or PC Hand-Me-Downs in a single city, be required to hire specialists to disassemble device firmwares for auditing purposes? Should this burden be placed on importers? Is this even legal under the DMCA? Should the UL certification be found at fault here, since clearly they did not audit nor certify the device’s preinstalled firmware?
  - donmcronald 6y ago
    The importer should be liable.
whoknew1122 6y ago
It's not the same thing. A PC can be patched. Patching the router requires firmware update, which requires cooperation from the vendor (which seems unlikely given the vendor intentionally implemented the vulnerabilities in the first place). Yes, Walmart should be slammed for this. It's the Walmart's responsibility to protect its customers by sourcing secure electronics--especially when they're advertising the router as a Walmart exclusive. They're explicitly aligning themselves with the vendor. But Walmart won't be slammed for this. Because the people who buy cheap routers from Walmart typically aren't the most tech savvy bunch.
- kortilla 6y ago
  > A PC can be patched. Patching the router requires firmware update, which requires cooperation from the vendor You’re not realistically patching Windows without Microsoft’s cooperation.
  - Shared404 6y ago
    I think they were talking about hardware wise. You can remove Windows and replace it with Linux or *BSD or what have you and then patch that yourself on commodity hardware. Meanwhile, the router both A) Comes with an OS that you may or may not be able to patch, and B) You may or may not be able to replace it with something you can.
wegs 6y ago
Someone within US jurisdictions ought to be liable. As far as I can tell, that's the company who imported and sold it. If Amazon and Walmart are liable, I won't need to worry about fake Sandisk memory cards, fake medicines, fake clothing, and other fake products there. I'd love that. Maybe I just had a really bad 6 months with Amazon, but it seems everything that comes is a fake or a scam. I'd gladly pay 10% more for real products than 10% less for 50-50. Right now, I switched to mostly buying off-brands direct from China for a lot of products, since I get the same thing as Amazon, but at a lower price and with an honest label. Or buying direct from manufacturers if I want something real. I got screwed once doing even that, though. I ordered a brand-name headset. They did... fulfillment by Amazon. The headset is barely usable, so I'm assuming Amazon did commingled products. Or perhaps I got a defective copy. In either case, not worth fighting for 50 bucks.
- heavyset_go 6y ago
  > In either case, not worth fighting for 50 bucks. Contact your state's AG, they usually have a consumer protection office that handles complaints like this.
- kortilla 6y ago
  > won't need to worry about fake Sandisk memory cards, fake medicines, fake clothing, and other fake products there. Fake and flawed (a vulnerability) are not in the same category. The first is fraud, the second is just standard flaws in the product.
DEADBEEFC0FFEE 6y ago
They chose the product to sell. That are absolutely part of the problem. Consumers buying cheap shite is also a problem.

mountainb 6y ago

Sure, find some customers and sue on their behalf; this is a product liability issue. However, you would have to show actual damages to collect much. If the router the plaintiff purchased was never compromised, it might be tough to claim significant damages. Even the purported harm to privacy would have to be demonstrated. There may be other crimes related to selling compromised hardware, but that might require actual knowledge or constructive knowledge that the products were compromised. So for example, if you buy a defective helmet for your kid from Walmart, the kid gets into an accident, and the kid dies, you sue Walmart for damages commensurate to the death of the child. For the router, you have to show the compromise that resulted from the vulnerability and the damages that ensued. If there was no compromise and just the potential for compromise the damages may be quite limited. So Walmart might have some good faith defenses and it might be challenging to show enough damages. There may also be some fines that the FTC could levy related to this because of the deceptive trade practices associated with selling a fatally defective product that could pose serious risks to privacy.

floatingatoll 6y ago

No, but Walmart should begin preparing to turn over a complete list of all identifiable purchasers of these devices when the FBI asks for it, and if we had a functioning US government, they should be compelled to issue a recall with refund for them.

deleted 6y ago
[deleted]

canada_dry 6y ago

> actively participating in the material worsening of our national security It's really just a symptom of the race-to-the-bottom that Wal-Mart has been strongly championing for a couple decades. Everything must be manufactured in China at the lowest BOM cost possible. And, of course, it's us consumers that fuel this race.