7 ms·

Backdoor in Zyxel Products

184 points by ta988 6y ago

emmanueloga_ 6y ago
I thought they had found vulnerabilities on my 14,400 baud modem. Phew. :-p The modem brands I still remember are Zyxel and US Robotics.
- arthuryip 6y ago
  They made slightly faster modems at 16800 or 19200 if both sides are running Zyxels.
mobilio 6y ago
In short - zyfwp is another way to login as root.
theamk 6y ago
It's a pity there are no long-term effects from the cases like those. We've had a serious security vulnerability introduced in the firmware release, and there were no negative consequences for Zyxel at all, other than some bad press (and it's probably a fairly small amount of the bad press). What I would like to see is a post-mortem with mitigations -- how did this happen, and how will they prevent similar occurrences in the future. Instead, most likely nothing will happen. And I will not be surprised if the "firmware update account" will be back in the next release, probably still insecure, but hidden better so that random researchers won't stumble on it. I wish there were some sort of liability for the manufacturers for the cases like those. For example, if a person runs a red light by accident and get caught, they get a fine and an insurance premium increase. We need something like this for IOT suppliers as well.
- 8organicbits 6y ago
  > but hidden better so that random researchers won't stumble on it. > 2020-12-02: Zyxel requests more information about how the vulnerability was discovered Hmm
  - doesnt_know 6y ago
    This is probably a fairly hot take but I believe that researchers shoudn't normanize providing this level of detail unless they have been explicitly hired to do so. The industry is pretty messed up and it sometimes feels like researchers/pen testers/bug hunters are effectively subsidizing and protecting shitty security practises.
    - albntomat0 6y ago
      > The industry is pretty messed up and it sometimes feels like researchers/pen testers/bug hunters are effectively subsidizing and protecting shitty security practises. In my opinion, this is a result of there being little/no consequences of being breached due to incompetence. Zyxel isn’t losing anything from this, and has no incentives to be better.
sarcasmatwork 6y ago
These devices have been owned for awhile now. I thought everyone knew? https://www.zyxel.com/us/en/support/security_advisories.shtml https://www.zyxel.com/us/en/support/security_advisories.shtm... Do a search for "cve zyxel"
- ta988 6y ago
  CVE short for CaVeat Emptor in that case :D
- l33tman 6y ago
  It's so uncommon to see "owned" spelled with just alphabetics that I had to read the sentence a few times to figure out what you meant :)
DoofusOfDeath 6y ago
Is there any kind of independent organization from which networking device vendors can seek security certification? E.g., they get to review all hw / sw / firmware, and if appropriate make a public affirmation that they could find no vulnerabilities for that stack?
- edoceo 6y ago
  UL need to step up their game
- marcan_42 6y ago
  Most of the time such reviews are not practical; they cost too much money and don't deliver results. Such review industries are almost always all about the rubber stamp and don't end up employing competent reviewers. See e.g. the Infineon ROCA flaw that FIPS certification didn't catch (even though that code reeked of them being too clever, and should've gone through proper cryptanalysis). See: flaws in the FIPS YubiKey (specific to that version! The certification requirements introduced vulns!) See: every audit of every terrible CA ever.
sqldba 6y ago
No bug bounty?
- aborsy 6y ago
  But this is a backdoor, thus not eligible for bug payment.
shakna 6y ago
> A hardcoded credential vulnerability was identified in the “zyfwp” user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP. Also translated as: In the name of "improving security" we created a backdoor, which is known throughout the entire industry as "removing all security". We are very sorry we were caught so easily. It does not take much to understand this was a terrible idea. Or that there are so many better ways to build and deploy automatic updates. You absolutely do not need to be able to control a machine remotely to deploy automatic updates. But counting the ways they went wrong building this update system makes it extremely hard to believe that was the intent. > After a thorough investigation, we’ve identified the vulnerable products that are within their warranty and support period and are releasing firmware patches to address the issue, as shown in the table below. That they went to the effort of identifying their minimal viable liability and all released patches for that, makes it even more disingenuous. This is a company whose business is supposed to be about enhancing security. They should know better.
- J-Kuhn 6y ago
  > 2020-12-02: Zyxel requests more information about how the vulnerability was discovered Sorry, but how did you figure it out? Can we hide it better next time?
  - albertgoeswoof 6y ago
    More like- did you violate any eula’s or laws in discovering this so we can sue you and call you a “convicted criminal hacker”
- dylan604 6y ago
  For something this severe, it should be made to everyone regardless of their current 'warranty and support period' status.
  - john_moscow 6y ago
    You'd be surprised, but it often comes to "nobody knows how to build that 10 year old piece of firmware anymore".
deleted 6y ago
[deleted]
gscott 6y ago
I have been thinking of daisy chaining 4 or 5 firewalls together for perfect security.
- Puts 6y ago
  To make sure you have at least one exploitable device with a buffer overflow triggered by a malformed TCP-packge? :D
- stordoff 6y ago
  I've been doing something vaguely similar, largely out of laziness, for the past few years. My ISP's router (largely) retains its default settings, then my main router/firewall[1] sits behind that in a double-NAT configuration (treating the ISP router as being on the WAN side). Works well enough in practice - it's never caused me any issues in the ten or so years I've been doing it (port forwarding becomes a two-step process, but I _very_ rarely need to do that, so it's a non-issue for me). [1] Typically pfSense, though it's just a generic Eero setup for now while I reconfigure some stuff33333333
dvh 6y ago
Company that makes this clearly is completely incompetent in computer security, nobody should buy their products. Ever.
jml7c5 6y ago
Is "backdoor" the right term for this? I was under the impression that it implied intent. I.e., a "backdoor" is something added specifically to provide access through abnormal means, not just something that can be used to provide access. This seems more like a mistake, particularly since they included the password in plaintext.
- rzzzt 6y ago
  It's a locked front door, with the key under the flower pot. (But that's too long to write out each time.)
- npteljes 6y ago
  I see your point. While this uses the normal authentication method (user, password), the undisclosed nature of the account makes it a backdoor practically.
- colonwqbang 6y ago
  A secret way for the manufacturer to get into your device; the term "backdoor" is very appropriate I think. Most manufacturers would not go about it as clumsily as Xyxel, but it's the same thing.
  - jml7c5 6y ago
    But implicit in your statement that it's "a secret way for the manufacturer to get into your device" is the claim that Zyxel intended it as a bypass. It seems like without intent, anything can be called a "backdoor". My browser receives automatic updates, and Mozilla could push an update that gives them remote access to my user account. But I don't think anyone would say Mozilla has "backdoored" Firefox.
    - colonwqbang 6y ago
      Firstly, I think it's a lot to ask that we believe Zyxel put a backdoor in their products and then just forgot about it. But even if we choose to believe that, it's not wrong to say that it was secret. "Secret" typically means "without the knowledge of others". If I forget the secret combination to my safe, it doesn't become "not a secret" because of that. In your example, Mozilla has presumably made public that they are using remote updates. So it can hardly be described as secret.
usr1106 6y ago
I worked with WiFi developement 15 years ago. For testing interoperability we used many vendor's access points. Zyxel was always on the lower end quality-wise. So this story does not surprise me, nothing seems to have changed. Or maybe there is a positive element of surprise; they accepted that that's not the way to do it and fixed it in only 2 weeks.
- nfriedly 6y ago
  I have a Zyxel switch that I had to disconnect from my network because every once in awhile it would just go nuts - I'd get a crazy amount of traffic and upwards of 80% packet loss across my network. But just for a few minutes, then everything would go back to normal. Took me a while to narrow it down to the switch, and I'm still not really sure what was happening, but it hasn't come up again since I disconnected it.
astrophysics 6y ago
Sigh. I'll never buy another ZyXEL product. What are decent alternatives in a similar price range?
- snuxoll 6y ago
  You have some couple year old computer sitting around collecting dust? pfSense, OpnSense, VyOS, etc; there's Sophos XG home edition for personal use that I've had success with. You want a ready-to-use hardware package? Maybe a UniFi Security Gateway, Netgate (pfSense) appliances fit in the price range.
tapper 6y ago
This is why I use OpenWrt!

184 points by ta988 6y ago

I thought they had found vulnerabilities on my 14,400 baud modem. Phew. :-p The modem brands I still remember are Zyxel and US Robotics.

arthuryip 6y ago
They made slightly faster modems at 16800 or 19200 if both sides are running Zyxels.

mobilio 6y ago

In short - zyfwp is another way to login as root.

theamk 6y ago

It's a pity there are no long-term effects from the cases like those. We've had a serious security vulnerability introduced in the firmware release, and there were no negative consequences for Zyxel at all, other than some bad press (and it's probably a fairly small amount of the bad press). What I would like to see is a post-mortem with mitigations -- how did this happen, and how will they prevent similar occurrences in the future. Instead, most likely nothing will happen. And I will not be surprised if the "firmware update account" will be back in the next release, probably still insecure, but hidden better so that random researchers won't stumble on it. I wish there were some sort of liability for the manufacturers for the cases like those. For example, if a person runs a red light by accident and get caught, they get a fine and an insurance premium increase. We need something like this for IOT suppliers as well.

8organicbits 6y ago
> but hidden better so that random researchers won't stumble on it. > 2020-12-02: Zyxel requests more information about how the vulnerability was discovered Hmm
- doesnt_know 6y ago
  This is probably a fairly hot take but I believe that researchers shoudn't normanize providing this level of detail unless they have been explicitly hired to do so. The industry is pretty messed up and it sometimes feels like researchers/pen testers/bug hunters are effectively subsidizing and protecting shitty security practises.
  - albntomat0 6y ago
    > The industry is pretty messed up and it sometimes feels like researchers/pen testers/bug hunters are effectively subsidizing and protecting shitty security practises. In my opinion, this is a result of there being little/no consequences of being breached due to incompetence. Zyxel isn’t losing anything from this, and has no incentives to be better.

sarcasmatwork 6y ago

These devices have been owned for awhile now. I thought everyone knew? https://www.zyxel.com/us/en/support/security_advisories.shtml https://www.zyxel.com/us/en/support/security_advisories.shtm... Do a search for "cve zyxel"

ta988 6y ago
CVE short for CaVeat Emptor in that case :D
l33tman 6y ago
It's so uncommon to see "owned" spelled with just alphabetics that I had to read the sentence a few times to figure out what you meant :)

DoofusOfDeath 6y ago

Is there any kind of independent organization from which networking device vendors can seek security certification? E.g., they get to review all hw / sw / firmware, and if appropriate make a public affirmation that they could find no vulnerabilities for that stack?

edoceo 6y ago
UL need to step up their game
marcan_42 6y ago
Most of the time such reviews are not practical; they cost too much money and don't deliver results. Such review industries are almost always all about the rubber stamp and don't end up employing competent reviewers. See e.g. the Infineon ROCA flaw that FIPS certification didn't catch (even though that code reeked of them being too clever, and should've gone through proper cryptanalysis). See: flaws in the FIPS YubiKey (specific to that version! The certification requirements introduced vulns!) See: every audit of every terrible CA ever.

sqldba 6y ago

No bug bounty?

aborsy 6y ago
But this is a backdoor, thus not eligible for bug payment.

shakna 6y ago

> A hardcoded credential vulnerability was identified in the “zyfwp” user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP. Also translated as: In the name of "improving security" we created a backdoor, which is known throughout the entire industry as "removing all security". We are very sorry we were caught so easily. It does not take much to understand this was a terrible idea. Or that there are so many better ways to build and deploy automatic updates. You absolutely do not need to be able to control a machine remotely to deploy automatic updates. But counting the ways they went wrong building this update system makes it extremely hard to believe that was the intent. > After a thorough investigation, we’ve identified the vulnerable products that are within their warranty and support period and are releasing firmware patches to address the issue, as shown in the table below. That they went to the effort of identifying their minimal viable liability and all released patches for that, makes it even more disingenuous. This is a company whose business is supposed to be about enhancing security. They should know better.

J-Kuhn 6y ago
> 2020-12-02: Zyxel requests more information about how the vulnerability was discovered Sorry, but how did you figure it out? Can we hide it better next time?
- albertgoeswoof 6y ago
  More like- did you violate any eula’s or laws in discovering this so we can sue you and call you a “convicted criminal hacker”
dylan604 6y ago
For something this severe, it should be made to everyone regardless of their current 'warranty and support period' status.
- john_moscow 6y ago
  You'd be surprised, but it often comes to "nobody knows how to build that 10 year old piece of firmware anymore".

deleted 6y ago

[deleted]

gscott 6y ago

I have been thinking of daisy chaining 4 or 5 firewalls together for perfect security.

Puts 6y ago
To make sure you have at least one exploitable device with a buffer overflow triggered by a malformed TCP-packge? :D
stordoff 6y ago
I've been doing something vaguely similar, largely out of laziness, for the past few years. My ISP's router (largely) retains its default settings, then my main router/firewall[1] sits behind that in a double-NAT configuration (treating the ISP router as being on the WAN side). Works well enough in practice - it's never caused me any issues in the ten or so years I've been doing it (port forwarding becomes a two-step process, but I _very_ rarely need to do that, so it's a non-issue for me). [1] Typically pfSense, though it's just a generic Eero setup for now while I reconfigure some stuff33333333

dvh 6y ago

Company that makes this clearly is completely incompetent in computer security, nobody should buy their products. Ever.

jml7c5 6y ago

Is "backdoor" the right term for this? I was under the impression that it implied intent. I.e., a "backdoor" is something added specifically to provide access through abnormal means, not just something that can be used to provide access. This seems more like a mistake, particularly since they included the password in plaintext.

rzzzt 6y ago
It's a locked front door, with the key under the flower pot. (But that's too long to write out each time.)
npteljes 6y ago
I see your point. While this uses the normal authentication method (user, password), the undisclosed nature of the account makes it a backdoor practically.
colonwqbang 6y ago
A secret way for the manufacturer to get into your device; the term "backdoor" is very appropriate I think. Most manufacturers would not go about it as clumsily as Xyxel, but it's the same thing.
- jml7c5 6y ago
  But implicit in your statement that it's "a secret way for the manufacturer to get into your device" is the claim that Zyxel intended it as a bypass. It seems like without intent, anything can be called a "backdoor". My browser receives automatic updates, and Mozilla could push an update that gives them remote access to my user account. But I don't think anyone would say Mozilla has "backdoored" Firefox.
  - colonwqbang 6y ago
    Firstly, I think it's a lot to ask that we believe Zyxel put a backdoor in their products and then just forgot about it. But even if we choose to believe that, it's not wrong to say that it was secret. "Secret" typically means "without the knowledge of others". If I forget the secret combination to my safe, it doesn't become "not a secret" because of that. In your example, Mozilla has presumably made public that they are using remote updates. So it can hardly be described as secret.

usr1106 6y ago

I worked with WiFi developement 15 years ago. For testing interoperability we used many vendor's access points. Zyxel was always on the lower end quality-wise. So this story does not surprise me, nothing seems to have changed. Or maybe there is a positive element of surprise; they accepted that that's not the way to do it and fixed it in only 2 weeks.

nfriedly 6y ago
I have a Zyxel switch that I had to disconnect from my network because every once in awhile it would just go nuts - I'd get a crazy amount of traffic and upwards of 80% packet loss across my network. But just for a few minutes, then everything would go back to normal. Took me a while to narrow it down to the switch, and I'm still not really sure what was happening, but it hasn't come up again since I disconnected it.

astrophysics 6y ago

Sigh. I'll never buy another ZyXEL product. What are decent alternatives in a similar price range?

snuxoll 6y ago
You have some couple year old computer sitting around collecting dust? pfSense, OpnSense, VyOS, etc; there's Sophos XG home edition for personal use that I've had success with. You want a ready-to-use hardware package? Maybe a UniFi Security Gateway, Netgate (pfSense) appliances fit in the price range.

tapper 6y ago

This is why I use OpenWrt!