4 ms·

> A hardcoded credential vulnerability was identified in the “zyfwp” user account in some Zyxel firewalls and AP controllers. The account was designed to delive

by shakna 6y ago

> A hardcoded credential vulnerability was identified in the “zyfwp” user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP. Also translated as: In the name of "improving security" we created a backdoor, which is known throughout the entire industry as "removing all security". We are very sorry we were caught so easily. It does not take much to understand this was a terrible idea. Or that there are so many better ways to build and deploy automatic updates. You absolutely do not need to be able to control a machine remotely to deploy automatic updates. But counting the ways they went wrong building this update system makes it extremely hard to believe that was the intent. > After a thorough investigation, we’ve identified the vulnerable products that are within their warranty and support period and are releasing firmware patches to address the issue, as shown in the table below. That they went to the effort of identifying their minimal viable liability and all released patches for that, makes it even more disingenuous. This is a company whose business is supposed to be about enhancing security. They should know better.

J-Kuhn 6y ago
> 2020-12-02: Zyxel requests more information about how the vulnerability was discovered Sorry, but how did you figure it out? Can we hide it better next time?
- albertgoeswoof 6y ago
  More like- did you violate any eula’s or laws in discovering this so we can sue you and call you a “convicted criminal hacker”
dylan604 6y ago
For something this severe, it should be made to everyone regardless of their current 'warranty and support period' status.
- john_moscow 6y ago
  You'd be surprised, but it often comes to "nobody knows how to build that 10 year old piece of firmware anymore".
  - bartvk 6y ago
    This. That's why I prefer to buy devices that have known compatibility with OpenWRT.
- 0x426577617265 6y ago
  > It seemed the vulnerability had been introduced in the latest firmware version. Even though older versions do not have this vulnerability, they do have others (such as this buffer overflow) so you should still update.
deleted 6y ago
[deleted]
moepstar 6y ago
>This is a company whose business is supposed to be about enhancing security. They should know better. Except they don't. Having owned a Zyxel NAS (comically named "NSA" back then), i can tell you their firmware, updates and support are even worse than you can imagine. After this NAS, i vowed to never ever buy or touch any kind of Zyxel hardware again.
rhn_mk1 6y ago
> You absolutely do not need to be able to control a machine remotely to deploy automatic updates. Huh? How are you supposed to deploy the update then, or make it effective? I think the definition of "remotely control" differs somewhat from mine. I could agree that you don't need to uniquely address a remote machine to deploy updates, but having control over the machine (if only for a moment) is the purpose of the update process.
- shakna 6y ago
  "control remotely" as in "issue arbitrary commands" is absolutely _not_ required for an update mechanism. The machine _itself_ can check for updates, and issue _only_ those commands that are _necessary_. You don't need complete control over a machine for an update mechanism. But the entire update infrastructure has issues... Firmware binaries downloaded over unprotected basic FTP... No checksums... No authenticated signatures... And arbitrary commands issued at the root level.
  - rhn_mk1 6y ago
    > The machine _itself_ can check for updates, and issue _only_ those commands that are _necessary_. The problem with this statement is that the machine doesn't know what sequence of actions is necessary to put the system into the "updated" state. If it knew, it wouldn't have to contact anything in order to update itself. It would already have known.
    - blumomo 6y ago
      Where in „client pulls a signed image with a secure and trusted process from the update server, flashes it, then swaps it with its previous image“ does the update server command any control over the client?
      - rhn_mk1 6y ago
        That depends on the contents of the supplied image. But I agree, it's more about the need for the ability to take over control rather than exercising the ability.

by shakna 6y ago

J-Kuhn 6y ago

> 2020-12-02: Zyxel requests more information about how the vulnerability was discovered Sorry, but how did you figure it out? Can we hide it better next time?

albertgoeswoof 6y ago
More like- did you violate any eula’s or laws in discovering this so we can sue you and call you a “convicted criminal hacker”

dylan604 6y ago

For something this severe, it should be made to everyone regardless of their current 'warranty and support period' status.

john_moscow 6y ago
You'd be surprised, but it often comes to "nobody knows how to build that 10 year old piece of firmware anymore".
- bartvk 6y ago
  This. That's why I prefer to buy devices that have known compatibility with OpenWRT.
0x426577617265 6y ago
> It seemed the vulnerability had been introduced in the latest firmware version. Even though older versions do not have this vulnerability, they do have others (such as this buffer overflow) so you should still update.

deleted 6y ago

[deleted]

moepstar 6y ago

>This is a company whose business is supposed to be about enhancing security. They should know better. Except they don't. Having owned a Zyxel NAS (comically named "NSA" back then), i can tell you their firmware, updates and support are even worse than you can imagine. After this NAS, i vowed to never ever buy or touch any kind of Zyxel hardware again.

rhn_mk1 6y ago

> You absolutely do not need to be able to control a machine remotely to deploy automatic updates. Huh? How are you supposed to deploy the update then, or make it effective? I think the definition of "remotely control" differs somewhat from mine. I could agree that you don't need to uniquely address a remote machine to deploy updates, but having control over the machine (if only for a moment) is the purpose of the update process.

shakna 6y ago
"control remotely" as in "issue arbitrary commands" is absolutely _not_ required for an update mechanism. The machine _itself_ can check for updates, and issue _only_ those commands that are _necessary_. You don't need complete control over a machine for an update mechanism. But the entire update infrastructure has issues... Firmware binaries downloaded over unprotected basic FTP... No checksums... No authenticated signatures... And arbitrary commands issued at the root level.
- rhn_mk1 6y ago
  > The machine _itself_ can check for updates, and issue _only_ those commands that are _necessary_. The problem with this statement is that the machine doesn't know what sequence of actions is necessary to put the system into the "updated" state. If it knew, it wouldn't have to contact anything in order to update itself. It would already have known.
  - blumomo 6y ago
    Where in „client pulls a signed image with a secure and trusted process from the update server, flashes it, then swaps it with its previous image“ does the update server command any control over the client?
    - rhn_mk1 6y ago
      That depends on the contents of the supplied image. But I agree, it's more about the need for the ability to take over control rather than exercising the ability.