4 ms·

Have I woken up in some universe where the word “backdoor” doesn’t mean what it used to? I am used to backdoor implying malicious intent on the part of the vend

Have I woken up in some universe where the word “backdoor” doesn’t mean what it used to? I am used to backdoor implying malicious intent on the part of the vendor / author, or something left by an attacker. I’m just not seeing that here. This just looks like utterly unsurprising incompetence on the part of a consumer networking / IoT gear manufacturer. Yes, I know what a literal ‘back door’ is, and yes, I know that “make it look like incompetence” could be a strategy. I’d partially blame people being all hot and bothered about xz, but I can see that these files were committed two weeks ago.

rfoo 3y ago
> This just looks like utterly unsurprising incompetence on the part of a consumer networking / IoT gear manufacturer. Then how about Xiongmai NVRs [1]? Can I say it's just an incompetently implemented debug feature left enabled in production? [1] https://habr.com/en/articles/486856/ https://habr.com/en/articles/486856/
II2II 3y ago
I also get the impression that the definition has shifted, though I don't recall malicious intent from the vendor/author being a part of it. Classical backdoors include things like service accounts that were intended for the vendor, which were genuinely intended for service. Granted, those passwords were intended to be changed. (Also, that's not really appropriate for consumer grade gear though, since consumers have not received that level of support in decades and were not connected to networks when that level of service actually existed.) Either way though, I do seem to recall intention being part of the definition. Ah well. It's just a new meaning to get used to!
- BobbyTables2 3y ago
  They knowingly created a password less account because of their authentication system! If it isn’t a true backdoor, then it is utter stupidity and negligence! When it comes to security, why is EOL allowed by society? We don’t give 5 or 10 yr old cars a free pass to blow up or stop working without a manufacturer recall. Software is even easier to fix!
  - II2II 3y ago
    The tricky part is determining how long software should be supported for, at least with respect to security updates. I'm sure that most people would agree that 5 years is insufficient. Twenty five years, many would say is too long. As for the car analogy, it is a weak comparison. First of all, the owner is expected to do some upkeep. A car is more likely to be deemed unroadworth from a lack of upkeep as it is from a design flaw or manufacturer defect. The other consideration is that the notion of secure software is a shifting target. In the case of cars, physics is a passive adversary. In the case of computer security, the adversary is active. Is software security to be judged by the security standards of when it is developed, or of when it is used? The former will catch cases like this, but will prove ineffective in the long term. The latter will bankrupt the industry.
aaron695 3y ago
[dead]
halJordan 3y ago
I think you went to sleep in some other universe and are waking up in the real world where backdoor has always meant "bypasses the front door."
cjbprime 3y ago
I'm surprised it wasn't "authentication bypass" too.

rfoo 3y ago

> This just looks like utterly unsurprising incompetence on the part of a consumer networking / IoT gear manufacturer. Then how about Xiongmai NVRs [1]? Can I say it's just an incompetently implemented debug feature left enabled in production? [1] https://habr.com/en/articles/486856/ https://habr.com/en/articles/486856/

II2II 3y ago

I also get the impression that the definition has shifted, though I don't recall malicious intent from the vendor/author being a part of it. Classical backdoors include things like service accounts that were intended for the vendor, which were genuinely intended for service. Granted, those passwords were intended to be changed. (Also, that's not really appropriate for consumer grade gear though, since consumers have not received that level of support in decades and were not connected to networks when that level of service actually existed.) Either way though, I do seem to recall intention being part of the definition. Ah well. It's just a new meaning to get used to!

BobbyTables2 3y ago
They knowingly created a password less account because of their authentication system! If it isn’t a true backdoor, then it is utter stupidity and negligence! When it comes to security, why is EOL allowed by society? We don’t give 5 or 10 yr old cars a free pass to blow up or stop working without a manufacturer recall. Software is even easier to fix!
- II2II 3y ago
  The tricky part is determining how long software should be supported for, at least with respect to security updates. I'm sure that most people would agree that 5 years is insufficient. Twenty five years, many would say is too long. As for the car analogy, it is a weak comparison. First of all, the owner is expected to do some upkeep. A car is more likely to be deemed unroadworth from a lack of upkeep as it is from a design flaw or manufacturer defect. The other consideration is that the notion of secure software is a shifting target. In the case of cars, physics is a passive adversary. In the case of computer security, the adversary is active. Is software security to be judged by the security standards of when it is developed, or of when it is used? The former will catch cases like this, but will prove ineffective in the long term. The latter will bankrupt the industry.

aaron695 3y ago

[dead]

halJordan 3y ago

I think you went to sleep in some other universe and are waking up in the real world where backdoor has always meant "bypasses the front door."

cjbprime 3y ago

I'm surprised it wasn't "authentication bypass" too.