8 ms·

From China, With Love

191 points by conductor 13y ago

taralx 13y ago
How many other embedded systems on our networks have these backdoors? As the number of important devices (Nest, I'm looking at you) on my home network increases, so does my risk profile.
- eob 13y ago
  I used to do R&D for the US defense industry. Three years back I was catching up with a friend from that industry and asked what they're up to these days. Her answer? Hacking into connected appliances (furnace, video games, espresso machines, etc) with the goal of turning them into listening devices, making them explode or catch fire, or otherwise malfunction. If you can dream up a sick way to mess with people, odds are there is a government somewhere funding research into it.
  - Cthulhu_ 13y ago
    You call it a sick way to mess with people, governments will refer to it as cyberwarfare. I'd say that the US / Israel's attacks on the Iranian uranium enrichment facilities (Stuxnet) was just a tame and reserved trial, and that most modern countries have plans in place that will unleash a devastating cyberattack on loads of internet-connected devices. I'd say routers are particularly vulnerable, if only because they are smart (Linux) machines, but in most cases users will never check them for anything odd going on. As this article shows, it takes but a simple command for them to execute stuff, and given how Linux is a general purpose OS, they could install and perform any kind of task - like install backdoors and whatnot on the PC's behind the routers, which can then in turn be disabled or used in a massive botnet to perform a DDoS or other attacks on other systems. Just think about the implications of there being a backdoor in every internet-connected computer system, or the consequences of all-out cyberwar.
    - dsrguru 13y ago
      A senior VP of a prominent credit card processing company in the US told me that he fields an average of 200,000 attacks originating from Chinese and Iranian IP addresses every day. Governments having backdoors everywhere would be terrifying.
- shawnreilly 13y ago
  You are completely correct. And I don't want to add fuel to the fire, but it gets even worse than that. Aside from backdoors and the security of these appliances/devices from a system perspective, what about network connectivity and the transport layer? Only recently, within the past few years [1], has SSL/443 become a requirement for some of the bigger organizations out there. Seems to me that security is often an afterthought. Smart Appliances/Devices run the same risks, and it stands to question; are they connecting securely? And if not, how long will it take them to secure their transport? Because even if that brand new IP-enabled Door Lock is secure from a system perspective, it wouldn't matter if someone can subvert the transport layer, take control, and open the Lock. One of my Projects attempts to solve this problem for the new generation of IP-enabled Appliances/Devices. I plan to make the process painless and easy. Everyone wins, both customer/consumer and developers/providers. Does anyone want to build it with me? [1] http://www.washingtonpost.com/blogs/the-switch/wp/2013/10/14/yahoo-to-make-ssl-encryption-the-default-for-webmail-users-finally/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/10/14...
eliteraspberrie 13y ago
Perhaps it's time for an open-source router. Does one exist? I would support a crowd-funded ADSL router.
- conductor 13y ago
  There are open source (Linux based) firmwares such as OpenWRT [0]. [0] - https://openwrt.org/ https://openwrt.org/
  - rwg 13y ago
    The problem isn't a lack of software to put on hardware, it's a lack of hardware that doesn't go out of its way to thwart attempts to install different software, either intentionally or as a side-effect of being optimized for cost. As an example of the latter, I have a Monoprice-rebadged Tenda W301A ceiling-/wall-mount AP on my desk. It only has 2 MB of flash and 16 MB of RAM. It has a TTL serial port, but the lines are broken out to surface pads that aren't even grouped together on the PCB. (They're not labelled on the silkscreen, either.) The version of u-boot it ships with is stripped down to nothing, probably because of the limited flash space available. For ≤$5 more on the BOM, these problems could be fixed, and the device would be considerably more useful.
    - conductor 13y ago
      There are devices with more RAM (32MB or 64MB) and with USB port(s) where you can mount a flash drive / external disk and install anything (like Transmission, or even Samba) on it and use as a poor man's NAS. For example the TP-Link MR-3020 is pretty much hackable [0]. [0] - http://wiki.openwrt.org/toh/tp-link/tl-mr3020 http://wiki.openwrt.org/toh/tp-link/tl-mr3020
    - justincormack 13y ago
      There are manufacturers who have product lines designed to be reflashed eg Netgear http://www.myopenrouter.com/ http://www.myopenrouter.com/
- jbooth 13y ago
pasbesoin 13y ago
As a perhaps unnecessary (for HN) reminder: This is a primary reason that "anti-circumvention" legislation, that "outlaws" e.g. decompiling and/or reverse engineering (1) machine code in proprietary devices (in this case, for research purposes), needs to be permanently put down. Without examination, existing circumstances repeatedly demonstrate that we more than a bit likely to be subjected to hidden weaknesses and exploitations we are uninformed about and have not agreed to. ---- (1) decompilation/reversing, as in the referenced, recent D-Link case, or perhaps even simple extraction of a compressed fileset
- tptacek 13y ago
  Which is why the DMCA exempts most security testing, and, in particular, the exact kind of security testing performed in this analysis.
  - pasbesoin 13y ago
    In one sense, I'll defer to your far greater experience. In another, though, I'm increasingly of the impression that the effect, or lack thereof, of the DMCA upon one is more about the lawyers and money for lawyers that one has, than about "rights". I also seem to recall ongoing efforts to (further) criminalize various forms of infringement (as opposed to leaving them matters of civil law), taking accusations to a whole new level of hurt.
- throwawaykf 13y ago
  The DMCA Anti-circumvention clause explicitly makes an exception for "security testing" and "encryption research", amongst others. Search for those terms on this page: http://www.law.cornell.edu/uscode/text/17/1201 http://www.law.cornell.edu/uscode/text/17/1201 I am no law scholar, but I get the impression that, in general, reverse engineering and research are exempt from most forms of IP protection (which is what the DMCA is).
  - KimberlyJClark 13y ago
    my classmate's mother-in-law makes $67 an hour on the computer. She has been fired for 7 months but last month her pay check was $18297 just working on the computer for a few hours. this page ========================== http://WWW.Works23.Com http://WWW.Works23.Com
adjwilli 13y ago
This was interesting but the title "From China, With Love" seems descriptively weak and unnecessarily confrontational, as if somehow the Chinese government were to blame for one router manufacturers backdoor.
- tptacek 13y ago
  * Chinese intervention and even ownership of its local industries is a well-known phenomenon. You can't on the one hand believe that NSA --- err, Clyde Frog --- is strongarming US Internet companies into complying with court orders while at the same time seriously suggesting that Chinese manufacturers are independent of the Chinese state. * How much do we know about Shenzhen Tenda? All I could find in 5 minutes or so of research is that it's the result of the efforts of D.P. Quan to provide networking and enrich the lives of all people through, IIRC, excellence. * China has a very well-established, well-attributed track record of attacking the tech infrastructure of the rest of the world, and does so through proxy organizations. * A very blatant backdoor with minimal tech support value is something that is more valuable to a state than to a random tech company.
  - est 13y ago
    US gadgets have backdoor - blame the bad programmers Chinese gadgets have backdoor - evil Communist country making a grand scheme.
    - tptacek 13y ago
      Minus the "evil" and "communist" (that doesn't really describe China anymore), that sounds about right.
    - mintplant 13y ago
      Ever since the Snowden situation began every security issue related to the US has invited comments suggesting the NSA might be involved. I don't see your point.
  - jotm 13y ago
    But the NSA (with the FBI) IS strongarming companies to comply with court orders :-)
w1ntermute 13y ago
Off-topic: does anyone know what software was used to make graphics like http://www.devttys0.com/wp-content/uploads/2013/10/recvfrom.png http://www.devttys0.com/wp-content/uploads/2013/10/recvfrom.... ?
- paraxisi 13y ago
  It's a feature in IDA.
  - tptacek 13y ago
    You can get even better graphics out of Hopper.app, which is a great little program. Hopper will even do a decent first-pass conversion from assembly back to C.
    - conductor 13y ago
      Yet IDA Pro is much more mature and feature-rich, and it has become an industry standard. I wish there was an open-source alternative.
      - tptacek 13y ago
        We use both, but when I can get away with using Hopper, I try to, because the UI is nicer, the program feels faster, and the Python extension interface is built right in. Disassemblers are a good target for open source development. They're commercially valuable only for a very small subset of users, and the market leader is terribly mispriced relative to the value it provides, which drags the whole commercial market for them down.
        X-Istence 13y ago
        Not only are they terribly mis-priced, it is very difficult for people that are not in the security industry but have an interest in reverse engineering to get access to the software because the author won't sell to them.
kayoone 13y ago
"One teensy-weensy, but ever so crucial little tiny detail is that the backdoor only listens on the LAN, thus it is not exploitable from the WAN" mh, so not really phoning home is it ? I thought this was pretty interesting until i read that..thats a pretty minimal security risk.
- austinz 13y ago
  Right. It looks a lot more like a badly-implemented feature for factory validation than a backdoor intended as an easily exploitable point of attack.
  - yeukhon 13y ago
    But a government is very likely to have access into a local network.
- tptacek 13y ago
  It also means that any bit of unprivileged clientside malware an attacker can get onto your machine might be able to use the bug as a pivot, first to your whole network, then potentially back to a more privileged place on your machine.
  - kayoone 13y ago
    True, however we are talking about a $30 consumer router. Most people using something like that have alot of other security flaws to worry about (but usually dont) and arent that interesting as an attack target to hackers anyway. Anyone with a "whole network" who remotely knows what hes doing wont be using a router like that one.
    - sillysaurus2 13y ago
      Anyone with a "whole network" who remotely knows what hes doing wont be using a router like that Which router would he use?
deleted 13y ago
[deleted]
zenocon 13y ago
This is why I've replaced all my home network gear's firmware with http://www.dd-wrt.com/site/index http://www.dd-wrt.com/site/index
- mentat 13y ago
  I've found openwrt to be quite superior, especially config and packet management.
  - tuananh 13y ago
    Agree. Packet management is mainly the reason I did the switch.
  - swatkat 13y ago
    Also, if you're looking for open-source firmware for 3G/4G USB-enabled routers, then check out ROOter. ROOter is based on OpenWRT, and supports most of the popular routers and 3G/4G USB dongles. http://ofmodemsandmen.com/supported.html http://ofmodemsandmen.com/supported.html
olalonde 13y ago
Strangely, the whole GoAhead code including the backdoor seems to be on Github: https://github.com/socoola/yhrouter/blob/master/user/goahead/src/goahead.c#L969 https://github.com/socoola/yhrouter/blob/master/user/goahead...
- justincormack 13y ago
  I filed an issue, see what happens. Unclear if this code is a legit copy...
kuchaguangjie 13y ago
In china, I think TP-link is much better than D-link and Tenda, Tenda is just rubbish, it's not easy to use, TP-link is much easier to use, but I am not sure does it have backdoor.
- est 13y ago
  search for backdoor keyword userRpmNatDebugRpm26525557
happywolf 13y ago
Hey, I guess PRISM belongs to China, too!

191 points by conductor 13y ago

How many other embedded systems on our networks have these backdoors? As the number of important devices (Nest, I'm looking at you) on my home network increases, so does my risk profile.

eob 13y ago
I used to do R&D for the US defense industry. Three years back I was catching up with a friend from that industry and asked what they're up to these days. Her answer? Hacking into connected appliances (furnace, video games, espresso machines, etc) with the goal of turning them into listening devices, making them explode or catch fire, or otherwise malfunction. If you can dream up a sick way to mess with people, odds are there is a government somewhere funding research into it.
- Cthulhu_ 13y ago
  You call it a sick way to mess with people, governments will refer to it as cyberwarfare. I'd say that the US / Israel's attacks on the Iranian uranium enrichment facilities (Stuxnet) was just a tame and reserved trial, and that most modern countries have plans in place that will unleash a devastating cyberattack on loads of internet-connected devices. I'd say routers are particularly vulnerable, if only because they are smart (Linux) machines, but in most cases users will never check them for anything odd going on. As this article shows, it takes but a simple command for them to execute stuff, and given how Linux is a general purpose OS, they could install and perform any kind of task - like install backdoors and whatnot on the PC's behind the routers, which can then in turn be disabled or used in a massive botnet to perform a DDoS or other attacks on other systems. Just think about the implications of there being a backdoor in every internet-connected computer system, or the consequences of all-out cyberwar.
  - dsrguru 13y ago
    A senior VP of a prominent credit card processing company in the US told me that he fields an average of 200,000 attacks originating from Chinese and Iranian IP addresses every day. Governments having backdoors everywhere would be terrifying.
shawnreilly 13y ago
You are completely correct. And I don't want to add fuel to the fire, but it gets even worse than that. Aside from backdoors and the security of these appliances/devices from a system perspective, what about network connectivity and the transport layer? Only recently, within the past few years [1], has SSL/443 become a requirement for some of the bigger organizations out there. Seems to me that security is often an afterthought. Smart Appliances/Devices run the same risks, and it stands to question; are they connecting securely? And if not, how long will it take them to secure their transport? Because even if that brand new IP-enabled Door Lock is secure from a system perspective, it wouldn't matter if someone can subvert the transport layer, take control, and open the Lock. One of my Projects attempts to solve this problem for the new generation of IP-enabled Appliances/Devices. I plan to make the process painless and easy. Everyone wins, both customer/consumer and developers/providers. Does anyone want to build it with me? [1] http://www.washingtonpost.com/blogs/the-switch/wp/2013/10/14/yahoo-to-make-ssl-encryption-the-default-for-webmail-users-finally/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/10/14...

eliteraspberrie 13y ago

Perhaps it's time for an open-source router. Does one exist? I would support a crowd-funded ADSL router.

conductor 13y ago
There are open source (Linux based) firmwares such as OpenWRT [0]. [0] - https://openwrt.org/ https://openwrt.org/
- rwg 13y ago
  The problem isn't a lack of software to put on hardware, it's a lack of hardware that doesn't go out of its way to thwart attempts to install different software, either intentionally or as a side-effect of being optimized for cost. As an example of the latter, I have a Monoprice-rebadged Tenda W301A ceiling-/wall-mount AP on my desk. It only has 2 MB of flash and 16 MB of RAM. It has a TTL serial port, but the lines are broken out to surface pads that aren't even grouped together on the PCB. (They're not labelled on the silkscreen, either.) The version of u-boot it ships with is stripped down to nothing, probably because of the limited flash space available. For ≤$5 more on the BOM, these problems could be fixed, and the device would be considerably more useful.
  - conductor 13y ago
    There are devices with more RAM (32MB or 64MB) and with USB port(s) where you can mount a flash drive / external disk and install anything (like Transmission, or even Samba) on it and use as a poor man's NAS. For example the TP-Link MR-3020 is pretty much hackable [0]. [0] - http://wiki.openwrt.org/toh/tp-link/tl-mr3020 http://wiki.openwrt.org/toh/tp-link/tl-mr3020
  - justincormack 13y ago
    There are manufacturers who have product lines designed to be reflashed eg Netgear http://www.myopenrouter.com/ http://www.myopenrouter.com/
jbooth 13y ago

pasbesoin 13y ago

As a perhaps unnecessary (for HN) reminder: This is a primary reason that "anti-circumvention" legislation, that "outlaws" e.g. decompiling and/or reverse engineering (1) machine code in proprietary devices (in this case, for research purposes), needs to be permanently put down. Without examination, existing circumstances repeatedly demonstrate that we more than a bit likely to be subjected to hidden weaknesses and exploitations we are uninformed about and have not agreed to. ---- (1) decompilation/reversing, as in the referenced, recent D-Link case, or perhaps even simple extraction of a compressed fileset

tptacek 13y ago
Which is why the DMCA exempts most security testing, and, in particular, the exact kind of security testing performed in this analysis.
- pasbesoin 13y ago
  In one sense, I'll defer to your far greater experience. In another, though, I'm increasingly of the impression that the effect, or lack thereof, of the DMCA upon one is more about the lawyers and money for lawyers that one has, than about "rights". I also seem to recall ongoing efforts to (further) criminalize various forms of infringement (as opposed to leaving them matters of civil law), taking accusations to a whole new level of hurt.
throwawaykf 13y ago
The DMCA Anti-circumvention clause explicitly makes an exception for "security testing" and "encryption research", amongst others. Search for those terms on this page: http://www.law.cornell.edu/uscode/text/17/1201 http://www.law.cornell.edu/uscode/text/17/1201 I am no law scholar, but I get the impression that, in general, reverse engineering and research are exempt from most forms of IP protection (which is what the DMCA is).
- KimberlyJClark 13y ago
  my classmate's mother-in-law makes $67 an hour on the computer. She has been fired for 7 months but last month her pay check was $18297 just working on the computer for a few hours. this page ========================== http://WWW.Works23.Com http://WWW.Works23.Com

adjwilli 13y ago

This was interesting but the title "From China, With Love" seems descriptively weak and unnecessarily confrontational, as if somehow the Chinese government were to blame for one router manufacturers backdoor.

tptacek 13y ago
* Chinese intervention and even ownership of its local industries is a well-known phenomenon. You can't on the one hand believe that NSA --- err, Clyde Frog --- is strongarming US Internet companies into complying with court orders while at the same time seriously suggesting that Chinese manufacturers are independent of the Chinese state. * How much do we know about Shenzhen Tenda? All I could find in 5 minutes or so of research is that it's the result of the efforts of D.P. Quan to provide networking and enrich the lives of all people through, IIRC, excellence. * China has a very well-established, well-attributed track record of attacking the tech infrastructure of the rest of the world, and does so through proxy organizations. * A very blatant backdoor with minimal tech support value is something that is more valuable to a state than to a random tech company.
- est 13y ago
  US gadgets have backdoor - blame the bad programmers Chinese gadgets have backdoor - evil Communist country making a grand scheme.
  - tptacek 13y ago
    Minus the "evil" and "communist" (that doesn't really describe China anymore), that sounds about right.
  - mintplant 13y ago
    Ever since the Snowden situation began every security issue related to the US has invited comments suggesting the NSA might be involved. I don't see your point.
- jotm 13y ago
  But the NSA (with the FBI) IS strongarming companies to comply with court orders :-)

w1ntermute 13y ago

Off-topic: does anyone know what software was used to make graphics like http://www.devttys0.com/wp-content/uploads/2013/10/recvfrom.png http://www.devttys0.com/wp-content/uploads/2013/10/recvfrom.... ?

paraxisi 13y ago
It's a feature in IDA.
- tptacek 13y ago
  You can get even better graphics out of Hopper.app, which is a great little program. Hopper will even do a decent first-pass conversion from assembly back to C.
  - conductor 13y ago
    Yet IDA Pro is much more mature and feature-rich, and it has become an industry standard. I wish there was an open-source alternative.
    - tptacek 13y ago
      We use both, but when I can get away with using Hopper, I try to, because the UI is nicer, the program feels faster, and the Python extension interface is built right in. Disassemblers are a good target for open source development. They're commercially valuable only for a very small subset of users, and the market leader is terribly mispriced relative to the value it provides, which drags the whole commercial market for them down.
      - X-Istence 13y ago
        Not only are they terribly mis-priced, it is very difficult for people that are not in the security industry but have an interest in reverse engineering to get access to the software because the author won't sell to them.

kayoone 13y ago

"One teensy-weensy, but ever so crucial little tiny detail is that the backdoor only listens on the LAN, thus it is not exploitable from the WAN" mh, so not really phoning home is it ? I thought this was pretty interesting until i read that..thats a pretty minimal security risk.

austinz 13y ago
Right. It looks a lot more like a badly-implemented feature for factory validation than a backdoor intended as an easily exploitable point of attack.
- yeukhon 13y ago
  But a government is very likely to have access into a local network.
tptacek 13y ago
It also means that any bit of unprivileged clientside malware an attacker can get onto your machine might be able to use the bug as a pivot, first to your whole network, then potentially back to a more privileged place on your machine.
- kayoone 13y ago
  True, however we are talking about a $30 consumer router. Most people using something like that have alot of other security flaws to worry about (but usually dont) and arent that interesting as an attack target to hackers anyway. Anyone with a "whole network" who remotely knows what hes doing wont be using a router like that one.
  - sillysaurus2 13y ago
    Anyone with a "whole network" who remotely knows what hes doing wont be using a router like that Which router would he use?

deleted 13y ago

[deleted]

zenocon 13y ago

This is why I've replaced all my home network gear's firmware with http://www.dd-wrt.com/site/index http://www.dd-wrt.com/site/index

mentat 13y ago
I've found openwrt to be quite superior, especially config and packet management.
- tuananh 13y ago
  Agree. Packet management is mainly the reason I did the switch.
- swatkat 13y ago
  Also, if you're looking for open-source firmware for 3G/4G USB-enabled routers, then check out ROOter. ROOter is based on OpenWRT, and supports most of the popular routers and 3G/4G USB dongles. http://ofmodemsandmen.com/supported.html http://ofmodemsandmen.com/supported.html

olalonde 13y ago

Strangely, the whole GoAhead code including the backdoor seems to be on Github: https://github.com/socoola/yhrouter/blob/master/user/goahead/src/goahead.c#L969 https://github.com/socoola/yhrouter/blob/master/user/goahead...

justincormack 13y ago
I filed an issue, see what happens. Unclear if this code is a legit copy...

kuchaguangjie 13y ago

In china, I think TP-link is much better than D-link and Tenda, Tenda is just rubbish, it's not easy to use, TP-link is much easier to use, but I am not sure does it have backdoor.

est 13y ago
search for backdoor keyword userRpmNatDebugRpm26525557

happywolf 13y ago

Hey, I guess PRISM belongs to China, too!