4 ms·
"One teensy-weensy, but ever so crucial little tiny detail is that the backdoor only listens on the LAN, thus it is not exploitable from the WAN" mh, so not re
by kayoone 13y ago
"One teensy-weensy, but ever so crucial little tiny detail is that the backdoor only listens on the LAN, thus it is not exploitable from the WAN"
mh, so not really phoning home is it ? I thought this was pretty interesting until i read that..thats a pretty minimal security risk.
- austinz 13y agoRight. It looks a lot more like a badly-implemented feature for factory validation than a backdoor intended as an easily exploitable point of attack.
- yeukhon 13y agoBut a government is very likely to have access into a local network.
- tptacek 13y agoIt also means that any bit of unprivileged clientside malware an attacker can get onto your machine might be able to use the bug as a pivot, first to your whole network, then potentially back to a more privileged place on your machine.
- kayoone 13y agoTrue, however we are talking about a $30 consumer router. Most people using something like that have alot of other security flaws to worry about (but usually dont) and arent that interesting as an attack target to hackers anyway. Anyone with a "whole network" who remotely knows what hes doing wont be using a router like that one.
- sillysaurus2 13y agoAnyone with a "whole network" who remotely knows what hes doing wont be using a router like that Which router would he use?
- kayoone 13y agoProbably a enterprise grade router if its a bigger/corporate network or something halfway decent that supports OpenWRT
- homeomorphic 13y agoAre you sure you haven't visited webpages that tell your browser to send requests to your local router lately?
- justincormack 13y agoThis requires UDP packets, which a browser cant send.