4 ms·

Looks to me that these are all discount vendors. I didn't even know Realtek made their own consumer devices. That they were all using the same or a variation o

Looks to me that these are all discount vendors. I didn't even know Realtek made their own consumer devices. That they were all using the same or a variation of the same firmware shows that the problem isn't maliciousness but carelessness. Someone writes a reference implementation that happens to have a hard-coded username as a debugging option. It may even have come with a note warning you that this needed to be changed before being put in the final product. But in the rush to a product to market as fast and as cheap as possible, they forego any modification to the firmware beyond branding and push it out bugs, backdoors, and all. I think it's a stretch to say these are "major" vendors. I've only seen TrendNet in the wild and usually because someone is complaining about their internet not working well and I say, "Yeah, that's not a good router. You should buy another one." You get what you pay for. Of course if a truly malicious actor wanted to place a backdoor into a router on purpose, I expect it'd be someplace other than the flash firmware that can be easily overwritten.

deleted 12y ago
[deleted]
- JTon 12y ago
  "Never attribute to malice that which is adequately explained by stupidity" - Hanlon's Razor [1] [1] https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
  - deleted 12y ago
    [deleted]
  - deleted 12y ago
    [deleted]
  - stcredzero 12y ago
    But what that really says, is that between malice and stupidity, the odds are most often for stupidity. Garden variety stupidity is much more common than clever malice. There is no reason to rule out clever malice entirely, however. If you're going to be Bayesian about it, use Hanlon's Razor as your prior, then update that. In other words, you should default to that, unless you have very good reasons.
  - gemexe 12y ago
    Fair enough - this is too obvious, a lot more effort would be applied to obfuscate a deliberate backdoor
  - pdkl95 12y ago
    As a corollary to Occam's Razor, this is always a good heuristic to remember. It is also important to keep in mind that heuristics can sometimes be misleading and should not be followed blindly. Hanlon's Razor, like Occam's Razor, is most useful in cases where we there isn't any other evidence that points to a specific answer. In the case of internet security, we do have a significant amount of evidence that several national spy agencies have been corrupting security of networking hardware and software. With projects like BULLRUN and the RSA/Dual_EC_DRBG scandal, we even know they went as far as pay businesses to do exactly this kind of weakening of their product's security features. This is especially true for this kind of low-end, discount product; a business with low profit margins is probably easier to bribe. All else is not equal, so it is reasonable assign a high probability to spy agency involvement. This isn't proof, of course, but neither is Hanlon's Razor.
    - acdha 12y ago
      > All else is not equal, so it is reasonable assign a high probability to spy agency involvement. This requires determined effort to ignore the level of sophistication on evidence in the same reports of nation-state level attacks which you cite. Everyone who's read them noted a consistently high level of attention paid to making sure that attacks were both targeted and concealed. Using “super” as both a username/password for a million devices is the kind of thing you'd expect from incompetence; with the NSA I'd expect something like what they actually did with Dual_EC_DRBG, where the device would show every sign of appearing to be secure but someone with knowledge of a particular constant could save significant effort when cracking the crypto. The last thing they want is for you to notice & patch the hole because some random spammer started exploiting it.
      - pdkl95 12y ago
        The NSA is not the only spy agency in the world.
        acdha 12y ago
        You might have missed that the examples cited in the post which I assigned were all NSA programs. That said, any serious program is unlikely to make a rookie mistake like this. The one remotely plausible explanation would be something like this being a way for a mole to spin a backdoor as an innocent mistake. Even that's stretching it a bit because this is so easy to find that it'd have a pretty high risk of exposure – if you're going to invest that kind of time, a more subtle bug is only a minor increase in difficulty.
- deleted 12y ago
  [deleted]
- whoopdedo 12y ago
  Like I said, if a truly malicious actor wanted to get a backdoor in I expect they'd be able to be a lot more subtle than a default password in an a web administration app. The cost of doing what you describe is too great for something that can easily be blocked by flashing Tomato... or just turn off remote web management.
rasz_pl 12y ago
>Realtek made their own consumer devices they dont ALL of those devices are based on the same RTL8196C Realtek SoC. This is one stupid/corrupted/incompetent Realtek employee/contractor putting a backdoor in SDK reference codebase (access under NDA, Realtek is famous for being hostile towards opensource just like Broadcom), and no one else bothering to even read sources before shipping devices.
- userbinator 12y ago
  Realtek is famous for being hostile towards opensource just like Broadcom On the other hand, you can easily find datasheets for many of their SoCs. Whether or not this is due to their lax security policies is a question to consider too... Realtek might not be agreeable to opensource, but I'd say they are still a far distance away from Broadcom. They are more of a "Gongkai"[1] sort of company. [1] http://www.bunniestudios.com/blog/?p=4297 http://www.bunniestudios.com/blog/?p=4297
  - TeMPOraL 12y ago
    Doesn't gongkai imply that someone simply "stole" their datasheets and circulated them? I.e. they are available, but not because the company itself wanted it that way.

deleted 12y ago

[deleted]

JTon 12y ago
"Never attribute to malice that which is adequately explained by stupidity" - Hanlon's Razor [1] [1] https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
- stcredzero 12y ago
  But what that really says, is that between malice and stupidity, the odds are most often for stupidity. Garden variety stupidity is much more common than clever malice. There is no reason to rule out clever malice entirely, however. If you're going to be Bayesian about it, use Hanlon's Razor as your prior, then update that. In other words, you should default to that, unless you have very good reasons.
- gemexe 12y ago
  Fair enough - this is too obvious, a lot more effort would be applied to obfuscate a deliberate backdoor
- pdkl95 12y ago
  As a corollary to Occam's Razor, this is always a good heuristic to remember. It is also important to keep in mind that heuristics can sometimes be misleading and should not be followed blindly. Hanlon's Razor, like Occam's Razor, is most useful in cases where we there isn't any other evidence that points to a specific answer. In the case of internet security, we do have a significant amount of evidence that several national spy agencies have been corrupting security of networking hardware and software. With projects like BULLRUN and the RSA/Dual_EC_DRBG scandal, we even know they went as far as pay businesses to do exactly this kind of weakening of their product's security features. This is especially true for this kind of low-end, discount product; a business with low profit margins is probably easier to bribe. All else is not equal, so it is reasonable assign a high probability to spy agency involvement. This isn't proof, of course, but neither is Hanlon's Razor.
  - acdha 12y ago
    > All else is not equal, so it is reasonable assign a high probability to spy agency involvement. This requires determined effort to ignore the level of sophistication on evidence in the same reports of nation-state level attacks which you cite. Everyone who's read them noted a consistently high level of attention paid to making sure that attacks were both targeted and concealed. Using “super” as both a username/password for a million devices is the kind of thing you'd expect from incompetence; with the NSA I'd expect something like what they actually did with Dual_EC_DRBG, where the device would show every sign of appearing to be secure but someone with knowledge of a particular constant could save significant effort when cracking the crypto. The last thing they want is for you to notice & patch the hole because some random spammer started exploiting it.
    - pdkl95 12y ago
      The NSA is not the only spy agency in the world.
      - acdha 12y ago
        You might have missed that the examples cited in the post which I assigned were all NSA programs. That said, any serious program is unlikely to make a rookie mistake like this. The one remotely plausible explanation would be something like this being a way for a mole to spin a backdoor as an innocent mistake. Even that's stretching it a bit because this is so easy to find that it'd have a pretty high risk of exposure – if you're going to invest that kind of time, a more subtle bug is only a minor increase in difficulty.
deleted 12y ago
[deleted]
whoopdedo 12y ago
Like I said, if a truly malicious actor wanted to get a backdoor in I expect they'd be able to be a lot more subtle than a default password in an a web administration app. The cost of doing what you describe is too great for something that can easily be blocked by flashing Tomato... or just turn off remote web management.

rasz_pl 12y ago

>Realtek made their own consumer devices they dont ALL of those devices are based on the same RTL8196C Realtek SoC. This is one stupid/corrupted/incompetent Realtek employee/contractor putting a backdoor in SDK reference codebase (access under NDA, Realtek is famous for being hostile towards opensource just like Broadcom), and no one else bothering to even read sources before shipping devices.

userbinator 12y ago
Realtek is famous for being hostile towards opensource just like Broadcom On the other hand, you can easily find datasheets for many of their SoCs. Whether or not this is due to their lax security policies is a question to consider too... Realtek might not be agreeable to opensource, but I'd say they are still a far distance away from Broadcom. They are more of a "Gongkai"[1] sort of company. [1] http://www.bunniestudios.com/blog/?p=4297 http://www.bunniestudios.com/blog/?p=4297
- TeMPOraL 12y ago
  Doesn't gongkai imply that someone simply "stole" their datasheets and circulated them? I.e. they are available, but not because the company itself wanted it that way.