Slashdot Mirror
Backdoor Account Found On Devices Used By White House, US Military (sec-consult.com)
An anonymous reader writes: A hidden backdoor account was discovered embedded in the firmware of devices deployed at the White House and in various US Military strategic centers, more precisely in AMX conference room equipment. The first account was named Black Widow, and after security researchers reported its presence to AMX, the company's employees simply renamed it to Batman thinking nobody will notice. AMX did remove the backdoor after three months. In its firmware's official release notes, AMX claimed that the two accounts were only used for debugging, just like Fortinet claimed that its FortiOS SSH backdoor was used only internally by a management protocol.
That way they can monitor EVERYTHING, everywhere, including subversives in the White House that might foil FBI, NSA & CIA operations.
Nothing to see here. This was a "front door," not a "back door."
"AMX claimed that the two accounts were only used for debugging,"
No, you only use them for debugging.
Even if we choose to trust that you're not using these accounts for nefarious purposes (which we shouldn't), that's not the point. The point is that they exist at all, and just because you created them doesn't mean someone else cannot use them.
.... but somehow I doubt that the anti-encryption crowd will get the point. Instead they'll point out how they, as government, are a different category.
Everyone knows that you should always be yourself. Unless you can be Batman, then be Batman.
*backdoor account access granted, Batman*
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
Let's hope that someone has been recording the output for posterity; to hear the real story of a presidency for the first time since Nixon would be great...
I thought the government *wants* back doors in everything.
I'm confused now... Why would they have them removed?
Nope, think of it like a Kwikset Smartkey deadbolt where you twist the faceplate, exposing a second lock cylinder.
This isn't a "debugging" tool.
I have personally seen "debug" access done properly:
1: The debug account is only accessible from a certain IP range.
2: The debug account is set to be inaccessible after a certain time.
3: The debug account uses a long passphrase.
4: The appliance website has an obvious note that the code is not for prime-time.
5: The debug account drops an entry into a log bucket.
6: When switching to a release build, the #ifdef macros ensure those accounts are never in the actual production software.
Basic common sense here. Any company can grok this, as it isn't any more complex than installing HID card readers on the office doors.
The NSA probably "persuaded" them to install it. The NSA spied on congress and nothing happened. Nobody was fired or went to jail. Spying on the whitehouse isn't that far a stretch.
Only the State obtains its revenue by coercion. - Murray Rothbard
Don't think of it as a back door. Think of it as a front door with really big locks.
I'd rather it had great knockers:
https://www.youtube.com/watch?v=XTw1lzxTAis
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
No, because the people advocating for backdoors still magically think only they can use the backdoors, and don't understand the reality that a backdoor is open to anybody who knows about it.
Don't ever expect those people to understand how their wishes diverge from reality.
Lost at C:>. Found at C.
We could call it, perhaps, "The Cone of Silence."
E Proelio Veritas.
I'm an AMX programmer (and Crestron as well). I can tell you that A LOT of the time the A/V LAN is a completely separate system that isn't physically connected to the house network. But that is no excuse for leaving a backdoor. Of the two major competitors in commercial control (AMX and Crestron), AMX is usually considered the most secure. They put a high focus on security so that they can land these government jobs. Just to give you some background, Crestron controllers currently run embedded Windows and previously ran VxWorks. AMX controllers previously ran VxWorks and now run Embedded Linux. The AMX controllers have many levels of security including a DoD mode which shuts down most of the services (FTP, web, telnet and leaves SSH). Their proprietary communication between the panel and the controller (carried over port 1319 and registered) is also encrypted in secure mode (this generally carries button presses, text updates, levels, etc.). Sounds to me like the engineers didn't want to give up the backdoor account for service issues once it was discovered and likely didn't realize what a big mistake it was by the time it got passed down. I've met most of the people at AMX and they are very good guys and gals. It's an engineering driven company (not marketing driven). The Harman acquisition may change that to some extent but they are true geeks who I am sure realize they messed up. It's a small company (aside from the Harman parent) in a niche market. They will learn from this and move on.
As a software engineer, you have debug builds and production builds, and as a general rule you don't ship builds to customers with the debug features enabled... unless you're beta testing. The White House probably wouldn't be my first choice for a beta test site!
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Reciprocal transparency, that's all I ask for!
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Nah nah nah nah nah nah nah nah,
nah nah nah nah nah nah nah nah!
That's why. They're basically flipping them the bird.
BAT-MAN!
That's 'cause Bill's a Back Door Man.
"So long and thanks for all the fish."