Slashdot Mirror
BHU's 'Tiger Will Power' Wi-Fi Router May Be The Most Insecure Router Ever Made (softpedia.com)
An anonymous reader writes from a report via Softpedia: A Wi-Fi router manufactured and sold only in China can easily run for the title of "most insecure router ever made." The BHU router, whose name translates to "Tiger Will Power," has a long list of security problems that include: four authentication bypass flaws (one of which is just hilarious); a built-in backdoor root account that gets created on every boot-up sequence; the fact that it opens the SSH port for external connections after every boot (somebody has to use that root backdoor account right?); a built-in proxy server that re-routes all traffic; an ad injection system that adds adverts to all the sites you visit; and a backup JS file embedded in the router firmware if the ad script fails to load from its server. For techies, there's a long technical write-up, which gets funnier and scarier at the same time as you read through it. "An attacker authenticating on the router can use a hardcoded session ID (SID) value of 700000000000000 to gain admin privileges," reports Softpedia. "If he misspells the SID and drops a zero, that's no problem. The BHU router will accept any value and still grant the user admin rights."
nt
They clearly went to a lot of trouble to make it easy to access this router.
I think we should give them credit for the "most user friendly router".
Really, think of all the times you have had to battle with passwords, IDs, etc. to get access to your router... what a drag.
Anybody can get into this thing.
I don't read your sig. Why are you reading mine?
It's China. Anything goes.
How about vxworks or qnx? The vxworks variants of the wrt54g were the best.. /sarcasm
Yeah, it's "sold only in China" until we find out some American company imported them by the boatload, slapped their own plastic case around them, and are selling them under another brand. It wouldn't be the first time.
This... is probably one of the worst product break-downs I've read in my entire short life as a software dev. Who coded this ****, a monkey?
The fact that it re-writes the root password and opens the SSH port means it's intentional 100%.
Probably backed by someone neophyte wanting to create a discount botnet. Not a very smart outfit mind you. But ypu can blame them for trying
Maybe they are not worried anymore about foreign hacks due to these unhackable satellites. So now only the government can access their router, and of course those inside the country... a thought.
Let's see, ad injection, changing stuff back to default after you've changed it to something else, etc., etc. .... sounds like Windows 10 is already on there.
Runs BusyBox
No, they decompiled Windows and copied some of its code.
This is just begging for someone to write patches for those vulnerabilities, and push them to the routers using said vulnerabilities.
Their safety comes from the fact that it's only sold in China, so they've already got a firewall.
Not bugs. It is all by design [barring an occasional authentic bug]
coming from the shitty outleft softpedia here? I think I will stop dropping by...
Tyst! När man talar om trollen så står de i farstun!
Il n'y a pas de Planet B.
A little router
Such wow, closed never was
So much interest
Some PABX stuff is like that - imagine all of the above only with telnet as well.
Point Of Sale stuff sometimes has hardcoded passwords as well.
Try Hacker News at https://news.ycombinator.com/ for better submissions - and also for much better discussions. I don't want to advertise it too much though, let the "funny" commenters and over-emotional downvoters who can't say anything technical about the subject(s) being discussed remain on all the other websites... :)
But if a US company had made it, it would be called "trusted".
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Sweartogod, it came in the box! I was wondering why a fortune cookie was in there! It turns out that the fortune is part of the package! I remember, I cracked it open, but the fortune was printed in Chinese! I handed it my Chinese co-worker, and he laughed and said, Congratulations, you have just installed the most insecure network in the mainland!
We first thought it meant mainland China, the way they referred to it in their papers, y'know, but now that THIS story is out...now, that I think about it, mainland USA isn't farfetched...
... does it run DD-WRT (or variants)?
That's really all I ever want or expect from an off-the-shelf router. I assume that vendor-provided firmware is crap, untrustworthy, or inflexible.
Log in or piss off.
Does it also generate easily guessable passwords based on its MAC address and also include a free-for-all non-throttling WPS system that cannot be turned off, or worse, pretends that it has been disabled? If the answer is no, then it's not the most hackable router, at least not from a WLAN standpoint.
It is almost like no one knows what Group Policy Editor is.
Nobody will be cruising your house with a Pringles can unless they are in fact US government spies.
If they have to use nearby spy gear to hack into your router, you are doing it right. If you are doing it right you will not buy some piece of shit bhus "tiger will power" router anyway.
This story is just some "what do we do today FBI" story about bullshit.
Sell them to Iraq.
Why would US government spies use a pringle can instead of buying a Yagi? Did someone cut their budget?
https://www.google.com/search?...
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?