Slashdot Mirror
BHU's 'Tiger Will Power' Wi-Fi Router May Be The Most Insecure Router Ever Made (softpedia.com)
An anonymous reader writes from a report via Softpedia: A Wi-Fi router manufactured and sold only in China can easily run for the title of "most insecure router ever made." The BHU router, whose name translates to "Tiger Will Power," has a long list of security problems that include: four authentication bypass flaws (one of which is just hilarious); a built-in backdoor root account that gets created on every boot-up sequence; the fact that it opens the SSH port for external connections after every boot (somebody has to use that root backdoor account right?); a built-in proxy server that re-routes all traffic; an ad injection system that adds adverts to all the sites you visit; and a backup JS file embedded in the router firmware if the ad script fails to load from its server. For techies, there's a long technical write-up, which gets funnier and scarier at the same time as you read through it. "An attacker authenticating on the router can use a hardcoded session ID (SID) value of 700000000000000 to gain admin privileges," reports Softpedia. "If he misspells the SID and drops a zero, that's no problem. The BHU router will accept any value and still grant the user admin rights."
They clearly went to a lot of trouble to make it easy to access this router.
I think we should give them credit for the "most user friendly router".
Really, think of all the times you have had to battle with passwords, IDs, etc. to get access to your router... what a drag.
Anybody can get into this thing.
I don't read your sig. Why are you reading mine?
It's China. Anything goes.
Yeah, it's "sold only in China" until we find out some American company imported them by the boatload, slapped their own plastic case around them, and are selling them under another brand. It wouldn't be the first time.
This... is probably one of the worst product break-downs I've read in my entire short life as a software dev. Who coded this ****, a monkey?
The fact that it re-writes the root password and opens the SSH port means it's intentional 100%.
Let's see, ad injection, changing stuff back to default after you've changed it to something else, etc., etc. .... sounds like Windows 10 is already on there.
Runs BusyBox
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
Their safety comes from the fact that it's only sold in China, so they've already got a firewall.
coming from the shitty outleft softpedia here? I think I will stop dropping by...
Tyst! När man talar om trollen så står de i farstun!
Il n'y a pas de Planet B.
A little router
Such wow, closed never was
So much interest
Some PABX stuff is like that - imagine all of the above only with telnet as well.
Point Of Sale stuff sometimes has hardcoded passwords as well.
Try Hacker News at https://news.ycombinator.com/ for better submissions - and also for much better discussions. I don't want to advertise it too much though, let the "funny" commenters and over-emotional downvoters who can't say anything technical about the subject(s) being discussed remain on all the other websites... :)
But if a US company had made it, it would be called "trusted".
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
No matter where you did that you'd be fucked.
In China, you'd get jailed for dissident behaviour.
In the US, you'd get fined, to the point where you wish it was jail time because then you could at least get food and shelter, for breaking the DMCA.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Why waste resources? /etc/init.d/iptables stop
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Sorry, but seriously I stopped following and caring about the US copyright system altogether. It's not possible to not break it anymore, so why bother trying?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
... does it run DD-WRT (or variants)?
That's really all I ever want or expect from an off-the-shelf router. I assume that vendor-provided firmware is crap, untrustworthy, or inflexible.
Log in or piss off.
Should probably start paying attention to Congress now, because in 2019 things will start entering the public domain again. I'm sure that starting next year, someone's going to try to push another Mickey Mouse Protection Act through.
Gamingmuseum.com: Give your 3D accelerator a rest.
I can't avoid it, I can't fight it, all I can do is simply treat them and their laws with the same attention they treat me: None at all.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Why would US government spies use a pringle can instead of buying a Yagi? Did someone cut their budget?
https://www.google.com/search?...
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?