Slashdot Mirror
China Electronics Firm To Recall Some US Products After Hacking Attack (reuters.com)
An anonymous reader writes:Chinese firm Hangzhou Xiongmai said it will recall some of its products sold in the United States after it was identified by security researchers as having made parts for devices that were targeted in a major hacking attack on Friday. Hackers unleashed a complex attack on the Internet through common devices like webcams and digital recorders, and cut access to some of the world's best known websites in a stunning breach of global internet stability. The electronics components firm, which makes parts for surveillance cameras, said in a statement on its official microblog that it would recall some of its earlier products sold in the United States, strengthen password functions and send users a patch for products made before April last year. It said the biggest issue was users not changing default passwords, adding that, overall, its products were well protected from cyber security breaches. It said reports that its products made up the bulk of those targeted in the attack were false. "Security issues are a problem facing all mankind. Since industry giants have experienced them, Xiongmai is not afraid to experience them once, too," the company statement said.
How often does any company do a recall for security issues? They seem to be taking the issue at least somewhat seriously.
Looks like the made the classic mistake of assuming users would be sane enough to change the default password.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
That particular board or whatever is probably in stuff they don't even know about (endless re-branding and all that).
This reminds me of Chinese Foreign Minister Wang Yi's 2015 comment (in the wake of an obvious wave of government- and business-oriented hacking out of a well known government facility in China) that they couldn't possibly be responsible for such things, since as just a developing nation, they didn't have the sophistication.
... laziness.
Obviously the laziness of users around the world who don't change default passwords is a different problem, but shipping stuff configured and documented in a way that makes not securing it the default mode in the hands of users is just
Don't disappoint your bird dog. Go to the range.
Really? So you're less sophisticated than a script kiddie? Maybe tech-journalism isn't for you; tabloids are better suited for sensationalist bullshit.
...I only use genuine Sorny products.
It shouldn't even be an option to misconfigure your product in that fashion. Botnets are nothing new. Assume your customer will go with the defaults, and make those defaults a secure default. Give them an option for doing a factory reset, because yes, many folks will forget the password even though you reminded them to record it. Don't let them make the password "password" or "password123." Because they will.
These vulnerable IoT devices are here to stay, so we need an ISP-level solution to this.
Kudos. Really. I'm impressed.
This is far more than I expected: again, thank you.
Looks like the made the classic mistake of assuming users would be sane enough to change the default password.
Frankly, if I buy a lightbulb or a smoke detector, I really don't want to spend twenty minutes trying to figure out the protocol to reset passwords. "Insecure by default" means insecure.
Anything made by them is either crap or worthless after one use.
Only a solution comes to my mind for this to not happen again: create a simple worm that infects and disables ("disables" as in "Kill") all the unprotected devices.
Yes, I would be pissed off if my devices would suddenly die, but if it has been that easy to infect all those appliances, it should be the manufacturer the responsible for repairing them.
Next time they'll implement at least basic security.
Given the disastrous ramifications of not changing the default passwords, IoT devices should be little more than bricks until the default password is changed to something better.
When they go to war with us and lo and behold they find that their people have just as many, if not far more, of these shit for quality IoT devices on their domestic internet. It's going to be the Internet equivalent of two countries nuking each other off the face of the planet as China-controlled bots in the US attack us and NSA-controlled botnets in China attack them.
The Chinese government needs to wake up to the fact that these devices are just as much of a threat to them as they are to us and work with us to make the whole ecosystem more secure.
Hmmm...I wonder how many, and what the recall process will be for the customer.
I suspect "not many" and "horrible" respectively...
if you think you have computer security but you buy your hardware from the Communist Chinese army...
It's probably just a recall to install updated spyware
Americans/Brits/Aussies/Japanese etc who buy from "companies" like Lenovo are just stupidly giving the Chinese government backdoor access into everything. There's no such thing as a non-government "business" in communist China - it's all run by The Party, or people well-connected to The Party, or tolerated by The party as long as it does anything (like injecting malware, building-in backdoors, etc) tells it to do. Unlike a western democracy, in China The Party and the people's army are one, inseparable....one political party running the nation, it's economy, its military, its "businesses", its people's lives...
by this Chinese company. Meanwhile, Xerox, Cisco, etc. are just pumping out hardware with NSA backdoors in it. It's funny how much bullshit and stupid accusations are thrown towards China, while they're doing more right than most of the countries in the west.
Xiongmai is not afraid
Courageous Xiongmai
(This is not a Haiku)
...Six software engineers were quietly executed at Phuc Tup Prison for making government-ordered back door access to the devices so blatantly obvious even barbaric Western script kiddies were on them faster than a priest on a one-legged choir boy.
I've calculated my velocity with such exquisite precision that I have no idea where I am.