Slashdot Mirror
Hidden Backdoor Discovered In Chinese IoT Devices (techradar.com)
"A backdoor has been found in devices made by a Chinese tech firm specializing in VoIP products," reports TechRadar. An anonymous reader quotes their article:
Security outfit Trustwave made the discovery of a hidden backdoor in DblTek's devices which was apparently put there to allow the manufacturer access to said hardware -- but of course, it's also open to being exploited by other malicious parties. The backdoor is in the Telnet admin interface of DblTek-branded devices, and potentially allows an attacker to remotely open a shell with root privileges on the target device.
What's perhaps even more worrying is that when Trustwave contacted DblTek regarding the backdoor last autumn -- multiple times -- patched firmware was eventually released at the end of December. However, rather than removing the flaw, the vendor simply made it more difficult to access and exploit. And further correspondence with the Chinese company has apparently fallen on deaf ears.
The firmware with the hole "is present on almost every GSM-to-VoIP device which DblTek makes," and Trustwave "found hundreds of these devices on the net, and many other brands which use the same firmware, so are equally open to exploit."
What's perhaps even more worrying is that when Trustwave contacted DblTek regarding the backdoor last autumn -- multiple times -- patched firmware was eventually released at the end of December. However, rather than removing the flaw, the vendor simply made it more difficult to access and exploit. And further correspondence with the Chinese company has apparently fallen on deaf ears.
The firmware with the hole "is present on almost every GSM-to-VoIP device which DblTek makes," and Trustwave "found hundreds of these devices on the net, and many other brands which use the same firmware, so are equally open to exploit."
There is a price for outsourcing all of your manufacturing needs to companies in countries with authoritarian governments. Having state sponsored Spyware in your devices is one such cost.
I've just shat myself with surprise.
"Oh my God. This is terrible. This is the end of my Presidency. I'm fucked."; ~ Donald J. Trump
Shocked to find there's gambling in this establishment.
This is clearly another instance where lack of government oversight leads to dangerous, illegal things in the wild. If my thingamajig gets hacked I'm suing China!
This is made worse by the fact that default router configurations leave telnet open.
Could be worse. Close that port and it's a non-issue. Should have closed it with the last batch.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
China can't hurt the average citizen. Where as every single domestic and foreign made IOT device that comes to America have multiple backdoors, as a feature. If you ever attended a protest, or dumped a cop, or for no reason at all. You could be subject to Zersetzung style harassment.
I'd get a DVR but they all require an account be created to use them when there is no technical reason for it.
I had to creat an account to use my Roku when there is no technical reason to do so - I used a throwaway email to fulfill their silly ass marketing requirement.
My point is tag these IoT and every other electronic doohickey is gonna collect information because that's how these businesses work. Consumer data is gold. For advertisers and government.
And this is why I don't have any IoT devices. X-10 still works for me.
A couple of months ago I purchased a temperature measuring device that plugs into a USB port. The device was made in China by a Chinese company and shipped directly from China. I am really reluctant to plug it into any USB port nowadays, as I do not know what will be activated in the device once it gets power. Coming from China, I doubt if it would be anything good...
You mean to tell me you're still using freakin TELNET to communicate over the public internet? In this day and age? Hell, the mere EXISTENCE of a working Telnet interface is itself a back door as far as I can see.
I'm so worn down by the number of news items about (yet another) shitty Chinese device having some a backdoor/malware/shitty or non existent security that I just assume that every device made in China has these flaws, we just haven't yet heard of them in the wild.
What would be more shocking to me is a news story about a Chinese device that has been security audited and found to be secure. When that day comes I will be truly suprised.
Then your IOT devices would have authorized_keys with names like repairman@factory.cn and spy@gov.cn
davecb@spamcop.net
at least the US designers try to obfuscate their backdoors
China strikes me as incapable of responding to bug reports, because a bug report puts the manufacturer in a bad light and that amounts to losing face.
Case in point:
I was maintaining a driver for a widespread SoC. The driver would flat out crash the Linux kernel during bootup (kernel oops and complete freeze) at every other kernel release, but only when booted off a specific hardware vendor's product. On other vendors' products based on the same SoC, no such problem.
I contacted the SoC's manufacturer, asking if that particular issue rang a bell. It didn't. However, their product specialist recalled that this particular hardware vendor had very pointy questions about hardware interrupts, back when they were building their BIOS image. As far as he could guess, the vendor had probably messed their build configuration and produced faulty BIOS images whose bugs were triggered by changes in the Linux kernel's other subsystems at every other release.
He gave me the name of a contact person at the hardware vendor, suggesting to report the bug to them. My e-mail was passed around from department to department – OEM support, Marketing, Sales, etc. – to no avail. One department assumed that I didn't understand some BIOS settings, another presumed that I was placing an order that would require a custom BIOS build. No, I'm reporting a defect in the BIOS sold in your products. I'm asking you to find the cause of the issue I've described – which does NOT affect other products based on the same SoC reference design that are sold by other hardware vendors, so it HAS to be a BIOS bug – and to please release a fixed BIOS image. At that point, someone with a modicum of English skills figured out what the word "defect" means and promised to contact me as soon as they found the solution. They never did. They also stopped responding to any further e-mail.
China. Sigh.
Software is not supposed to be about how to work around a useability issue. - Ken Barber
https://s-media-cache-ak0.pinimg.com/736x/69/b7/ae/69b7ae08af4a503b9bcc00459d40d4f6.jpg
"Hidden Backdoor Discovered In Chinese IoT Devices"
Shocking *cough*.
Seriously, this should surprise no one. No one who's been paying attention, anyway. At this point I pretty much assume that any internet-enabled Chinese hardware likely contains some sort of backdoor, hard-coded passwords, or other hidden stuff.
Just cruising through this digital world at 33 1/3 rpm...
There needs to be a UL type organization for IoT security.
Why is this marked as troll? It's funny given all the various articles related to China and security in their devices. Their culture doesn't enshrine privacy and user control like ours in the USA does.
From reading the article (yes - I know - and no I'm not new here) it's nasty piece of telephony hardware and more like a router than anything else. I know it's a current meme to thrash IoT as a platform but this is not a case of a programmer taking shortcuts on a feature constrained device, but rather a programmer or designer who is just dumb. This has been a problem long before the IoT ever came around.
I rhombus have just thought you're an asshole.
Yes because the USA is just a beacon of privacy
It's not an IoT device. It's basic networking equipment. Stop calling everything IoT.
This sounds like a feature, not a bug
Many vendors put a method to contact and trouble shoot their devices. Windows telemetry could be considered an example of this. For the average consumer (who doesn't even know what privacy is) this is almost always a good think. Customer support can easily fix their device. Unfortunately, this is IoT so the security is going to be shit. It's not just a Chinese problem it's the entire industries attitude.
It was marked because of the Chinaman slur. Now if it said 'the Chinese' instead of 'a Chinaman'... you would have a point.
You only hear that because China makes all the devices. If America actually made anything anymore, you'd hear about all their backdoors...
There is no privacy when there are Africans around, and the same goes with Orientals. They even know what you are doing inside restrooms behind walls to a high degree of accuracy, no need for backdoors in devices.