71–80 of 136 posts
reminds me of a bug I found in some tplink router it compared passwords of 3 different users but that table was empty so basically 15 NULL bytes would log you in as admin lol
> The associated username is not validated, so any provided username will succeed when paired with the backdoor password. Great. I am really wondering why should the customers trust these manufacturers. At this point I would not use any router with vendor-provided black box firmware. Full stop. I would always install OpenWRT or something similar on it before using it. And if that is not possible for whatever reason,…
good approach, but your security should not depend on your router anyway, you should be immune to attacks from it
Earlier quoted context omitted.
good approach, but your security should not depend on your router anyway, you should be immune to attacks from it
Not exposing your management interface to internet and running a guest network which doesn't have access to said management interfaces can block 95%+ of the attacks, I believe.
Earlier quoted context omitted.
In computer security, never attribute to ignorance that which is adequately explained by malice.
You’ve got the saying backwards: “Never attribute to malice that which is adequately explained by stupidity.” https://en.wikipedia.org/wiki/Hanlon%27s_razor
> The associated username is not validated, so any provided username will succeed when paired with the backdoor password. Great. I am really wondering why should the customers trust these manufacturers. At this point I would not use any router with vendor-provided black box firmware. Full stop. I would always install OpenWRT or something similar on it before using it. And if that is not possible for whatever reason,…
Earlier quoted context omitted.
Yes, I got their point. My point is that’s the opposite of reality.
His point is that in security, the opposite applies. The supposed "incompetence" is just plausible deniability for a malicious act.
Earlier quoted context omitted.
Yes, I got their point. My point is that’s the opposite of reality.
Maybe it's time to take a closer look at reality and correct this meme, which might casually blur the issue and deflect responsibility? Looking at the IT security landscape we see every layer, every product category if not every product itself riddled with issues at one point or another. At the same time the incentives to put those security issues in are huge, and we know attackers work systematic, creative and persi…
The saying doesn’t mean that all vulnerabilities are blunders. It means we shouldn’t automatically assume vulnerabilities are nefarious.
If closer inspection proves beyond reasonable doubt that it was placed there deliberately and maliciously then that’s different.
But the point is most vulnerabilities are blunders so it’s better to assume that until proven otherwise.
Earlier quoted context omitted.
You’ve got the saying backwards: “Never attribute to malice that which is adequately explained by stupidity.” https://en.wikipedia.org/wiki/Hanlon%27s_razor
Looks like this time you interpreted the message in a malicious way.
> The associated username is not validated, so any provided username will succeed when paired with the backdoor password. Great. I am really wondering why should the customers trust these manufacturers. At this point I would not use any router with vendor-provided black box firmware. Full stop. I would always install OpenWRT or something similar on it before using it. And if that is not possible for whatever reason,…
Last time when I looked OpenWRT was unable to support MIMO and beamforming capabilities of many of the devices it was running on. This capabilities are crucial to have decent coverage, signal strength and throughput where I live (i.e.: crowded/congested wireless networks in an apartment complex). Did OpenWRT team managed to work around them, or did the manufacturers started to play nicer with open drivers with loadab…
Also honest take this looks less like a "backdoor" (implies malicious - this is a link to a CVE after all) and more like a developer access credential/default credential that was burned into the firmware (i'd imagine the code remains but on a production run they randomize the key so its non-guessable but then you get lazy and dont run that extra step and this slips in/you burn the bare firmware with no production configs).