Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tenda firmware (multiple versions) contains hidden authentication backdoor

kb.cert.org

Post reply on HN
Print view View original

131–136 of 136 posts

Re: Tenda firmware (multiple versions) contains hidden authentication backdoor

#131

Post by VladVladikoff »

miki123211 wrote: post #30
VladVladikoff wrote: post #17

Earlier quoted context omitted.

I’m working on a hotel right now. And I’ve gone to great lengths to make the wifi more secure. Everyone on their own VLAN. Separate PPSK for each room. Credentials are randomly generated and not some ridiculous pattern of last name and room number or similar. We built our own custom access control system, with what at the time was the strongest keycards we could find (mifare desfire ev3), I’m really trying to make a…

How do you distribute credentials to residents? My Macbook is permanently locked out of Cox's hotspot system (used in some U.S. hotels) because the password was given to me on a tiny label which I couldn't read as a blind person except through OCR, and the OCR was wrong a few too many times.

We push a QR code to their TV as well as send them an SMS after check in.

Re: Tenda firmware (multiple versions) contains hidden authentication backdoor

#132

Post by VladVladikoff »

ggm wrote: post #20
VladVladikoff wrote: post #17

Earlier quoted context omitted.

I’m working on a hotel right now. And I’ve gone to great lengths to make the wifi more secure. Everyone on their own VLAN. Separate PPSK for each room. Credentials are randomly generated and not some ridiculous pattern of last name and room number or similar. We built our own custom access control system, with what at the time was the strongest keycards we could find (mifare desfire ev3), I’m really trying to make a…

As long as I can bind more than one device in my room, and as long as I can "see" the devices amongst themselves, I'd love this. I can imagine people who want inter-room access but they can live through proxies offsite. If I want to do in room sharing, I need in room wifi. Gets hard when you bring "smart" TV's to the table. They're going to need to expose into this system somewhat 'credential-free' but if you do it o…

Yes we allow in room multiple devices and casting to the room TV. The TVs exist in each rooms separate VLAN.

Inter room communication between group bookings is in the works but it’s complex to say the least.

Re: Tenda firmware (multiple versions) contains hidden authentication backdoor

#133

Post by UweSchmidt »

hnlmorg wrote: post #77
UweSchmidt wrote: post #66

Earlier quoted context omitted.

Maybe it's time to take a closer look at reality and correct this meme, which might casually blur the issue and deflect responsibility? Looking at the IT security landscape we see every layer, every product category if not every product itself riddled with issues at one point or another. At the same time the incentives to put those security issues in are huge, and we know attackers work systematic, creative and persi…

> I wouldn't assume that all of those security mishaps stem from an endless series of blunders from "stupid" programmers. The saying doesn’t mean that all vulnerabilities are blunders. It means we shouldn’t automatically assume vulnerabilities are nefarious. If closer inspection proves beyond reasonable doubt that it was placed there deliberately and maliciously then that’s different. But the point is most vulnerabil…

It's usually not possible to prove that something was put in deliberately and maliciously, so that puts the bar very high. We know it for sure in some of the supply chain attacks, and should assume that other kinds of bugs are being introduced by malicious actors across the board, rather than to risk downplaying the issues to "just blunders".

Re: Tenda firmware (multiple versions) contains hidden authentication backdoor

#134

Post by pseudohadamard »

torginus wrote: post #99
Wololooo wrote: post #63

Earlier quoted context omitted.

I mean, it's 99% sure this was supposed to be a debug feature...

I have done this accidentally at least once - we shipped a full-stack app, and telemetry started lighting up that on certain older phones and browsers (no points for guessing which brand and browser), the release version didn't load. The minifier did something in the release build that it didn't like. So after a quick test, it was decided to deploy the debug version of just the frontend as a bandaid. Next day we saw…

Did this too when I was working for a company that decided dongle-protecting their software was a good idea. We shipped with the protection check no-op'd out for, ah, debugging purposes and it never got re-enabled. Not really sure if it was by-accident-on-purpose or not.

Re: Tenda firmware (multiple versions) contains hidden authentication backdoor

#135

Post by hnlmorg »

UweSchmidt wrote: post #133
hnlmorg wrote: post #77

Earlier quoted context omitted.

> I wouldn't assume that all of those security mishaps stem from an endless series of blunders from "stupid" programmers. The saying doesn’t mean that all vulnerabilities are blunders. It means we shouldn’t automatically assume vulnerabilities are nefarious. If closer inspection proves beyond reasonable doubt that it was placed there deliberately and maliciously then that’s different. But the point is most vulnerabil…

It's usually not possible to prove that something was put in deliberately and maliciously, so that puts the bar very high. We know it for sure in some of the supply chain attacks, and should assume that other kinds of bugs are being introduced by malicious actors across the board, rather than to risk downplaying the issues to "just blunders".

It’s actually quite easy in most cases:

1. You can generally get a feel for the intent by the developers reputation.

2. Look at the code that changed as part of the same commits. Eg was the vulnerable code included as part of the same commits as an unrelated change elsewhere in the codebase? If the latter then that’s hugely suspicious.

3. How is that vulnerability encoded? Eg is a bug parsing logic that was discovered via fuzzing? Or is it obfuscated code? Clearly the latter demonstrates intent.

4. What’s the nature of the vulnerability? Is it simply a dumb unhandled bounds or allocation error in C? Or is there an entire path of code that opens network ports? The latter also demonstrates intent.

5. How did the authors behind the vulnerable code react to the big report? Did they rush a patch out? Write more robust tests? Work with the community? Was there any transparency? Or was the issue quietly brushed over? This is least reliable indicator but it does demonstrate trustworthiness.

With these and other indicators you can build a body of evidence that can make an argument for or against a particular vulnerability being malicious. And while I do agree that in some cases it isn’t going to be clear cut, in most cases the evidence, or lack of, will be enough to justify an opinion.

The key part of my earlier statement being “beyond reasonable doubt”. Ie I’m not talking about a mathematical proof here.

Re: Tenda firmware (multiple versions) contains hidden authentication backdoor

#136

Post by pshirshov »

pbasista wrote: post #107
pshirshov wrote: post #75

Earlier quoted context omitted.

Hm, do you ever go over 1gbit? If my understanding is correct, good affordable routers like Mikrotik's CCR2004 are fully closed, so the only option is to build your own shitty box which will be much less energy efficient than their specialized switch chips.

> do you ever go over 1gbit No. None of the local ISPs offer speeds above 1 Gbps. However, I use FriendlyElec NanoPi R5C as the main entrypoint router. It has two 2.5G ethernet ports. It costs less than 100 euros. And it runs OpenWRT. It is not a multiport, multi-gigabit device though. And I have not tested it above 1 Gbps so I am unsure about its real world performance.

Their own spec declares less than 2.5 throughput in ideal conditions.
Post reply on HN