11–20 of 26 posts
Where does this "Hauwei Autorun" come from? The findings you show could have been made by anything/anyone
the first sentence says it came with a USB stick
The "USB Stick" you refer to is the "E353 HSPA+ 3G USB stick" being the device itself; also called the "Surf stick". Google it.
Yeah, a lazy developer introducing a dirty hack is state-sponsored hacking. Give me a break...
Considering China is a communist dictatorship, the company is the state, in a way. Now my biggest guess is that xhost + is being used to allow a process running as root to launch a window into the existing xserver no matter what (probably a graphical client). It's a very bad practice though. How comes that devices can autorun software nowadays?
Less than ideal behavior, but this bit is nonsense: >This command makes your Linux desktop remotely accessible to anyone on the network It's definitely not a common configuration to have X11 listening for network connections. In a multiuser environment this could actually be a problem, but I doubt there are many multiuser environments running this driver. On a single user machine like a laptop, this really doesn't ma…
Laptops travel to coffee shops and share their network.
Less than ideal behavior, but this bit is nonsense: >This command makes your Linux desktop remotely accessible to anyone on the network It's definitely not a common configuration to have X11 listening for network connections. In a multiuser environment this could actually be a problem, but I doubt there are many multiuser environments running this driver. On a single user machine like a laptop, this really doesn't ma…
This means that any daemon with a remote code execution exploit (even if running as its own, compartmentalized user) can now be chained with this to get complete access to your X11 session.
Earlier quoted context omitted.
Considering China is a communist dictatorship, the company is the state, in a way. Now my biggest guess is that xhost + is being used to allow a process running as root to launch a window into the existing xserver no matter what (probably a graphical client). It's a very bad practice though. How comes that devices can autorun software nowadays?
They can't, he probably installed whatever software that came with the hardware.
Less than ideal behavior, but this bit is nonsense: >This command makes your Linux desktop remotely accessible to anyone on the network It's definitely not a common configuration to have X11 listening for network connections. In a multiuser environment this could actually be a problem, but I doubt there are many multiuser environments running this driver. On a single user machine like a laptop, this really doesn't ma…
> In a multiuser environment this could actually be a problem, but I doubt there are many multiuser environments running this driver. Laptops travel to coffee shops and share their network.
There are two primary ways that the 'xhost +' command could be an issue on a multiuser machine these days (assuming that X11 not listening on the network): other users on the machine can now access your X11 session with no access control (as 'xhost +' disables access control) or that a remote code execution exploit against a daemon running on the network can be used to access your X11 session with no access control.
Earlier quoted context omitted.
They can't, he probably installed whatever software that came with the hardware.
I guess you're right. I don't understand why my previous comment is being downvoted though.
Edit: Case in point - this comment was flagged less than five minutes after it was posted.
The Windows drivers were unsigned, the “dashboard” application for managing the dongle was horrible (and the Mac version, which I was especially responsible for, was so bad I eventually asked to provide a modem script instead). But I could not attribute any of it to malice, really (as the saying goes...).
And yes, those things usually have a plethora of USB functionality inside them, from a USB UART (Ethernet in some variants) to storage, which usually had drivers and carrier-specific apps to configure the dongles.
(My notes on the E220 are still around - https://taoofmac.com/space/com/Huawei/E220 has a bunch of low-level stuff I had actually forgotten about)
Now, this post does pose some questions, but not necessarily about Huawei - last I checked, Linux had no autorun functionality, so I’m wondering if the author didn’t actually run some portion of their installer without thinking of the consequences?
Earlier quoted context omitted.
I guess you're right. I don't understand why my previous comment is being downvoted though.
You criticized China, that's why. You can't criticize China on the Internet and expect to not be downvoted by the fifty cent army. Edit: Case in point - this comment was flagged less than five minutes after it was posted.