Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Huawei Hacked My Laptop

sunburnt.com.au

Post reply on HN
Print view View original

21–26 of 26 posts

Re: Huawei Hacked My Laptop

#21

Post by detaro »

bzb3 wrote: post #12
znpy wrote: post #9

Earlier quoted context omitted.

Considering China is a communist dictatorship, the company is the state, in a way. Now my biggest guess is that xhost + is being used to allow a process running as root to launch a window into the existing xserver no matter what (probably a graphical client). It's a very bad practice though. How comes that devices can autorun software nowadays?

They can't, he probably installed whatever software that came with the hardware.

There is a few mechanisms through which hardware can get the OS to execute code, so it is possible for the BIOS to cause software to be installed. E.g. the easiest one is probably the "Windows Platform Binary Table" in ACPI.

Re: Huawei Hacked My Laptop

#22

Post by sova »

gbraad wrote: post #11
sova wrote: post #7

Earlier quoted context omitted.

the first sentence says it came with a USB stick

(I do not see that line in the article) but that is the point; who made this? Who says this is legit? Perhaps bought off Aliexpress? Or rebadged by the provider? The "USB Stick" you refer to is the "E353 HSPA+ 3G USB stick" being the device itself; also called the "Surf stick". Google it.

That's a fair point, the origins are not explained well and it may not be a stock product. Check out mg's twitter @_MG_

Re: Huawei Hacked My Laptop

#23

Post by FDSGSG »

phone8675309 wrote: post #14
FDSGSG wrote: post #2

Less than ideal behavior, but this bit is nonsense: >This command makes your Linux desktop remotely accessible to anyone on the network It's definitely not a common configuration to have X11 listening for network connections. In a multiuser environment this could actually be a problem, but I doubt there are many multiuser environments running this driver. On a single user machine like a laptop, this really doesn't ma…

>Yes, a process running as another user could mess with your X11 session. But if you get compromised somehow that process will almost certainly be running as your current user or root. This means that any daemon with a remote code execution exploit (even if running as its own, compartmentalized user) can now be chained with this to get complete access to your X11 session.

And how many such daemons do you have running on your laptop? My debian install only has tor and avahi. Any adversary with 0days for those would certainly have linux kernel exploits too.

Re: Huawei Hacked My Laptop

#24

Post by phone8675309 »

FDSGSG wrote: post #23
phone8675309 wrote: post #14

Earlier quoted context omitted.

>Yes, a process running as another user could mess with your X11 session. But if you get compromised somehow that process will almost certainly be running as your current user or root. This means that any daemon with a remote code execution exploit (even if running as its own, compartmentalized user) can now be chained with this to get complete access to your X11 session.

And how many such daemons do you have running on your laptop? My debian install only has tor and avahi. Any adversary with 0days for those would certainly have linux kernel exploits too.

>And how many such daemons do you have running on your laptop?

Typically none, but the security of someone else's system is not defined by the security of my system. For some users, they might have CUPS running because they have a printer configured, SSH so that people can connect to help them (or so they can push files to the machine over the network), perhaps they're doing some web development and have Apache running. There are any number of daemons that could be running on a laptop with legitimate access to the rest of the network.

> Any adversary with 0days for those would certainly have linux kernel exploits too.

I wouldn't say that's a given, first off, and second off, they may not have a Linux kernel exploit, and even if they do, why should they burn a Linux 0day when they can simply just listen using this open hole?

Re: Huawei Hacked My Laptop

#25

Post by FDSGSG »

phone8675309 wrote: post #24
FDSGSG wrote: post #23

Earlier quoted context omitted.

And how many such daemons do you have running on your laptop? My debian install only has tor and avahi. Any adversary with 0days for those would certainly have linux kernel exploits too.

>And how many such daemons do you have running on your laptop? Typically none, but the security of someone else's system is not defined by the security of my system. For some users, they might have CUPS running because they have a printer configured, SSH so that people can connect to help them (or so they can push files to the machine over the network), perhaps they're doing some web development and have Apache runni…

>they might have CUPS running because they have a printer configured

Runs as root.

>SSH so that people can connect to help them

Runs as root.

>perhaps they're doing some web development and have Apache running

I think you're fundamentally screwed if your adversary is willing to use apache 0days on you.

>There are any number of daemons that could be running on a laptop with legitimate access to the rest of the network

In practice this is a very rare scenario, the severity of this fuckup by Huawei should be viewed in that light. It's not ideal, but this is hardly a big deal.

>why should they burn a Linux 0day

Those are a dime in a dozen, and using an exploit very rarely means burning it.

And even if the adversary didn't have a linux 0day to use on you, you'd almost certainly still be screwed sooner or later as they'd now have persistent local access to your system. Odds are that you'd never notice a cronjob running as debian-tor, pinging the attackers c&c once a day.

It really is game over once someone gets arbitrary code execution on your system, unless you maintain an extraordinary security posture which would preclude installing sketchy huawei drivers anyway.

Re: Huawei Hacked My Laptop

#26

Post by JDW1023 »

gbraad wrote: post #11
sova wrote: post #7

Earlier quoted context omitted.

the first sentence says it came with a USB stick

(I do not see that line in the article) but that is the point; who made this? Who says this is legit? Perhaps bought off Aliexpress? Or rebadged by the provider? The "USB Stick" you refer to is the "E353 HSPA+ 3G USB stick" being the device itself; also called the "Surf stick". Google it.

it is actually called the "HiLink E353"[0], a 3G usb Modem from huawei.

[0]: https://consumer.huawei.com/en/press/news/2011/hw-256113/

Post reply on HN