Backdoor account discovered in more than 100k Zyxel firewalls, VPN gateways
1–10 of 18 posts
Re: Backdoor account discovered in more than 100k Zyxel firewalls, VPN gateways
#2Re: Backdoor account discovered in more than 100k Zyxel firewalls, VPN gateways
#3Re: Backdoor account discovered in more than 100k Zyxel firewalls, VPN gateways
#4This and a little looking on Shodan makes for a scary tale of negligence at scale.
Re: Backdoor account discovered in more than 100k Zyxel firewalls, VPN gateways
#5This reminds me of the guy that discovered a backdoor in his router after he forgot the admin password over the Christmas holidays.
https://github.com/elvanderb/TCP-32764
There is helpful hints in that research that enabled me to view the firmware of my own router
Re: Backdoor account discovered in more than 100k Zyxel firewalls, VPN gateways
#6> Patches are currently available only for the ATP, USG, USG Flex, and VPN series. Patches for the NXC series are expected in April 2021, according to a Zyxel security advisory.
4 months to deliver a security patch of this significance? Would love to know what kind of situation leads to that kind of latency.
Re: Backdoor account discovered in more than 100k Zyxel firewalls, VPN gateways
#7This is why I use OpenWrt in my network!
Re: Backdoor account discovered in more than 100k Zyxel firewalls, VPN gateways
#8> Patches are currently available only for the ATP, USG, USG Flex, and VPN series. Patches for the NXC series are expected in April 2021, according to a Zyxel security advisory. 4 months to deliver a security patch of this significance? Would love to know what kind of situation leads to that kind of latency.
They had to figure out what backdoor to replace it with
Re: Backdoor account discovered in more than 100k Zyxel firewalls, VPN gateways
#9Its okay, they all had nothing to hide
Re: Backdoor account discovered in more than 100k Zyxel firewalls, VPN gateways
#10Its almost as if Chinese companies are either just arms of the state, or thoroughly infiltrated by state actors! I don't think US-based hardware manufacturers are really any better though.
To me this just illustrates the need for fully open-sourced hardware and software with domestic production facilities.