Hacker News Reader

The huawei user account hardcoded in the firmware that has sudoers permissions for insmod/modprobe is really blatant. I would have guessed the Chinese would at least attempt to hide their way in?

So they sell enterprise infrastructure equipment with such an obvious backdoor? It seems the US boycott of Huawei was fully justified after all, I didn't really believe them.

View on HN

That doesn't have to be a backdoor. Remember the wave of bugs caused by hardcoded secrets in Cisco hardware?

Might just be some leftover debugging account or for service.

>That doesn't have to be a backdoor.

It is a backdoor. The definition of the term doesn't require intent.

It would be both more subtle and practical had Huawei modified sshd to accept any key that had been signed by their CA.

That would have been slightly harder to detect.

How could that be harder to detect?

Reply on news.ycombinator.com