And here is a video of our CEO talking more about it: https://finitestate.io/2019/10/03/security-weekly-podcast
> Safe: memset_s
Yeah, if you’re just counting up occurrences then this is a stupid comparison.
I read the report itself:
- Devices came with a default username/password. Called a "backdoor."
- Devices used password auth instead of public key cryptography for SSH out of the box. Called a "backdoor."
- Default public key cryptography keys for SSH auth instead of password. Called a "backdoor."
- Devices contained public certificate authorities. Called a "man in them middle."
- Devices contained well known vulnerabilities in common open source software.
If I had paid Finite State for this report, I'd fire them on the spot and blacklist them. I particularly love the Schrödinger's cat of public key SSH auth. If the vendor doesn't enable it by default it is a "backdoor" and if they do it is "hard-coded certificates" and thus a "backdoor."
According to Finite State's logic I've never used a vendor that didn't contain multiple "backdoors." Particularly as doing so is impossible (since you need to enable public certificate SSH auth AND not provide users any way of actually using it).
The thing that surprises me is that they found "backdoors" in only 55% of devices? Shouldn't it be 100%, or did you feel like misleading that much was too unbelievable (and people might e.g. read the report and call you out)?
PS - No conflicts or stakes here (don't even run Huawei's stuff that I know of). Just decided to read the report because of the extraordinary claims made, found out there was nothing there.
Whoever paid Finite State for that report presumably was happy with the outcome that was arranged for them. Alternatively, they could have written the report on their own in order to drum up business and "reputation" in the cybersecurity industry.
And even if it's documented, although it's not a backdoor, it's still generally bad for security. Any device with non-unique default passwords or default keypairs will generally have hackers scanning the internet to compromise them. The keypair should be randomly generated on first use. The device should prompt for what password to use on first use.
Wouldn't surprise me if this newfound paranoia leads to a golden age for cybersecurity, and a wave of new best practices.
I'd be shocked if this happened. This requires politicians to both care about and understand cybersecurity enough to enforce it, and for there to be no opportunists looking to cash in on the ignorance of policy makers.
People demanded more security after 9/11. We got the Patriot Act and the TSA, so the government spies on its own people and an agency that has proven 95% (!!!) of the time to fail to detect a weapon.
https://onemileatatime.com/tsa-fails-tests-95-percent/
Ronald Reagon declared a war on drugs - I've already made this comment too political so I won't delve into that.
For anything complicated enough the general public cannot easily understand it, there is no incentive for politicians to actually care about it. They can just give it lip service with a few talking points and then never actually do anything actionable.