Hacker News Reader

Comment by easytiger | Hacker News Reader

Why is the title sensationalised. There is no "injects backdoor into their chips".

It's a debug console on a busybox build. One would have to be on the same lan to exploit it.

This "debug console" is on networked IP cameras (many of which are open to the web) and available through a hardcoded password. I don't see a convincing argument for malicious intent, more so a dangerous level of incompetence from a company who should know better.

Unfortunately Xiongmai is not an outlier for subpar security practices on IOT products, doesn't make it any less bad though

The old "the 's' in IoT stands for 'security'" holds true. Hanlon's razor has been dangerously stressed lately.

Xiongmai has a history of oopsies this big or bigger, going back several years at least. Their software usually turns out to be spyware, whatever their intent may be.

I would like to point out that this is not specific to IOT. I deal with lots of servers and enterprise networking gear at my job and many of them come with hardcoded passwords on ipmi / networked admin consoles.

The difference is that your average Joe doesn't even know he has to configure these devices, let alone how to configure them.

Malice should be the default assumption in some scenarios. If a man with a covered face dressed in all black is discovered inside a bank vault, it should be assumed he was there to burglarize it. Maybe he was actually a ninja haplessly teleported through space and time by a powerful evil mage and landed in the bank vault through pure coincidence, but probably he's a burglar.

This isn't a court of law. We aren't morally obliged to feign naivety. If this wasn't meant to be a back door, they're free to explain their actions. But until they've done so to my satisfaction, I for one will assume malice.

Though, "on the same LAN" becomes much more of a problem when you consider insecure 'smart' lightbulbs and appliances everywhere.

Yep, how many people actually have a lan where every single device that ever connects is fully secure and trusted.

The US Govt?

Their contractors. The government itself can't be bothered to follow its own security policies.

vLAN segmentation is a best practice for this exact reason

Everyone savvy enough to browse HN ought to, at the very least...

IT laypeople: LAN segmentation is a security feature

Security people: Uhm...

If a consumer device ships with a “debug console” that gives the manufacturer (or any attacker who knew about it) root, that’s a vulnerability. If it happens on purpose, and they don’t tell you about it, then that’s the very definition of a backdoor.

I've worked on security for IoT devices, and "would have to be on the same lan" is not at all uncommon as an attack scenario. In fact at the company I worked at I worked hard to get our customers to understand that just because a network is "local" does not make it "secure".

> One would have to be on the same lan to exploit it.

For what it's worth, DNS rebinding attacks are commonly used against embedded devices, and remove this restriction.

Had never heard of DNS rebinding before. Very cool. I presume this is only useful for extremely target attacks given the strict timing requirements?

Nope, it would be pretty straightforward to set up a stateful dns server that serves the "real" ip on first request from a new client, and then ever subsequent request returns a local IP. That one dns server would enable an attack on anyone who visits the malicious site.

No, people use it to scan entire LANs from the outside, untargeted exploration.

Speaking of rebinding attacks... does anyone know why cloudflare's 1.1.1.1 resolver doesn't enforce this? It's the only "big" public one I know of that happily resolves RFC1918 IPs.

Probably because things would break in subtle and confusing ways if they did.

E.g. you have a build server and chose to use live DNS to point at it artifacts on an internal network because it was simpler to just edit a single zone file.

That's a terrible idea. For one, RFC1918 addresses are perfectly fine IP addresses, and as such are perfectly fine to put into DNS, but also, if your security depends on this, you are not secure, because rebinding attacks work just as well with non-RFC1918 addresses if that's what you happen to be using on your local network, so devices and software have to be secured against rebinding attacks with a non-filtering DNS anyway.

Plus, it just breaks things. More than once have I had the problem of trying to serve files to other devices on a LAN I was visiting, only for their idiotic local resolver to helpfully refuse resolving the host name of my laptop because, oh surprise, it resolved to an address on that LAN!

Yeah, if you don't want to lose the protection provided by a firewall, then all you have to do is avoid running any web browsers on any devices on the LAN...

This should be a huge scandal. For some reason we tend to give browsers a free pass when it comes to security.

So...Hanlon’s Razor? :)

Reply on news.ycombinator.com