These guys are working way too hard to push the intentional-backdoor angle and tying it into a broader China narrative.
>Low and behold, there was my super secret password in plain text, with the admin username in plain text, on a page that requires no authentication of any kind to view.
It is so fucking dumb that there is no other explanation other than an intentional backdoor. If anyone quotes Occam's Razor, you've been asleep for the past 5 years or so.
Maybe you have more faith in developers than I do because this sounds exactly like a dumb mistake/cutting corners to me.
In the CVE, it details the call it executes to retrieve the password from nvram.
You probably mean Hanlon's Razor¹, which has been used so much it no longer cuts².
This researcher isn't doing anything that complicated to find this page, and the page needs no authentication at all so it's not restricted to e.g. authentication via a secret that's held by the manufacturer.
If you want to make a backdoor, at least put some effort into it. This doesn't have the features I'd expect in a good backdoor.
Can someone explain what we get by assuming the Chinese are just so inept at technology (they aren't) that we give them the benefit of the doubt that this is a naive mistake here?
Just look at IoT crap produced around the world. Are they inept, or is security an after thought?
On other hand I believe that companies like Huawei are capable of very special things just like western counterparts.
Hardware manufacturers in general have a pretty poor reputation for security & software engineering, Chinese or otherwise. It’s not like Cisco has been vulnerability free.
The incentives for quality code here are incredibly weak, and the incentives for caring about security are basically zero. What damage does this vulnerability cause to Jetstream as a brand? It's not like they're going to lose many sales from people who read tech news sites.
If you need to get something working at the cheapest price point possible, you cut all the corners you can - especially in the ways that don't manifest until outside the return period. Paying senior developers and doing external code audits are luxuries you can't really afford.
It is a hard problem to solve. It is of advantage to China to flood US and European markets with cheap AND insecure hardware.
Someone would have to try hard to make a case that that is not the case.