Hacker News Reader

Comment by WhatsName | Hacker News Reader

How would anyone tell if this is not malicious in the first place? It quacks like a backdoor, looks like a backdoor...

On security issues from massive Internet appliance vendors, you can safely assume it is malicious, though it might not have been placed there with knowledge of the vendor itself (i.e. it's very likely a state actor)

I much rather assume it's cost cutting in combination with poor testing practices. Which is also more likely.

If a state actor has access to your LAN you're all kinds of fucked already. They really don't need this crummy exploit for crummy home routers. It's pretty far-fetched to suspect a state actor, and outright ridiculously conspiratorial to say we can "safely assume" this.

Noone said its "your state" actor.

> If a state actor has access to your LAN you're all kinds of fucked already.

Seems very likely that some IOT devices are connected to LANs and can be used for shenanigans which is why you shouldn't trust anything on your LAN and always require encryption/authentication. Having telnet available on a router is beyond stupid and outright malicious.

Hanlon's razor would disagree with you.

Hanlons razor is used by the malicious to fool the stupid

That's an opinion, not an argument.

Agreed, as is the point I was responding to.

Someone putting in a backdoor would have known it's a backdoor, and I feel like they would have done it better. For example, making sure the hardcoded password can't be recovered from the firmware.

Reply on news.ycombinator.com