Intentional Backdoor In Consumer Routers Found

Generally an unmoderated forum for discussion of pretty much any topic. The focus however, is usually politics.
Post Reply
bannination
Captain
Posts: 5656
Joined: Sun Sep 16, 2012 7:58 am
Location: Hendersonville
Contact:

Intentional Backdoor In Consumer Routers Found

Unread post by bannination »

http://tech.slashdot.org/story/14/04/22 ... ters-found
http://arstechnica.com/security/2014/04 ... losing-it/
"The nature of the change, which leverages the same code as was used in the old firmware to provide administrative access over the concealed port, suggests that the backdoor is an intentional feature of the firmware ... Because of the format of the packets—raw Ethernet packets, not Internet Protocol packets—they would need to be sent from within the local wireless LAN, or from the Internet service provider’s equipment. But they could be sent out from an ISP as a broadcast, essentially re-opening the backdoor on any customer’s router that had been patched."


That's it linksys..... I'm installing tomato tomorrow.

User avatar
k9nanny
General
Posts: 777
Joined: Sun Sep 16, 2012 3:11 pm

Re: Intentional Backdoor In Consumer Routers Found

Unread post by k9nanny »

Say what ? -0-?
Se Non Ora, Quando?

User avatar
Wneglia
Midshipman
Posts: 1103
Joined: Tue Sep 18, 2012 7:00 pm

Re: Intentional Backdoor In Consumer Routers Found

Unread post by Wneglia »

Image

:mrgreen:

Mr.B
A bad person.
Posts: 4891
Joined: Tue Jun 18, 2013 4:22 pm

Re: Intentional Backdoor In Consumer Routers Found

Unread post by Mr.B »

k9nanny wrote:"Say what ?" -0-?
I dunno either.....he said something about firmware, a concealed port, backdoors, and a service provider’s equipment; Homerfobe's gonna be all over that one! :wtf:

bannination
Captain
Posts: 5656
Joined: Sun Sep 16, 2012 7:58 am
Location: Hendersonville
Contact:

Re: Intentional Backdoor In Consumer Routers Found

Unread post by bannination »

Mr.B wrote:
k9nanny wrote:"Say what ?" -0-?
I dunno either.....he said something about firmware, a concealed port, backdoors, and a service provider’s equipment; Homerfobe's gonna be all over that one! :wtf:
HAHAHA

The NSA is basically saying ALL YOUR DATA ARE BELONG TO US. <---Grammar intentional.

User avatar
rstrong
Captain
Posts: 5889
Joined: Thu Oct 25, 2012 9:32 am
Location: Winnipeg, MB

Re: Intentional Backdoor In Consumer Routers Found

Unread post by rstrong »

I read about this last year:

Oct 3012: D-Link confirms, defends router back-door code

That D-Link back door also applies to other brands that use the same firmware. Linksys has their own problems:

80% of Best-Selling Wireless Routers Have Security Vulnerabilities

I won't say what I'm using at home, except that it's a corporate firewall and has a few more abilities than the consumer stuff.

I also have an open public Wi-Fi spot with no firewall whatsoever. But it has its own DSL line separate from my internal network.

bannination
Captain
Posts: 5656
Joined: Sun Sep 16, 2012 7:58 am
Location: Hendersonville
Contact:

Re: Intentional Backdoor In Consumer Routers Found

Unread post by bannination »

rstrong wrote:I read about this last year:

Oct 3012: D-Link confirms, defends router back-door code

That D-Link back door also applies to other brands that use the same firmware. Linksys has their own problems:

80% of Best-Selling Wireless Routers Have Security Vulnerabilities

I won't say what I'm using at home, except that it's a corporate firewall and has a few more abilities than the consumer stuff.

I also have an open public Wi-Fi spot with no firewall whatsoever. But it has its own DSL line separate from my internal network.
I have the old trusty WRT54G. Installing tomato and replacing the linksys firmware gives you a lot features of commercial routers for the tiny price. (I prefer tomato to DD-WRT). Just don't expect to run a gaggle of computers on it.

I love it though, they hid the door until you hit a certain port first. That's sneaky. Whatever happened to the NSA protecting us *instead* of making us vulnerable.

User avatar
rstrong
Captain
Posts: 5889
Joined: Thu Oct 25, 2012 9:32 am
Location: Winnipeg, MB

Re: Intentional Backdoor In Consumer Routers Found

Unread post by rstrong »

bannination wrote:I have the old trusty WRT54G. Installing tomato and replacing the linksys firmware gives you a lot features of commercial routers for the tiny price. (I prefer tomato to DD-WRT). Just don't expect to run a gaggle of computers on it.
I still have my old WRT54G, and while it's not currently in use, I have no plans to get rid of it.

There's about 18 versions of the WRT54G, with wildly different hardware and firmware inside. Only the earlier versions can have their firmware replaced with DD-WRT.

Early versions used Linux firmware, until someone reminded Linksys that they were required to release their source code. That opened up knowledge that allowed others to write their own firmware for it.

Later versions cut the flash memory from 4MB to 2, too small for current Linux-based third-party firmware. Linux was replaced with VxWorks, the same OS used in all of the Mars rovers and many other spacecraft, the Apache helicopter, my Canon camera, etc.

User avatar
neoplacebo
Admiral of the Fleet
Posts: 12708
Joined: Mon Sep 17, 2012 1:42 pm
Location: Kingsport TN

Re: Intentional Backdoor In Consumer Routers Found

Unread post by neoplacebo »

All that techno babble is fine, but I still adhere to my policy of buying things that are out of character with regard to my personal preferences.....like tampons (I have quite a stockpile of these now) and cat litter and non alcoholic beer and eye shadow. I like it because it makes me feel like I'm winning.

User avatar
O Really
Admiral
Posts: 23651
Joined: Tue Sep 18, 2012 3:37 pm

Re: Intentional Backdoor In Consumer Routers Found

Unread post by O Really »

There are people who have access to my home security system. They know when there's a sensor tamper or error, and they know when there's a breach. They can tell every time somebody opens a door or window, and they undoubtedly know when I'm not home. They know if I don't turn on the alarm for some reason, and can probably chart patterns. I'm sure they could provide information to the NSA should they choose to do so. Should I be terrified?

User avatar
rstrong
Captain
Posts: 5889
Joined: Thu Oct 25, 2012 9:32 am
Location: Winnipeg, MB

Re: Intentional Backdoor In Consumer Routers Found

Unread post by rstrong »

O Really wrote:They know when there's a sensor tamper or error,
and they know when there's a breach.
They know when you are sleeping
They know when you're awake
They know if you've been bad or good
So be good for goodness sake!

Frankly, the NSA wouldn't be interested. The information doesn't help spot terrorists.

They'd be far more interested in your shopping habits, which they can buy from private industry. (Or simply order them to hand it over and not talk about it.) Police do this. A few years ago there was a news story where someone was arrested for burning his own house, based on a database having shown that he bought BBQ starter fuel. That he owned a BBQ was unimportant.

And they'd be interested in your browsing habits. Your ISP is probably already handing that over. We now know that if a wife at home Googles pressure cookers, and her husband at work Googles backpacks around the same time, six armed men in three black SUVs from a joint terrorism task force will surround their house. And that this happens a hundred times a week in America.

And they're interested when you talk to foreigners, in which case they can spy on you. But they already know who has been talking to foreigners via phone or the internet. (I'm a foreigner. You're welcome.)

And of course they've granted themselves the right to spy on people three steps out from any terrorism suspect. Anyone who knows someone who knows someone who knows someone who is a suspect. Which gives them a population larger than Colorado that they can spy on, per suspect. The TSA watch list has over 21,000 names. The Terrorist Screening Database (TSDB) has 400,000 names.

I highly doubt that your security system data concerns the NSA unless you become the focus of a major investigation.

User avatar
O Really
Admiral
Posts: 23651
Joined: Tue Sep 18, 2012 3:37 pm

Re: Intentional Backdoor In Consumer Routers Found

Unread post by O Really »

You do know the backpack and pressure cooker Googling story wasn't exactly as originally presented, right? And that it was the man's employer who turned him in to the police? And the feds played no part? That's covered in your link, but the original story was stoked with inaccurate hysteria.

User avatar
Boatrocker
Lieutenant Commander
Posts: 2066
Joined: Thu Jan 03, 2013 11:53 am
Location: Southeast of Disorder

Re: Intentional Backdoor In Consumer Routers Found

Unread post by Boatrocker »

O Really wrote:. . . but the original story was stoked with inaccurate hysteria.
May be a law, I don't know . . . .
People are crazy and times are strange. I'm locked in tight, I'm out of range.
I used to care, but, things have changed.

bannination
Captain
Posts: 5656
Joined: Sun Sep 16, 2012 7:58 am
Location: Hendersonville
Contact:

Re: Intentional Backdoor In Consumer Routers Found

Unread post by bannination »

O Really wrote:There are people who have access to my home security system. They know when there's a sensor tamper or error, and they know when there's a breach. They can tell every time somebody opens a door or window, and they undoubtedly know when I'm not home. They know if I don't turn on the alarm for some reason, and can probably chart patterns. I'm sure they could provide information to the NSA should they choose to do so. Should I be terrified?
This is more like buying a home security system with a default pin of 1111 - and everyone knows it and has access to it.

User avatar
rstrong
Captain
Posts: 5889
Joined: Thu Oct 25, 2012 9:32 am
Location: Winnipeg, MB

Re: Intentional Backdoor In Consumer Routers Found

Unread post by rstrong »

O Really wrote:You do know the backpack and pressure cooker Googling story wasn't exactly as originally presented, right? And that it was the man's employer who turned him in to the police? And the feds played no part? That's covered in your link, but the original story was stoked with inaccurate hysteria.
Oops. I hadn't seen that.

Sorry.

Post Reply