Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
China Bug Networking Security

Hidden Backdoor Discovered In Chinese IoT Devices (techradar.com) 85

"A backdoor has been found in devices made by a Chinese tech firm specializing in VoIP products," reports TechRadar. An anonymous reader quotes their article: Security outfit Trustwave made the discovery of a hidden backdoor in DblTek's devices which was apparently put there to allow the manufacturer access to said hardware -- but of course, it's also open to being exploited by other malicious parties. The backdoor is in the Telnet admin interface of DblTek-branded devices, and potentially allows an attacker to remotely open a shell with root privileges on the target device.

What's perhaps even more worrying is that when Trustwave contacted DblTek regarding the backdoor last autumn -- multiple times -- patched firmware was eventually released at the end of December. However, rather than removing the flaw, the vendor simply made it more difficult to access and exploit. And further correspondence with the Chinese company has apparently fallen on deaf ears.

The firmware with the hole "is present on almost every GSM-to-VoIP device which DblTek makes," and Trustwave "found hundreds of these devices on the net, and many other brands which use the same firmware, so are equally open to exploit."
This discussion has been archived. No new comments can be posted.

Hidden Backdoor Discovered In Chinese IoT Devices

Comments Filter:
  • by aussie_a ( 778472 ) on Sunday March 05, 2017 @03:38PM (#53980949) Journal

    There is a price for outsourcing all of your manufacturing needs to companies in countries with authoritarian governments. Having state sponsored Spyware in your devices is one such cost.

    • by rtkluttz ( 244325 ) on Sunday March 05, 2017 @04:01PM (#53981061) Homepage

      There is a price for putting things on the internet that require command and control outside of the owners network. Authoritarian government == Authoritarian company. I love connected things but not when I have to ask someone elses servers to access or do shit with equipment behind MY firewalls.

    • I seem to remember the following conversation here a few months ago

      US Gov: "Give us access to everyone's phone."
      Apple: "That would be a massive security threat, everyone could access it."
      US Gov: "Then just make it so that only we good government guys could access it."
      Apple: "(involuntary eye twitch) You... that's... I mean... (deep breaths) Okay, that's not something that's possible."
      US Gov: "Just do it."
      Apple: "You know what, fuck off."
      US Gov: "Ah, never mind, we figured it out anyway."

      I'm sure
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      What was the price the world has paid for years of using American products, not little IoT thingies, but huge equipment for Internet backbone services from Cisco, Juniper etc., being loaded with backdoors etc. by NSA?

      • Yup. Cost is pretty high in lost trust. Same as when any government does it. Frankly the sanctions should be, alas Noone in power seems to care.

    • by brunes69 ( 86786 )

      "Never attribute to malice that which is adequately explained by stupidity" - Hanlon's razor

      • The age of Trump stretches Hanlon's Razor to the snapping point.

        Also, considering that they *buried* the code instead of actually removing it, makes it very clear that this was absolutely not an issue of stupidity.

    • You do know the USA does this too.
    • by gl4ss ( 559668 )

      doesn't need to be state sponsored.

      look, the mindset is just that what bad is a backdoor in a product you maybe need to patch up and such. it's secret yeah? thats the mindset the chinese and asians build anything like this.

      coincidentally asian thieves rarely pick locks and the locks are of shit quality everywhere.

    • Uh, "all"? Hyperbole much?

      Also, while it's certainly possible backdoors were added at the request/order of the Chinese government -- especially if the Chinese government owns some or all of the company -- it's also very possible they were placed there for the same reason U.S. firms do it in their hardware/software/firmware products: convenience during testing and service. Maybe it was meant to be removed/disabled before shipping, maybe not.

      Well, that's one reason U.S. firms do it. The Clipper Chip didn

  • by Gojira Shipi-Taro ( 465802 ) on Sunday March 05, 2017 @03:38PM (#53980951) Homepage

    I've just shat myself with surprise.

  • by Anonymous Coward on Sunday March 05, 2017 @03:47PM (#53980989)

    Shocked to find there's gambling in this establishment.

  • by HornWumpus ( 783565 ) on Sunday March 05, 2017 @03:58PM (#53981049)

    This is made worse by the fact that default router configurations leave telnet open.

    Could be worse. Close that port and it's a non-issue. Should have closed it with the last batch.

    • How does this make any sense? Telnet open by default? How does that get through NAT?

      • by aaarrrgggh ( 9205 ) on Sunday March 05, 2017 @06:31PM (#53981705)
        Device pings manufacturer's server every hour or so. Translation remains active for inbound connection, even with stateful firewall.

        You really have to segregate everything to stay protected, and block or proxy outbound connections for IoT devices.

        It gets harder when all the traffic is on 443.
        • Device pings manufacturer's server every hour or so. Translation remains active for inbound connection, even with stateful firewall

          Translation isn't that basic. If it's not an open TCP connection or a very recent UDP connection then it wouldn't be active.

          • Based on my firewall logs that doesn't seem to be the case; my stateful firewall times out after 30 minutes, but my logs show inbound translations for at least an hour, often two. Am I looking at it incorrectly?
            • Just as an example think of two people playing a game at the same time behind NAT connecting to the same remote server. NAT is more selective than source / destination. I'm not sure what you're seeing but if it were as simple as you said then it could conceptually not work.

  • X-10 (Score:4, Funny)

    by AndyKron ( 937105 ) on Sunday March 05, 2017 @04:21PM (#53981161)
    And this is why I don't have any IoT devices. X-10 still works for me.
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Referring to every router and gatway as an "IoT device" is getting stupid. This has nothing to do with X10 or lightbulbs or switches or home automation.

    • And this is why I don't have any IoT devices. X-10 still works for me.

      Is your X-10 device connected to your internet connected computer?

      • And this is why I don't have any IoT devices.
        X-10 still works for me.

        I have a lot of X-10 stuff running, but sadly they changed all the fucking light controllers to this asinine "soft start" shit and it's been a disaster. If you use them you probably know exactly what I'm talking about.

        • I tried x10 like 20 years ago when Fry's had a free giveaway, but couldn't see the point beyond novelty. And I built my own for some industrial processes that I was playing with a few years ago (hatching chickens), but what mostly for fun.
  • A couple of months ago I purchased a temperature measuring device that plugs into a USB port. The device was made in China by a Chinese company and shipped directly from China. I am really reluctant to plug it into any USB port nowadays, as I do not know what will be activated in the device once it gets power. Coming from China, I doubt if it would be anything good...
    • by Anonymous Coward

      Fire up a VM after first taking a snapshot. Route the USB device to the VM. Plug it in and run diagnostics. Obvious thing to look for is enumeration of multiple end points at the device. Those temp monitors appear as a HID device. They're flakey as crap and unfortunately don't make it easy to enumerate multiple sensors - but after plugging it in you should be able to suss it out pretty painlessly.

      I'd be much more worried about the dodgy software they ship for reading the sensor...

    • Does the device load its own software?
    • Connect it to a non-windows machine, preferably linux. The majority of malicious software tends to target windows. While the the number of malicious entities for Mac have climbed in the past couple years, it's still a drop in the bucket compared to Windows. Linux may as well be a rounding error.

      Then you can poke at it relatively safely and see if there's anything interesting on it.

      If you don't have a Linux machine available, you could always use some distro's liveCD version, or you could even download a

  • by Anonymous Coward

    I'm so worn down by the number of news items about (yet another) shitty Chinese device having some a backdoor/malware/shitty or non existent security that I just assume that every device made in China has these flaws, we just haven't yet heard of them in the wild.

    What would be more shocking to me is a news story about a Chinese device that has been security audited and found to be secure. When that day comes I will be truly suprised.

  • Then your IOT devices would have authorized_keys with names like repairman@factory.cn and spy@gov.cn

  • at least the US designers try to obfuscate their backdoors
  • by Quietti ( 257725 ) on Sunday March 05, 2017 @05:44PM (#53981545) Journal

    China strikes me as incapable of responding to bug reports, because a bug report puts the manufacturer in a bad light and that amounts to losing face.

    Case in point:

    I was maintaining a driver for a widespread SoC. The driver would flat out crash the Linux kernel during bootup (kernel oops and complete freeze) at every other kernel release, but only when booted off a specific hardware vendor's product. On other vendors' products based on the same SoC, no such problem.

    I contacted the SoC's manufacturer, asking if that particular issue rang a bell. It didn't. However, their product specialist recalled that this particular hardware vendor had very pointy questions about hardware interrupts, back when they were building their BIOS image. As far as he could guess, the vendor had probably messed their build configuration and produced faulty BIOS images whose bugs were triggered by changes in the Linux kernel's other subsystems at every other release.

    He gave me the name of a contact person at the hardware vendor, suggesting to report the bug to them. My e-mail was passed around from department to department – OEM support, Marketing, Sales, etc. – to no avail. One department assumed that I didn't understand some BIOS settings, another presumed that I was placing an order that would require a custom BIOS build. No, I'm reporting a defect in the BIOS sold in your products. I'm asking you to find the cause of the issue I've described – which does NOT affect other products based on the same SoC reference design that are sold by other hardware vendors, so it HAS to be a BIOS bug – and to please release a fixed BIOS image. At that point, someone with a modicum of English skills figured out what the word "defect" means and promised to contact me as soon as they found the solution. They never did. They also stopped responding to any further e-mail.

    China. Sigh.

    • by Mandrel ( 765308 )

      Companies like these know that support is their biggest cost. Their aim is to have their products bought because they are a cheap and readily-available option that promises to do what people want. How well they do this isn't important if they can get customers past a return impetus, and if they can rely on few customers seeing a product review or security alert. They then make it hard to contact and converse with support, like your experience, but also often by not having a website, an English website, or

      • by AHuxley ( 892839 )
        The options are to have users look up revision and device codes to find some password, user name that works for that device for hours.
        Find some printed paper in the box with a code to enter? Find a read me file deep on the desktop?
        Or to have working plug and play as supported by most modern computer systems.
        So a device opens up the network and everything works with default passwords in seconds.
        Its not the device or OS issues, just that a home network is now open to default ports using expected password
  • No way (Score:4, Insightful)

    by JustAnotherOldGuy ( 4145623 ) on Sunday March 05, 2017 @07:00PM (#53981839)

    "Hidden Backdoor Discovered In Chinese IoT Devices"

    Shocking *cough*.

    Seriously, this should surprise no one. No one who's been paying attention, anyway. At this point I pretty much assume that any internet-enabled Chinese hardware likely contains some sort of backdoor, hard-coded passwords, or other hidden stuff.

  • IoT - really ? (Score:4, Informative)

    by slincolne ( 1111555 ) on Sunday March 05, 2017 @09:49PM (#53982497)
    Does this device sound like an IoT gadget ?

    From reading the article (yes - I know - and no I'm not new here) it's nasty piece of telephony hardware and more like a router than anything else. I know it's a current meme to thrash IoT as a platform but this is not a case of a programmer taking shortcuts on a feature constrained device, but rather a programmer or designer who is just dumb. This has been a problem long before the IoT ever came around.

  • by campuscodi ( 4234297 ) on Monday March 06, 2017 @08:21AM (#53984195)
    It's not an IoT device. It's basic networking equipment. Stop calling everything IoT.
  • This sounds like a feature, not a bug
  • Many vendors put a method to contact and trouble shoot their devices. Windows telemetry could be considered an example of this. For the average consumer (who doesn't even know what privacy is) this is almost always a good think. Customer support can easily fix their device. Unfortunately, this is IoT so the security is going to be shit. It's not just a Chinese problem it's the entire industries attitude.

"Paul Lynde to block..." -- a contestant on "Hollywood Squares"

Working...