Language Selection

English French German Italian Portuguese Spanish

Easter egg: DSL router patch merely hides backdoor instead of closing it

Filed under
Hardware
Security
Legal

First, DSL router owners got an unwelcome Christmas present. Now, the same gift is back as an Easter egg. The same security researcher who originally discovered a backdoor in 24 models of wireless DSL routers has found that a patch intended to fix that problem doesn’t actually get rid of the backdoor—it just conceals it. And the nature of the “fix” suggests that the backdoor, which is part of the firmware for wireless DSL routers based on technology from the Taiwanese manufacturer Sercomm, was an intentional feature to begin with.

Back in December, Eloi Vanderbecken of Synacktiv Digital Security was visiting his family for the Christmas holiday, and for various reasons he had the need to gain administrative access to their Linksys WAG200G DSL gateway over Wi-Fi. He discovered that the device was listening on an undocumented Internet Protocol port number, and after analyzing the code in the firmware, he found that the port could be used to send administrative commands to the router without a password.

After Vanderbecken published his results, others confirmed that the same backdoor existed on other systems based on the same Sercomm modem, including home routers from Netgear, Cisco (both under the Cisco and Linksys brands), and Diamond. In January, Netgear and other vendors published a new version of the firmware that was supposed to close the back door.

Read more

More in Tux Machines

Nix This Innovative OS for Its Uninviting Complexity

I had to keep reminding myself that I was not dealing with an extreme case of Arch Linux instead of GNU/Linux. NixOS is more demanding and definitely not a distro for users with anything less than advanced skills. To say NixOS comes with a steep learning curve and lots of hands-on overhead is putting it mildly. If you are a typical Linux user who lacks sysadmin training, avoid NixOS like a malware attack hiding in plain sight. Read more

Riot: A Distributed Way of Having IRC and VOIP Client and Home Server

Riot is a free and open source decentralized instant messaging application that can be considered an alternative to Slack. Take a look at features of Riot, installation procedure and usage. Read more

KDE’s New Elisa Music Player: So Close, Yet So Far Away

KDE is a working on a new music player called Elisa. Can Elisa become the new default music player in most Linux distributions? Find out in this review of Elisa music player. Read more

Collabora Online 3.2 released

Collabora Productivity, the driving force behind putting LibreOffice in the Cloud, is excited to announce a new release of its flagship enterprise-ready cloud document suite – Collabora Online 3.2, with new features and multiple improvements. Read more