Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Monday July 19, @04:52PM   Printer-friendly [Skip to comment(s)]
from the pwned dept.

For years, a backdoor in popular KiwiSDR product gave root to project developer:

KiwiSDR is hardware that uses a software-defined radio to monitor transmissions in a local area and stream them over the Internet. A largely hobbyist base of users does all kinds of cool things with the playing-card-sized devices. For instance, a user in Manhattan could connect one to the Internet so that people in Madrid, Spain, or Sydney, Australia, could listen to AM radio broadcasts, CB radio conversations, or even watch lightning storms in Manhattan.

On Wednesday, users learned that for years, their devices had been equipped with a backdoor that allowed the KiwiSDR creator—and possibly others—to log in to the devices with administrative system rights. The remote admin could then make configuration changes and access data not just for the KiwiSDR but in many cases to the Raspberry Pi, BeagleBone Black, or other computing devices the SDR hardware is connected to.

Archived copy of the story.


Original Submission

Display Options Threshold/Breakthrough Reply to Article Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
  • (Score: 4, Insightful) by weilawei on Monday July 19, @04:56PM (13 children)

    by weilawei (109) on Monday July 19, @04:56PM (#1157936) Homepage
    Are endemic in modern hardware, software, and business culture, whether or not open source is involved at some point or the project is a kickstartr. Goddamn peeping toms can't stop poking into other peoples' shit.
    • (Score: 4, Interesting) by RS3 on Monday July 19, @05:16PM (6 children)

      by RS3 (6367) on Monday July 19, @05:16PM (#1157947)

      Thank you. That's been my view of much of the spying / monitoring / "phone home" / "telemetry" - much of it is some sicko voyeur somewhere.

      I'll give that as an engineer / product developer, I'd love to know more about how / where / why / what is being done with my product, because I like "agile" iterative development, improving, refining. But I could never put "backdoors" or any kind of spying in something and feel okay about it. I'm more apt to offer people beta tester status, and some kind of reward, but it'd all be open negotiation.

      • (Score: 1) by fustakrakich on Monday July 19, @06:05PM (1 child)

        by fustakrakich (6150) on Monday July 19, @06:05PM (#1157965) Journal

        By now it must be possible to send back an "executable" through the telemetry

        --
        Ok, we paid the ransom. Do I get my dog back? REDЯUM
        • (Score: 2) by RS3 on Monday July 19, @09:24PM

          by RS3 (6367) on Monday July 19, @09:24PM (#1158046)

          Javascript and other scripts can run outside of a browser. But then you have the much worse "WebAssembly" https://en.wikipedia.org/wiki/WebAssembly. [wikipedia.org]

          Best to run things in containers, if your hardware can support it.

          Or what I do- hang on to older computers so I don't have to sacrifice my main email / important stuff computer when trying things that could be trouble.

      • (Score: 2, Informative) by Anonymous Coward on Monday July 19, @08:00PM (1 child)

        by Anonymous Coward on Monday July 19, @08:00PM (#1158005)

        So CoX, Neverwinter Online, Champions Online, and Star Trek Online all have a client RDP server built in for admins to remotely access any clients, likely for cheating, but it had provisions for viewing the desktop, not just the game client, and for remote execution of commands.

        Yeah, that bad. And people are installing these things and then allowing them to demand root privileges while also having network access...

        • (Score: 2, Insightful) by Anonymous Coward on Tuesday July 20, @12:04AM

          by Anonymous Coward on Tuesday July 20, @12:04AM (#1158106)
          And some wonder why a few of us prefer consoles over PCs, the industry's over-zealous philosophies behind both anti-piracy AND anti-cheating measures are in direct-conflict with the security of my machine. I can weather a botched DRM locking up my PS5 but if my workstation goes....
      • (Score: 1, Funny) by Anonymous Coward on Monday July 19, @09:32PM

        by Anonymous Coward on Monday July 19, @09:32PM (#1158050)

        > much of it is some sicko voyeur somewhere

        But why would they want to spy on me, I'm only a hot blonde that likes to touch myself in front of the computer when nobody's connected on my Zoomies.

      • (Score: 2) by Reziac on Wednesday July 21, @12:27AM

        by Reziac (2489) on Wednesday July 21, @12:27AM (#1158528) Homepage

        That's an interesting point. I wonder how much "telemetry" winds up amusing the trolls at, oh, say, Kiwifarms??

    • (Score: 5, Insightful) by istartedi on Monday July 19, @05:38PM (4 children)

      by istartedi (123) on Monday July 19, @05:38PM (#1157957) Journal

      This is why my camera-equipped PC got a piece of black electrical tape over the camera the day I set it up. Even if all the software were Open Source, nobody has time and skills to audit all that. The community takes time to find it. For pennies, I can have the piece of mind that at least my junk won't show up on the web. It's too bad other data paths aren't so easy to secure.

      • (Score: 2) by Common Joe on Tuesday July 20, @09:03AM (3 children)

        I can have the piece of mind that at least my junk won't show up on the web. It's too bad other data paths aren't so easy to secure.

        Given the choice between someone seeing my junk and someone hearing what I have to say in private to my spouse or friends, I'd rather someone see my junk.

        • (Score: 2) by driverless on Tuesday July 20, @10:50AM (2 children)

          by driverless (4770) on Tuesday July 20, @10:50AM (#1158213)

          Given the choice between someone seeing my junk and someone hearing what I have to say in private to my spouse or friends, I'd rather someone see my junk.

          I've seen it and trust me, it's not that exciting, a bit like a penis, only smaller.

          And for fsck's sake change the default password on your webcam.

          • (Score: 3, Touché) by Common Joe on Tuesday July 20, @11:45AM (1 child)

            Er... I believe that was my point. It's not exciting. And the reason why my password is "12345" is because once government agents see what I'm offering, they're less inclined to listen to my microphone because they're being rushed to the ER. My password is actually a security feature.

            I'm very disappointed in you. This is SoylentNews for crying out loud. We don't come here for the pics. We come here to discuss relevant topics. Hack my microphone and then we can discuss something important like which episode of ST:TNG I watched last night or if my cat threw up again.

            • (Score: 2) by driverless on Tuesday July 20, @01:09PM

              by driverless (4770) on Tuesday July 20, @01:09PM (#1158238)

              Oh, you're not the guy whose password is "hunter2"? Sorry, my bad, I was referring to his junk, not yours.

    • (Score: 3, Interesting) by JoeMerchant on Monday July 19, @05:49PM

      by JoeMerchant (3937) on Monday July 19, @05:49PM (#1157961)

      I know for a fact that our desk phones at a particular company I worked for were capable of undetectable audio monitoring of any room they were in: no lights, no clicks, doesn't matter if the phone is in use or not.

      I also openly discussed that fact and other things you wouldn't say to the CEOs face in public, not to piss him off, but because A) they don't really have the wetware bandwidth to listen to every hour of noise in every mid level engineer's office, and B) anything they did hear they couldn't openly acknowledge hearing without acknowledging that they are listening to their employees covertly. Whether it's legal or not, that would be really bad for morale.

      They never acknowledged hearing anything that was said, if they ever did my response would have included the prepared phrase: "well, I'm honored that you think me worthy of listening to like that."

      --
      My karma ran over your dogma.
  • (Score: 0) by Anonymous Coward on Monday July 19, @05:01PM (1 child)

    by Anonymous Coward on Monday July 19, @05:01PM (#1157938)

    He's breaking all sorts of laws here. According to industry websites, his lawyers have already told him to shut up and not talk to anyone.

    • (Score: 1) by fustakrakich on Monday July 19, @05:27PM

      by fustakrakich (6150) on Monday July 19, @05:27PM (#1157953) Journal

      He's breaking all sorts of laws here.

      Yeah, re-transmitting a signal might be one of them.

      With all this spying going on, I have to wonder how many "National Security Letters" went out.

      --
      Ok, we paid the ransom. Do I get my dog back? REDЯUM
  • (Score: 4, Insightful) by Runaway1956 on Monday July 19, @05:11PM (3 children)

    by Runaway1956 (2926) Subscriber Badge on Monday July 19, @05:11PM (#1157943) Homepage Journal

    Just like Apple and Microsoft then, right?

    --
    Make an actual interesting, germane, and relevant point and you may get away with Flamebait - 'Zumi
    • (Score: 3, Informative) by JoeMerchant on Monday July 19, @05:52PM (1 child)

      by JoeMerchant (3937) on Monday July 19, @05:52PM (#1157963)

      Don't forget Google home and Amazon Alexa: eavesdropping and piping the audio to the cloud for AI speech recognition is the primary feature of the product.

      --
      My karma ran over your dogma.
      • (Score: 0) by Anonymous Coward on Monday July 19, @07:00PM

        by Anonymous Coward on Monday July 19, @07:00PM (#1157978)

        PLUS Google and Amazon get the id1ot5 to pay them for getting eavesdropped in their own homes! It is genius. Evil, but genius.

    • (Score: 1, Touché) by Anonymous Coward on Monday July 19, @05:54PM

      by Anonymous Coward on Monday July 19, @05:54PM (#1157964)

      They're smart enough to get you to click on an EULA first.

  • (Score: 4, Funny) by Rosco P. Coltrane on Monday July 19, @06:27PM (1 child)

    by Rosco P. Coltrane (4757) on Monday July 19, @06:27PM (#1157971)

    AM radio broadcasts, CB radio conversations

    I'm really worried that evil hackers might be listening in on those private conversations between Snowman and the Bandit across the internet.

    • (Score: 1, Funny) by Anonymous Coward on Monday July 19, @09:30PM

      by Anonymous Coward on Monday July 19, @09:30PM (#1158049)

      The Bears have their ears on.

  • (Score: 2, Interesting) by Anonymous Coward on Monday July 19, @07:43PM (2 children)

    by Anonymous Coward on Monday July 19, @07:43PM (#1157993)

    The backdoor lives on

    Xssfox said that access to the underlying computing device—and possibly other devices on the same network—happens as long as a setting called "console access" is turned on, as it is by default. Turning the access off requires a change to either the admin interface or a configuration file, which many users are unlikely to have made. Additionally, many devices are updated rarely, if ever. So even though the KiwiSDR developer has removed the offending code, the backdoor will live on in devices, making them vulnerable to takeover.

    • (Score: 0) by Anonymous Coward on Monday July 19, @08:41PM

      by Anonymous Coward on Monday July 19, @08:41PM (#1158030)

      Additionally, many devices are updated rarely, if ever. So even though the KiwiSDR developer has removed the offending code, the backdoor will live on in devices, making them vulnerable to takeover.

      That is very important and should have been included in the OP.

    • (Score: 0) by Anonymous Coward on Monday July 19, @09:39PM

      by Anonymous Coward on Monday July 19, @09:39PM (#1158054)

      Since they can get in with admin rights, maybe they should do a little admin and update everyone's shit for them.

  • (Score: -1, Troll) by Anonymous Coward on Monday July 19, @07:51PM

    by Anonymous Coward on Monday July 19, @07:51PM (#1157997)

    If they won't say who put the backdoor in, then chances are that a Jew did it. It's not like a Black man or Mexican would have the expertise to do so.

(1)