For years, a backdoor in popular KiwiSDR product gave root to project developer:
KiwiSDR is hardware that uses a software-defined radio to monitor transmissions in a local area and stream them over the Internet. A largely hobbyist base of users does all kinds of cool things with the playing-card-sized devices. For instance, a user in Manhattan could connect one to the Internet so that people in Madrid, Spain, or Sydney, Australia, could listen to AM radio broadcasts, CB radio conversations, or even watch lightning storms in Manhattan.
On Wednesday, users learned that for years, their devices had been equipped with a backdoor that allowed the KiwiSDR creator—and possibly others—to log in to the devices with administrative system rights. The remote admin could then make configuration changes and access data not just for the KiwiSDR but in many cases to the Raspberry Pi, BeagleBone Black, or other computing devices the SDR hardware is connected to.
(Score: 4, Insightful) by weilawei on Monday July 19 2021, @04:56PM (13 children)
(Score: 4, Interesting) by RS3 on Monday July 19 2021, @05:16PM (6 children)
Thank you. That's been my view of much of the spying / monitoring / "phone home" / "telemetry" - much of it is some sicko voyeur somewhere.
I'll give that as an engineer / product developer, I'd love to know more about how / where / why / what is being done with my product, because I like "agile" iterative development, improving, refining. But I could never put "backdoors" or any kind of spying in something and feel okay about it. I'm more apt to offer people beta tester status, and some kind of reward, but it'd all be open negotiation.
(Score: 1) by fustakrakich on Monday July 19 2021, @06:05PM (1 child)
By now it must be possible to send back an "executable" through the telemetry
La politica e i criminali sono la stessa cosa..
(Score: 2) by RS3 on Monday July 19 2021, @09:24PM
Javascript and other scripts can run outside of a browser. But then you have the much worse "WebAssembly" https://en.wikipedia.org/wiki/WebAssembly. [wikipedia.org]
Best to run things in containers, if your hardware can support it.
Or what I do- hang on to older computers so I don't have to sacrifice my main email / important stuff computer when trying things that could be trouble.
(Score: 2, Informative) by Anonymous Coward on Monday July 19 2021, @08:00PM (1 child)
So CoX, Neverwinter Online, Champions Online, and Star Trek Online all have a client RDP server built in for admins to remotely access any clients, likely for cheating, but it had provisions for viewing the desktop, not just the game client, and for remote execution of commands.
Yeah, that bad. And people are installing these things and then allowing them to demand root privileges while also having network access...
(Score: 2, Insightful) by Anonymous Coward on Tuesday July 20 2021, @12:04AM
(Score: 1, Funny) by Anonymous Coward on Monday July 19 2021, @09:32PM
> much of it is some sicko voyeur somewhere
But why would they want to spy on me, I'm only a hot blonde that likes to touch myself in front of the computer when nobody's connected on my Zoomies.
(Score: 2) by Reziac on Wednesday July 21 2021, @12:27AM
That's an interesting point. I wonder how much "telemetry" winds up amusing the trolls at, oh, say, Kiwifarms??
And there is no Alkibiades to come back and save us from ourselves.
(Score: 5, Insightful) by istartedi on Monday July 19 2021, @05:38PM (4 children)
This is why my camera-equipped PC got a piece of black electrical tape over the camera the day I set it up. Even if all the software were Open Source, nobody has time and skills to audit all that. The community takes time to find it. For pennies, I can have the piece of mind that at least my junk won't show up on the web. It's too bad other data paths aren't so easy to secure.
Appended to the end of comments you post. Max: 120 chars.
(Score: 2) by Common Joe on Tuesday July 20 2021, @09:03AM (3 children)
Given the choice between someone seeing my junk and someone hearing what I have to say in private to my spouse or friends, I'd rather someone see my junk.
(Score: 2) by driverless on Tuesday July 20 2021, @10:50AM (2 children)
I've seen it and trust me, it's not that exciting, a bit like a penis, only smaller.
And for fsck's sake change the default password on your webcam.
(Score: 3, Touché) by Common Joe on Tuesday July 20 2021, @11:45AM (1 child)
Er... I believe that was my point. It's not exciting. And the reason why my password is "12345" is because once government agents see what I'm offering, they're less inclined to listen to my microphone because they're being rushed to the ER. My password is actually a security feature.
I'm very disappointed in you. This is SoylentNews for crying out loud. We don't come here for the pics. We come here to discuss relevant topics. Hack my microphone and then we can discuss something important like which episode of ST:TNG I watched last night or if my cat threw up again.
(Score: 2) by driverless on Tuesday July 20 2021, @01:09PM
Oh, you're not the guy whose password is "hunter2"? Sorry, my bad, I was referring to his junk, not yours.
(Score: 3, Interesting) by JoeMerchant on Monday July 19 2021, @05:49PM
I know for a fact that our desk phones at a particular company I worked for were capable of undetectable audio monitoring of any room they were in: no lights, no clicks, doesn't matter if the phone is in use or not.
I also openly discussed that fact and other things you wouldn't say to the CEOs face in public, not to piss him off, but because A) they don't really have the wetware bandwidth to listen to every hour of noise in every mid level engineer's office, and B) anything they did hear they couldn't openly acknowledge hearing without acknowledging that they are listening to their employees covertly. Whether it's legal or not, that would be really bad for morale.
They never acknowledged hearing anything that was said, if they ever did my response would have included the prepared phrase: "well, I'm honored that you think me worthy of listening to like that."
🌻🌻 [google.com]
(Score: 0) by Anonymous Coward on Monday July 19 2021, @05:01PM (1 child)
He's breaking all sorts of laws here. According to industry websites, his lawyers have already told him to shut up and not talk to anyone.
(Score: 1) by fustakrakich on Monday July 19 2021, @05:27PM
Yeah, re-transmitting a signal might be one of them.
With all this spying going on, I have to wonder how many "National Security Letters" went out.
La politica e i criminali sono la stessa cosa..
(Score: 4, Insightful) by Runaway1956 on Monday July 19 2021, @05:11PM (3 children)
Just like Apple and Microsoft then, right?
(Score: 3, Informative) by JoeMerchant on Monday July 19 2021, @05:52PM (1 child)
Don't forget Google home and Amazon Alexa: eavesdropping and piping the audio to the cloud for AI speech recognition is the primary feature of the product.
🌻🌻 [google.com]
(Score: 0) by Anonymous Coward on Monday July 19 2021, @07:00PM
PLUS Google and Amazon get the id1ot5 to pay them for getting eavesdropped in their own homes! It is genius. Evil, but genius.
(Score: 1, Touché) by Anonymous Coward on Monday July 19 2021, @05:54PM
They're smart enough to get you to click on an EULA first.
(Score: 4, Funny) by Rosco P. Coltrane on Monday July 19 2021, @06:27PM (1 child)
I'm really worried that evil hackers might be listening in on those private conversations between Snowman and the Bandit across the internet.
(Score: 1, Funny) by Anonymous Coward on Monday July 19 2021, @09:30PM
The Bears have their ears on.
(Score: 2, Interesting) by Anonymous Coward on Monday July 19 2021, @07:43PM (2 children)
(Score: 0) by Anonymous Coward on Monday July 19 2021, @08:41PM
That is very important and should have been included in the OP.
(Score: 0) by Anonymous Coward on Monday July 19 2021, @09:39PM
Since they can get in with admin rights, maybe they should do a little admin and update everyone's shit for them.
(Score: -1, Troll) by Anonymous Coward on Monday July 19 2021, @07:51PM
If they won't say who put the backdoor in, then chances are that a Jew did it. It's not like a Black man or Mexican would have the expertise to do so.