SoylentNews is people
SoylentNews
For years, a backdoor in popular KiwiSDR product gave root to project developer:
KiwiSDR is hardware that uses a software-defined radio to monitor transmissions in a local area and stream them over the Internet. A largely hobbyist base of users does all kinds of cool things with the playing-card-sized devices. For instance, a user in Manhattan could connect one to the Internet so that people in Madrid, Spain, or Sydney, Australia, could listen to AM radio broadcasts, CB radio conversations, or even watch lightning storms in Manhattan.
On Wednesday, users learned that for years, their devices had been equipped with a backdoor that allowed the KiwiSDR creator—and possibly others—to log in to the devices with administrative system rights. The remote admin could then make configuration changes and access data not just for the KiwiSDR but in many cases to the Raspberry Pi, BeagleBone Black, or other computing devices the SDR hardware is connected to.
(Score: 4, Insightful) by weilawei on Monday July 19 2021, @04:56PM (13 children)
(Score: 4, Interesting) by RS3 on Monday July 19 2021, @05:16PM (6 children)
Thank you. That's been my view of much of the spying / monitoring / "phone home" / "telemetry" - much of it is some sicko voyeur somewhere.
I'll give that as an engineer / product developer, I'd love to know more about how / where / why / what is being done with my product, because I like "agile" iterative development, improving, refining. But I could never put "backdoors" or any kind of spying in something and feel okay about it. I'm more apt to offer people beta tester status, and some kind of reward, but it'd all be open negotiation.
(Score: 1) by fustakrakich on Monday July 19 2021, @06:05PM (1 child)
By now it must be possible to send back an "executable" through the telemetry
La politica e i criminali sono la stessa cosa..
(Score: 2) by RS3 on Monday July 19 2021, @09:24PM
Javascript and other scripts can run outside of a browser. But then you have the much worse "WebAssembly" https://en.wikipedia.org/wiki/WebAssembly. [wikipedia.org]
Best to run things in containers, if your hardware can support it.
Or what I do- hang on to older computers so I don't have to sacrifice my main email / important stuff computer when trying things that could be trouble.
(Score: 2, Informative) by Anonymous Coward on Monday July 19 2021, @08:00PM (1 child)
So CoX, Neverwinter Online, Champions Online, and Star Trek Online all have a client RDP server built in for admins to remotely access any clients, likely for cheating, but it had provisions for viewing the desktop, not just the game client, and for remote execution of commands.
Yeah, that bad. And people are installing these things and then allowing them to demand root privileges while also having network access...
(Score: 2, Insightful) by Anonymous Coward on Tuesday July 20 2021, @12:04AM
(Score: 1, Funny) by Anonymous Coward on Monday July 19 2021, @09:32PM
> much of it is some sicko voyeur somewhere
But why would they want to spy on me, I'm only a hot blonde that likes to touch myself in front of the computer when nobody's connected on my Zoomies.
(Score: 2) by Reziac on Wednesday July 21 2021, @12:27AM
That's an interesting point. I wonder how much "telemetry" winds up amusing the trolls at, oh, say, Kiwifarms??
And there is no Alkibiades to come back and save us from ourselves.
(Score: 5, Insightful) by istartedi on Monday July 19 2021, @05:38PM (4 children)
This is why my camera-equipped PC got a piece of black electrical tape over the camera the day I set it up. Even if all the software were Open Source, nobody has time and skills to audit all that. The community takes time to find it. For pennies, I can have the piece of mind that at least my junk won't show up on the web. It's too bad other data paths aren't so easy to secure.
Appended to the end of comments you post. Max: 120 chars.
(Score: 2) by Common Joe on Tuesday July 20 2021, @09:03AM (3 children)
Given the choice between someone seeing my junk and someone hearing what I have to say in private to my spouse or friends, I'd rather someone see my junk.
(Score: 2) by driverless on Tuesday July 20 2021, @10:50AM (2 children)
I've seen it and trust me, it's not that exciting, a bit like a penis, only smaller.
And for fsck's sake change the default password on your webcam.
(Score: 3, Touché) by Common Joe on Tuesday July 20 2021, @11:45AM (1 child)
Er... I believe that was my point. It's not exciting. And the reason why my password is "12345" is because once government agents see what I'm offering, they're less inclined to listen to my microphone because they're being rushed to the ER. My password is actually a security feature.
I'm very disappointed in you. This is SoylentNews for crying out loud. We don't come here for the pics. We come here to discuss relevant topics. Hack my microphone and then we can discuss something important like which episode of ST:TNG I watched last night or if my cat threw up again.
(Score: 2) by driverless on Tuesday July 20 2021, @01:09PM
Oh, you're not the guy whose password is "hunter2"? Sorry, my bad, I was referring to his junk, not yours.
(Score: 3, Interesting) by JoeMerchant on Monday July 19 2021, @05:49PM
I know for a fact that our desk phones at a particular company I worked for were capable of undetectable audio monitoring of any room they were in: no lights, no clicks, doesn't matter if the phone is in use or not.
I also openly discussed that fact and other things you wouldn't say to the CEOs face in public, not to piss him off, but because A) they don't really have the wetware bandwidth to listen to every hour of noise in every mid level engineer's office, and B) anything they did hear they couldn't openly acknowledge hearing without acknowledging that they are listening to their employees covertly. Whether it's legal or not, that would be really bad for morale.
They never acknowledged hearing anything that was said, if they ever did my response would have included the prepared phrase: "well, I'm honored that you think me worthy of listening to like that."
🌻🌻 [google.com]