SoylentNews is people
SoylentNews
For years, a backdoor in popular KiwiSDR product gave root to project developer:
KiwiSDR is hardware that uses a software-defined radio to monitor transmissions in a local area and stream them over the Internet. A largely hobbyist base of users does all kinds of cool things with the playing-card-sized devices. For instance, a user in Manhattan could connect one to the Internet so that people in Madrid, Spain, or Sydney, Australia, could listen to AM radio broadcasts, CB radio conversations, or even watch lightning storms in Manhattan.
On Wednesday, users learned that for years, their devices had been equipped with a backdoor that allowed the KiwiSDR creator—and possibly others—to log in to the devices with administrative system rights. The remote admin could then make configuration changes and access data not just for the KiwiSDR but in many cases to the Raspberry Pi, BeagleBone Black, or other computing devices the SDR hardware is connected to.
(Score: 4, Interesting) by RS3 on Monday July 19 2021, @05:16PM (6 children)
Thank you. That's been my view of much of the spying / monitoring / "phone home" / "telemetry" - much of it is some sicko voyeur somewhere.
I'll give that as an engineer / product developer, I'd love to know more about how / where / why / what is being done with my product, because I like "agile" iterative development, improving, refining. But I could never put "backdoors" or any kind of spying in something and feel okay about it. I'm more apt to offer people beta tester status, and some kind of reward, but it'd all be open negotiation.
(Score: 1) by fustakrakich on Monday July 19 2021, @06:05PM (1 child)
By now it must be possible to send back an "executable" through the telemetry
La politica e i criminali sono la stessa cosa..
(Score: 2) by RS3 on Monday July 19 2021, @09:24PM
Javascript and other scripts can run outside of a browser. But then you have the much worse "WebAssembly" https://en.wikipedia.org/wiki/WebAssembly. [wikipedia.org]
Best to run things in containers, if your hardware can support it.
Or what I do- hang on to older computers so I don't have to sacrifice my main email / important stuff computer when trying things that could be trouble.
(Score: 2, Informative) by Anonymous Coward on Monday July 19 2021, @08:00PM (1 child)
So CoX, Neverwinter Online, Champions Online, and Star Trek Online all have a client RDP server built in for admins to remotely access any clients, likely for cheating, but it had provisions for viewing the desktop, not just the game client, and for remote execution of commands.
Yeah, that bad. And people are installing these things and then allowing them to demand root privileges while also having network access...
(Score: 2, Insightful) by Anonymous Coward on Tuesday July 20 2021, @12:04AM
(Score: 1, Funny) by Anonymous Coward on Monday July 19 2021, @09:32PM
> much of it is some sicko voyeur somewhere
But why would they want to spy on me, I'm only a hot blonde that likes to touch myself in front of the computer when nobody's connected on my Zoomies.
(Score: 2) by Reziac on Wednesday July 21 2021, @12:27AM
That's an interesting point. I wonder how much "telemetry" winds up amusing the trolls at, oh, say, Kiwifarms??
And there is no Alkibiades to come back and save us from ourselves.