Walmart Exclusive Wi-Fi Router Contains Backdoor to Control Devices(hfet.org)
hfet.org
Walmart Exclusive Wi-Fi Router Contains Backdoor to Control Devices
https://hfet.org/walmart-exclusive-wi-fi-router-contains-backdoor-to-control-devices/
13 comments
Here's their source, which actually contains details: https://cybernews.com/security/walmart-exclusive-routers-oth...
and the source's source https://james-clee.com/2020/04/23/more-information-disclosur...
That original research only looked at one Wavlink router. This is the extended research with the help of two other researchers. And of course the attempted exploit from a malicious IP address which was detected only recently
All the (three?) articles about this gloss over whether/how this is remotely exploitable or whether you need to be on the local network. This would seem to be evidence that it is:
> Basically, the first IP address you see there – 222.141.xx.xxx, which comes from China – was trying to upload a malicious file on the router using the vulnerabilities.
Since when does a router respond to the whole world on port 80 by default?
> Basically, the first IP address you see there – 222.141.xx.xxx, which comes from China – was trying to upload a malicious file on the router using the vulnerabilities.
Since when does a router respond to the whole world on port 80 by default?
I don't really like the way cybernews [0] is pushing the malicious narrative. There's a fairly large gap from "there is a security exploit being used in the wild" to "this exploit was intentional." This seems much more like the software equivalent of Chinesium.
This really reeks of corner-cutting and negligence. The only way around corner-cutting is to make it expensive and make "doing it right" the cheapest, most profitable way to build something. We can do that with hefty fines for retailers selling this garbage (I think there needs to be more onus on domestic businesses shoveling shit without smelling it first) and creating open hardware/software stacks that are easy to put in a box and sell for $20 on Amazon without hiring any software developers that could screw it up.
[0] https://cybernews.com/security/walmart-exclusive-routers-oth...
This really reeks of corner-cutting and negligence. The only way around corner-cutting is to make it expensive and make "doing it right" the cheapest, most profitable way to build something. We can do that with hefty fines for retailers selling this garbage (I think there needs to be more onus on domestic businesses shoveling shit without smelling it first) and creating open hardware/software stacks that are easy to put in a box and sell for $20 on Amazon without hiring any software developers that could screw it up.
[0] https://cybernews.com/security/walmart-exclusive-routers-oth...
Damn I just bought the AX1500 from Walmart ugh
https://news.ycombinator.com/item?id=25186843