Fox News Flash top headlines for July 17
Fox News Flash top headlines are here. Check out what's clicking on Foxnews.com.
Researchers have found a “backdoor” in Chinese networking equipment that could allow anyone to access the devices with the right tools.
The devices’ vulnerabilities could allow virtually anyone to access the Telnet accounts of popular networking devices from Chinese companies C-Data and V-SOL, security researchers Pierre Kim and Alexandre Torres wrote in two advisories. Telnet is a protocol to access computer devices remotely.
The backdoor could give cybercriminals “complete administrator CLI access,” the researchers wrote, referring to Command Line Interface.
Known as Fiber to the Home (FTTH) Optical Line Termination (OLT) devices, the products are the “endpoint” that provide access to service providers on an optical network.
FTTH is now common, and many home users throughout the U.S. are plugged into these networks. These devices are also used in millions of networks globally.
The researchers found the security issues in software — known as firmware — running on two of the C-DATA devices and one of the V-SOL devices but they speculate the vulnerabilities could be present in dozens of other models.
“A hacker can intercept and modify the traffic from all the customers connected to these appliances and steal passwords sent in clear-text,” Kim told Fox News in an email.
Jayant Shukla, co-founder and CTO of K2 Cyber Security, said these vulnerabilities pose serious problems. “Having a backdoor into networking devices like these … is as serious a compromise as you can get,” Shukla told Fox News.
“Network devices are often accessible to attackers, since many are directly on the internet, and they are typically not secured very well,” he added. “The other issue is that networking devices do not get scrutinized very often for compromises or receive regular patches with the zeal that is typically used for servers and desktops.”
While it is not known what attackers, if any, would take advantage of this. The mere possibility of this happening also presents an opportunity for state-sponsored hackers.
AS FTC ISSUES FRESH WARNING, HERE ARE 5 COVID-19 SCAMS TO BE AWARE OF
“With backdoor access to the device, state actors can gain access to sensitive information passing through these devices. … They can also use these devices to launch attacks on the other parts of the network and wreak havoc [such as] shutting off or misconfiguring the device,” Shukla explained.
“Backdoors in equipment is a serious concern. We have seen this several times over the past years and they tend to be in cheaper equipment from smaller Chinese manufacturers," Lamar Bailey, director of security research and development at Tripwire, told Fox News.
C-Data posted a lengthy response on its website.
“C-Data admires the work of … Pierre Kim and Alexandre Torres, and thanks [them] for their identifying security breach problems through detailed testing," the company said in the statement.
The statement attributed some issues to “counterfeit” devices that are not made by C-Data but also recognized vulnerabilities in its devices. The company disputed, in some cases, the ability to remotely access the devices via a backdoor. The response also lists additional "measures to defend against cyber-attack" for customers.
Any vulnerabilities "should not be interpreted as C-Data intentionally left a backdoor," C-Data added.
Fox News has contacted C-Data and V-SOL for comment.
Get a daily look at what’s developing in science and technology throughout the world.