Linux-SWAT
Forum Addict!
- Joined
- Feb 13, 2010
- Messages
- 9,188
Backdoor in Allwinner CPU kernel
- Thread starter Linux-SWAT
- Start date
Hey, we can do that too for the Pyra (not on kernel level, this is on software level), it goes like this:
Debian (as opposed to Devuan) has systemd. You see, you can start services just by probing a port. This is called: systemd socket activation. (this is not a new backdoor, the old inetd also has it; it is also disabled by default in Debian, and easy to enable/disable)
More information about it:
https://www.freedesktop.org/software/systemd/man/systemd.socket.html
http://0pointer.de/blog/projects/socket-activation.html
Now, what neat things can you do with it, you ask? For example:
https://leonardoce.wordpress.com/2015/03/08/systemd-socket-based-activation/
Debian (as opposed to Devuan) has systemd. You see, you can start services just by probing a port. This is called: systemd socket activation. (this is not a new backdoor, the old inetd also has it; it is also disabled by default in Debian, and easy to enable/disable)
More information about it:
https://www.freedesktop.org/software/systemd/man/systemd.socket.html
http://0pointer.de/blog/projects/socket-activation.html
Now, what neat things can you do with it, you ask? For example:
https://leonardoce.wordpress.com/2015/03/08/systemd-socket-based-activation/
levi
Still fresh, damnit!
That's not a backdoor, that's a feature 
tigerroast
YOUNG VORHEES
Are you implying that it's a backdoor? You'd still need root access in order to start most services.
well.. somebody needs to write the "undocumented debugging" feature first, of course...
imagine an extra layer of protection: Pyra connected to the internet, sshd disabled. probe another port, start a small program. Send magic key, sshd is started, now you can sshd into the Pyra...
or connect to a port, which starts usb (with a camera connected, uses VLC (there is other software) to make a snapshot, receive picture... stop everything, stop usb).
Or server initiated backups... Pyra will be fun...
rygD
Nihilistic Mystic
After reading this thread and other discussions and coverage I am starting to get a little concerned. The people that built my house put a backdoor in it.
Last edited:
levi
Still fresh, damnit!
That's (a slight development on) port knocking, a pretty common obfuscation approach which I'd consider pretty much essential if I was running a public facing ssh server.
bzar
A Commando
If someone gets you to run their malicious code on your computer as root, you're screwed systemd or not. Any "vulnerability" that requires root access is not really a vulnerability, just one more thing to do on already compromised systems.well.. somebody needs to write the "undocumented debugging" feature first, of course...
imagine an extra layer of protection: Pyra connected to the internet, sshd disabled. probe another port, start a small program. Send magic key, sshd is started, now you can sshd into the Pyra...
or connect to a port, which starts usb (with a camera connected, uses VLC (there is other software) to make a snapshot, receive picture... stop everything, stop usb).
Or server initiated backups... Pyra will be fun...
I'm not sure that this method would have any security advantages. An attacker would see that you just sent your magic key and then recognize the typical ssh fingerprint.
That's why you built your house by yourself, so it's your own backdoor. (At least that's what I did)
comradekingu
Glowing ember
If this is true, it might be the best thing allwinner could do for the GPL license.
comradekingu
Glowing ember
It is a potential but non-option for pyra CPU upgrades.
rygD
Nihilistic Mystic
I plan to, eventually. Funny thing is my plan does not allow for a back door, but it has nothing to do with security.
levi
Still fresh, damnit!
Yes, a MITM type attack would be able to see what you're doing. But anyone who's not already compromised your connectivity just will only see the 'knock' port open on port scanning you.
Note traditionally port knocking does not even ask for a secret, you can just ping the knock port to open up ssh. All it really does stop anyone who's scanning a large number of IP addresses for common ports from seeing you're running ssh externally.
When talking about Information Security, your supposed attacker is usually working at ISP or government level (or anything similar). If you can defend against this one, you can defend against any weaker attacker.
But if you really want to go full paranoia, you can configure sshd to function as a Tor hidden service.
But if you really want to go full paranoia, you can configure sshd to function as a Tor hidden service.
TeDaDeS
Forum Addict!
I hope it's just a debugging function they forgot to remove. Still would be a very bad mistake.
Almost everyone puts a standard lock in their door, very easy to by-pass.
Similar threads
