Backdoor in Allwinner CPU kernel


Hey, we can do that too for the Pyra (not on kernel level, this is on software level), it goes like this:

Debian (as opposed to Devuan) has systemd. You see, you can start services just by probing a port. This is called: systemd socket activation. (this is not a new backdoor, the old inetd also has it; it is also disabled by default in Debian, and easy to enable/disable)

More information about it:
https://www.freedesktop.org/software/systemd/man/systemd.socket.html
http://0pointer.de/blog/projects/socket-activation.html

Now, what neat things can you do with it, you ask? For example:
https://leonardoce.wordpress.com/2015/03/08/systemd-socket-based-activation/
 
Hey, we can do that too for the Pyra (not on kernel level, this is on software level), it goes like this:

Debian (as opposed to Devuan) has systemd. You see, you can start services just by probing a port. This is called: systemd socket activation. (this is not a new backdoor, the old inetd also has it; it is also disabled by default in Debian, and easy to enable/disable)

More information about it:
https://www.freedesktop.org/software/systemd/man/systemd.socket.html
http://0pointer.de/blog/projects/socket-activation.html

Now, what neat things can you do with it, you ask? For example:
https://leonardoce.wordpress.com/2015/03/08/systemd-socket-based-activation/

Are you implying that it's a backdoor? You'd still need root access in order to start most services.
 
Are you implying that it's a backdoor? You'd still need root access in order to start most services.
well.. somebody needs to write the "undocumented debugging" feature first, of course... ;)

imagine an extra layer of protection: Pyra connected to the internet, sshd disabled. probe another port, start a small program. Send magic key, sshd is started, now you can sshd into the Pyra...
or connect to a port, which starts usb (with a camera connected, uses VLC (there is other software) to make a snapshot, receive picture... stop everything, stop usb).
Or server initiated backups... Pyra will be fun...
 
I was expecting stuff like NSA-put backdoors (well, China this time but you get my point) with how much you hear about that nowdays...
Still a rather nasty backdoor, though, with every application being able to gain root access trivially.
 
imagine an extra layer of protection: Pyra connected to the internet, sshd disabled. probe another port, start a small program. Send magic key, sshd is started, now you can sshd into the Pyra...
That's (a slight development on) port knocking, a pretty common obfuscation approach which I'd consider pretty much essential if I was running a public facing ssh server.
 
well.. somebody needs to write the "undocumented debugging" feature first, of course... ;)

imagine an extra layer of protection: Pyra connected to the internet, sshd disabled. probe another port, start a small program. Send magic key, sshd is started, now you can sshd into the Pyra...
or connect to a port, which starts usb (with a camera connected, uses VLC (there is other software) to make a snapshot, receive picture... stop everything, stop usb).
Or server initiated backups... Pyra will be fun...
If someone gets you to run their malicious code on your computer as root, you're screwed systemd or not. Any "vulnerability" that requires root access is not really a vulnerability, just one more thing to do on already compromised systems.
 
That's (a slight development on) port knocking, a pretty common obfuscation approach which I'd consider pretty much essential if I was running a public facing ssh server.

I'm not sure that this method would have any security advantages. An attacker would see that you just sent your magic key and then recognize the typical ssh fingerprint.
 
After reading this thread and other discussions and coverage I am starting to get a little concerned. The people that built my house put a backdoor in it.
That's why you built your house by yourself, so it's your own backdoor. (At least that's what I did)
 
And even if it was, this only applies to the allwinner custom kernel, but allwinner chips tend to be supported in mainline (eventually) in a much saner way.
 
That's why you built your house by yourself, so it's your own backdoor. (At least that's what I did)
I plan to, eventually. Funny thing is my plan does not allow for a back door, but it has nothing to do with security.
 
I'm not sure that this method would have any security advantages. An attacker would see that you just sent your magic key and then recognize the typical ssh fingerprint.
Yes, a MITM type attack would be able to see what you're doing. But anyone who's not already compromised your connectivity just will only see the 'knock' port open on port scanning you.

Note traditionally port knocking does not even ask for a secret, you can just ping the knock port to open up ssh. All it really does stop anyone who's scanning a large number of IP addresses for common ports from seeing you're running ssh externally.
 
When talking about Information Security, your supposed attacker is usually working at ISP or government level (or anything similar). If you can defend against this one, you can defend against any weaker attacker.
But if you really want to go full paranoia, you can configure sshd to function as a Tor hidden service.
 
I hope it's just a debugging function they forgot to remove. Still would be a very bad mistake.

I plan to, eventually. Funny thing is my plan does not allow for a back door, but it has nothing to do with security.
Almost everyone puts a standard lock in their door, very easy to by-pass.
 
Back
Top