Backdoor in Allwinner CPU kernel


FBnil

I promise to cut my personal CO2 emissions by 2060
Joined
Dec 14, 2012
Messages
4,444
Location
Yurp
Hey, we can do that too for the Pyra (not on kernel level, this is on software level), it goes like this:

Debian (as opposed to Devuan) has systemd. You see, you can start services just by probing a port. This is called: systemd socket activation. (this is not a new backdoor, the old inetd also has it; it is also disabled by default in Debian, and easy to enable/disable)

More information about it:
https://www.freedesktop.org/software/systemd/man/systemd.socket.html
http://0pointer.de/blog/projects/socket-activation.html

Now, what neat things can you do with it, you ask? For example:
https://leonardoce.wordpress.com/2015/03/08/systemd-socket-based-activation/
 

tigerroast

YOUNG VORHEES
Joined
Apr 22, 2016
Messages
258
Location
Big Bertha, LA.
Hey, we can do that too for the Pyra (not on kernel level, this is on software level), it goes like this:

Debian (as opposed to Devuan) has systemd. You see, you can start services just by probing a port. This is called: systemd socket activation. (this is not a new backdoor, the old inetd also has it; it is also disabled by default in Debian, and easy to enable/disable)

More information about it:
https://www.freedesktop.org/software/systemd/man/systemd.socket.html
http://0pointer.de/blog/projects/socket-activation.html

Now, what neat things can you do with it, you ask? For example:
https://leonardoce.wordpress.com/2015/03/08/systemd-socket-based-activation/

Are you implying that it's a backdoor? You'd still need root access in order to start most services.
 

FBnil

I promise to cut my personal CO2 emissions by 2060
Joined
Dec 14, 2012
Messages
4,444
Location
Yurp
Are you implying that it's a backdoor? You'd still need root access in order to start most services.
well.. somebody needs to write the "undocumented debugging" feature first, of course... ;)

imagine an extra layer of protection: Pyra connected to the internet, sshd disabled. probe another port, start a small program. Send magic key, sshd is started, now you can sshd into the Pyra...
or connect to a port, which starts usb (with a camera connected, uses VLC (there is other software) to make a snapshot, receive picture... stop everything, stop usb).
Or server initiated backups... Pyra will be fun...
 

FIQ

Member
Joined
Apr 1, 2014
Messages
96
I was expecting stuff like NSA-put backdoors (well, China this time but you get my point) with how much you hear about that nowdays...
Still a rather nasty backdoor, though, with every application being able to gain root access trivially.
 

levi

Still fresh, damnit!
Joined
Oct 6, 2008
Messages
14,963
Location
Somewhere off the coast of the EU
imagine an extra layer of protection: Pyra connected to the internet, sshd disabled. probe another port, start a small program. Send magic key, sshd is started, now you can sshd into the Pyra...
That's (a slight development on) port knocking, a pretty common obfuscation approach which I'd consider pretty much essential if I was running a public facing ssh server.
 

bzar

A Commando
Joined
Sep 22, 2008
Messages
4,494
Location
Finland
Website
Visit site
well.. somebody needs to write the "undocumented debugging" feature first, of course... ;)

imagine an extra layer of protection: Pyra connected to the internet, sshd disabled. probe another port, start a small program. Send magic key, sshd is started, now you can sshd into the Pyra...
or connect to a port, which starts usb (with a camera connected, uses VLC (there is other software) to make a snapshot, receive picture... stop everything, stop usb).
Or server initiated backups... Pyra will be fun...
If someone gets you to run their malicious code on your computer as root, you're screwed systemd or not. Any "vulnerability" that requires root access is not really a vulnerability, just one more thing to do on already compromised systems.
 

Plume

Member
Joined
Sep 21, 2015
Messages
121
That's (a slight development on) port knocking, a pretty common obfuscation approach which I'd consider pretty much essential if I was running a public facing ssh server.

I'm not sure that this method would have any security advantages. An attacker would see that you just sent your magic key and then recognize the typical ssh fingerprint.
 

mclien

Very Active Member
Joined
Mar 22, 2012
Messages
486
Location
Hannover
After reading this thread and other discussions and coverage I am starting to get a little concerned. The people that built my house put a backdoor in it.
That's why you built your house by yourself, so it's your own backdoor. (At least that's what I did)
 

valhalla

Member
Joined
Jul 17, 2008
Messages
305
And even if it was, this only applies to the allwinner custom kernel, but allwinner chips tend to be supported in mainline (eventually) in a much saner way.
 

rygD

Nihilistic Mystic
Joined
Feb 28, 2014
Messages
7,526
Location
Everywhere
That's why you built your house by yourself, so it's your own backdoor. (At least that's what I did)
I plan to, eventually. Funny thing is my plan does not allow for a back door, but it has nothing to do with security.
 

levi

Still fresh, damnit!
Joined
Oct 6, 2008
Messages
14,963
Location
Somewhere off the coast of the EU
I'm not sure that this method would have any security advantages. An attacker would see that you just sent your magic key and then recognize the typical ssh fingerprint.
Yes, a MITM type attack would be able to see what you're doing. But anyone who's not already compromised your connectivity just will only see the 'knock' port open on port scanning you.

Note traditionally port knocking does not even ask for a secret, you can just ping the knock port to open up ssh. All it really does stop anyone who's scanning a large number of IP addresses for common ports from seeing you're running ssh externally.
 

Plume

Member
Joined
Sep 21, 2015
Messages
121
When talking about Information Security, your supposed attacker is usually working at ISP or government level (or anything similar). If you can defend against this one, you can defend against any weaker attacker.
But if you really want to go full paranoia, you can configure sshd to function as a Tor hidden service.
 

TeDaDeS

Advanced Member
Joined
Jan 15, 2004
Messages
1,269
Location
The Netherlands
Website
Visit site
I hope it's just a debugging function they forgot to remove. Still would be a very bad mistake.

I plan to, eventually. Funny thing is my plan does not allow for a back door, but it has nothing to do with security.
Almost everyone puts a standard lock in their door, very easy to by-pass.
 
Top