[greyface-]

The article doesn't disclose the value of "sys.rzadmin.password", but this writeup from 2022 does:

https://boschko.ca/tenda_ac1200_router/

Spoiler: it's "rzadmin". And it looks like there are a bunch of other goodies in the firmware, too.

[thibaut_barrere]

That backdoor is so up front about it. We might as well call it a frontdoor.

[Wololooo]

I mean, it's 99% sure this was supposed to be a debug feature...

[torginus]

I have done this accidentally at least once - we shipped a full-stack app, and telemetry started lighting up that on certain older phones and browsers (no points for guessing which brand and browser), the release version didn't load. The minifier did something in the release build that it didn't like.

So after a quick test, it was decided to deploy the debug version of just the frontend as a bandaid. Next day we saw we managed to deploy the debug version of the backend with admin stuff like this as well..

[pseudohadamard]

Did this too when I was working for a company that decided dongle-protecting their software was a good idea. We shipped with the protection check no-op'd out for, ah, debugging purposes and it never got re-enabled. Not really sure if it was by-accident-on-purpose or not.

[DaSHacka]

Whatever these happen it's 50/50 either an internal debugging feature used when designing the device or intended as a way for customer support to more easily help people.

I remember when a backdoor was discovered in the most popular brand of keylogging devices[0], likely added there in case someone forgot their password and reached out to support.

[0] https://old.reddit.com/r/cybersecurity/comments/jw6k5v/backd...

[JoshTriplett]

> Whatever these happen it's 50/50 either an internal debugging feature used when designing the device or intended as a way for customer support to more easily help people.

The problem with this is, everyone who builds an intentional backdoor will also claim that it's this.

Sufficiently advanced ignorance is indistinguishable from malice, and sometimes needs to be treated as if it were malice.

[SoftTalker]

> a way for customer support to more easily help people

This is my guess. People don't like it when a device they have turns into a brick of e-waste because they can't remember their password. So most consumer devices have either a "reset to defaults" feature or a hidden support password. Even enterprise routers and switches often have this.

[JoshTriplett]

> So most consumer devices have either a "reset to defaults" feature or a hidden support password.

One of those is sensible, and one is not. Put a recessed "hold to reset" button on the device, problem solved, no backdoor required or desired.

[rootatixww3]

and "accidentally" they forgot to disable it when releasing

[Wololooo]

Wouldn't be the first nor the last time someone is asked to ship something and it gets rushed through for reasons XYZ...

This being said makes the situation for an attacker awfully convenient...

[amarant]

Believe it or not, shit happens in the software business.

I know this from personal experience.

[rasz]

Enemy of the state:

- What did you think was going on?

Jack Black: Oh, I thought it was an STO.

- STO?

Jack Black: Standard Training Op.

[BloondAndDoom]

At that point it’s not even a back door it’s just stupid default root password kind of design which used to be standard in this kind of hardware. Backdoor would at least try to be subtle :)

[Asraelite]

Backdoors are often (almost always?) designed to look like incompetence so that there's plausible deniability.

[eth0up]

It's refreshing to see someone around here addressing the compulsively overlooked elephant in the room; plausible deniability. I am not implying it applies directly here, but notice the trend -- it's taboo to even speculate on and often gets rebuke for even hinting at it. The social convention around it is perfect cover. And I am not the only one that knows this. If we were to wake suddenly and realize the scale of relevance here, we'd probably all go full luddite. Call me paranoid though.

[Grombobulous]

If this wasn’t Tenda maybe I would be more inclined to agree with you. We are talking about an extremely shitty bargain basement vendor. The three stars on Amazon kind of router company.

I think sufficiently explained by incompetence over malice applies here. Some nefarious three letter agency having a backdoor like this is pretty pointless anyway.

Unless you’ve enabled remote management you can’t even get to this backdoor from a physical network perspective.

And then you change some router settings which really aren’t a magical access point into your devices in your home. My PC isn’t just going to magically allow you to browse the file system just because a malicious actor got on my local network. They can’t intercept anything moving over TLS.

Not saying it’s good to have that kind of access, but I think at the scale of “typical home network of consumer devices” the utility and blast radius is pretty limited. Go ahead and launch a DDOS attack on my printer and use up my ink cartridges, I guess.

[eth0up]

Well, as mentioned (but perhaps not with sufficient emphasis), I wasn’t implying that this case is necessarily some 3-letter agency op. However, things eg(*) CopyFail, XZ Utils / Jia Tan, Intel ME/IME, Heartbleed, Dirty COW, CVE‑2021‑3156, third‑party contractors, supply chains, and the myriad opportunities all around, are but a few examples that leave me cynical. I don’t claim detailed, expert understanding for any of these; however, I’m convinced the majority of such things remain unknown, and a that our perceived malice:incompetence ratio is off.

I think we could stop reflexively defaulting to “incompetence” when the end result just as easily resembles a deliberate exploit. Plausible deniability is an extremely effective cover when it’s smartly applied.

I’m not disputing any of your specific technical points; my cynicism is thematic. Even when I try to muzzle it, it tends to get through. The parent comment, though short, is dense with implications about cheap gear, opaque firmware, exposure surfaces I think deserve more sustained attention.

* A quick, generic, maybe sub-ideal list to harden my point.

[ktm5j]

That sounds like a fun thing to wonder about, but how could anyone possibly know that for sure?

[gunapologist99]

That's what makes it plausible deniability.

[lemagedurage]

Sounds like a convenience feature for a dev that they forgot to remove before distribution, since it's this poorly hidden.

[sph]

In computer security, never attribute to ignorance that which is adequately explained by malice.

[torginus]

Dunno, if I were to backdoor a piece of my code, I would definitely put in an exploit instead of a deliberate bypass.

Plausible deniability is important.

A lot of the stuff I worked on already had glaring issues like that without me having to add it..

[hnlmorg]

You’ve got the saying backwards:

“Never attribute to malice that which is adequately explained by stupidity.”

https://en.wikipedia.org/wiki/Hanlon%27s_razor

[jchw]

Pretty sure the point was to invert it. :)

[hnlmorg]

Yes, I got their point. My point is that’s the opposite of reality.

[naruhodo]

His point is that in security, the opposite applies. The supposed "incompetence" is just plausible deniability for a malicious act.

[jchw]

The main reason I assumed you didn't is because you linked to Hanlon's Razor and explained it in a way that made it seem like you didn't think the other person knew.

I think it's true to some extent that a lot of the backdoors really are just stupidity, like debugging tools put into prod for convenience. Rather than suggesting that it is genuine malice, maybe the right thing to say is that for security, it doesn't matter whether or not it is malice for most purposes. If it did, it would give more incentive to do as much as possible to disguise malicious backdoors as mistakes.

[UweSchmidt]

Maybe it's time to take a closer look at reality and correct this meme, which might casually blur the issue and deflect responsibility?

Looking at the IT security landscape we see every layer, every product category if not every product itself riddled with issues at one point or another. At the same time the incentives to put those security issues in are huge, and we know attackers work systematic, creative and persistent to introduce those weak points.

Security is hard and many bugs certainly happen due to mistakes, but I wouldn't assume that all of those security mishaps stem from an endless series of blunders from "stupid" programmers.

So I would go with “Never attribute to ignorance that which is adequately explained by malice.”

[psychoslave]

Looks like this time you interpreted the message in a malicious way.

[hnlmorg]

How? Neither their comment nor mine have anything malicious in their tone nor content.

[psychoslave]

Unfortunately, explaining a joke won’t make it funny afterward I guess.

[LargoLasskhyfv]

Somehow this reads like German to me. Because "rz" is a common abbreviation of RechenZentrum, meaning DataCenter.

So in English it would be like "dcadmin". Maybe they outsourced it to someone doing "gute Deutsche Wertarbeit", or it's a leftover from some agency having had their fun, or smoke&mirrors from whomever for whichever reasons.

[petee]

Nearly 4 years from last notification and the password is the same; either thats real incompetence, or a hilarious power move