Incident: Backdoor Vulnerabilities in Chinese Networking Equipment Lead to Security Breach

Published Date: 2020-07-17

Postmortem Analysis
Timeline 1. The software failure incident of the "backdoor" in Chinese networking equipment allowing unauthorized access to Telnet accounts happened around July 2020. [Article 102827]
System 1. C-Data and V-SOL Fiber to the Home (FTTH) Optical Line Termination (OLT) devices 2. Firmware running on two C-Data devices and one V-SOL device 3. Telnet accounts of popular networking devices from C-Data and V-SOL 4. Software vulnerabilities in networking devices 5. Counterfeit devices not made by C-Data 6. Backdoor access to networking devices
Responsible Organization 1. Security researchers Pierre Kim and Alexandre Torres identified the backdoor vulnerability in Chinese networking equipment [102827]. 2. C-Data and V-SOL, the Chinese companies manufacturing the vulnerable networking devices, were responsible for the software failure incident [102827].
Impacted Organization 1. Home users throughout the U.S. and globally who are plugged into Fiber to the Home (FTTH) networks [102827].
Software Causes 1. The software causes of the failure incident were vulnerabilities found in the firmware running on two C-DATA devices and one V-SOL device, allowing unauthorized access to Telnet accounts and complete administrator CLI access [102827].
Non-software Causes 1. Counterfeit devices not made by C-Data were identified as a cause of some issues [102827].
Impacts 1. The software failure incident allowed virtually anyone to access the Telnet accounts of popular networking devices from Chinese companies C-Data and V-SOL, potentially giving cybercriminals complete administrator CLI access [102827]. 2. The vulnerabilities in the software running on the devices could enable hackers to intercept and modify traffic from all customers connected to these appliances, potentially leading to the theft of passwords sent in clear-text [102827]. 3. State-sponsored hackers could exploit the backdoor access to gain sensitive information passing through these devices, launch attacks on other parts of the network, and cause disruptions such as shutting off or misconfiguring the devices [102827]. 4. The incident raised concerns about the security of networking devices, as they are often directly accessible from the internet and may not receive regular patches or security scrutiny compared to servers and desktops [102827]. 5. The software failure incident highlighted the serious compromise posed by having a backdoor into networking devices like the ones affected, emphasizing the need for robust cybersecurity measures in such critical infrastructure [102827].
Preventions 1. Implementing secure coding practices during the development of the firmware running on the networking devices could have prevented the software failure incident [102827]. 2. Regular security audits and penetration testing of the networking devices' firmware to identify and address vulnerabilities before they are exploited by malicious actors could have helped prevent the incident [102827]. 3. Ensuring timely software updates and patches for the firmware of the networking devices to address any discovered vulnerabilities could have mitigated the risk of unauthorized access through backdoors [102827]. 4. Conducting thorough security assessments of third-party components and software integrated into the networking devices to prevent the introduction of potential vulnerabilities could have been a preventive measure [102827].
Fixes 1. Patching the firmware running on the affected C-Data and V-SOL devices to address the security issues identified by the researchers [102827]. 2. Implementing stronger security measures on networking devices to prevent unauthorized access, such as enforcing secure password practices and encryption protocols. 3. Regularly scrutinizing networking devices for compromises and ensuring they receive timely security patches to address vulnerabilities. 4. Conducting thorough testing and security assessments on networking equipment to identify and mitigate potential backdoors or vulnerabilities. 5. Enhancing network security practices to detect and prevent unauthorized access or malicious activities on the network.
References 1. Security researchers Pierre Kim and Alexandre Torres [102827] 2. Jayant Shukla, co-founder and CTO of K2 Cyber Security [102827] 3. Lamar Bailey, director of security research and development at Tripwire [102827]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to a backdoor in Chinese networking equipment has happened again at C-Data and V-SOL. The vulnerabilities were found in the firmware running on two C-Data devices and one V-SOL device, but it is speculated that similar vulnerabilities could be present in dozens of other models [102827]. C-Data posted a response acknowledging the vulnerabilities in its devices and providing additional measures to defend against cyber-attacks [102827]. (b) The software failure incident involving a backdoor in networking devices is a recurring issue in the industry. Lamar Bailey, director of security research and development at Tripwire, mentioned that backdoors in equipment, particularly in cheaper equipment from smaller Chinese manufacturers, have been seen several times over the past years [102827]. This indicates that similar incidents have occurred at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the discovery of a "backdoor" in Chinese networking equipment by security researchers Pierre Kim and Alexandre Torres. The vulnerabilities found in the Telnet accounts of popular networking devices from Chinese companies C-Data and V-SOL were due to security issues in the software (firmware) running on these devices [102827]. (b) The software failure incident related to the operation phase is highlighted by the fact that the backdoor discovered in the networking devices could allow cybercriminals to have complete administrator CLI access. This poses a serious problem as network devices like these are often directly accessible on the internet and are typically not secured very well. The vulnerabilities could potentially allow hackers to intercept and modify traffic from connected customers, steal passwords sent in clear-text, and even launch attacks on other parts of the network [102827].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident in the articles is related to a "backdoor" found in Chinese networking equipment, specifically in the firmware running on devices from C-Data and V-SOL. Security researchers identified vulnerabilities that could allow unauthorized access to Telnet accounts on these networking devices, potentially leading to cybercriminals gaining complete administrator CLI access [102827]. (b) outside_system: The software failure incident also involves external factors as the vulnerabilities were found in the software (firmware) running on the networking devices. The potential risks associated with these vulnerabilities include the interception and modification of traffic, stealing passwords sent in clear-text, and the possibility of state-sponsored hackers gaining access to sensitive information passing through these devices [102827].
Nature (Human/Non-human) non-human_actions (a) The software failure incident in this case is related to non-human actions. Researchers discovered a "backdoor" in Chinese networking equipment that could allow unauthorized access to the devices, potentially leading to cybercriminals gaining complete administrator CLI access [102827]. The vulnerabilities were found in the firmware running on the devices, indicating a flaw in the software itself rather than being directly caused by human actions.
Dimension (Hardware/Software) hardware, software (a) The software failure incident reported in the articles is primarily related to hardware vulnerabilities found in Chinese networking equipment. Researchers discovered a "backdoor" in the networking devices' firmware, specifically in Fiber to the Home (FTTH) Optical Line Termination (OLT) devices from Chinese companies C-Data and V-SOL. The vulnerabilities allowed unauthorized access to Telnet accounts, potentially giving cybercriminals complete administrator CLI access [102827]. (b) The software failure incident is also related to software vulnerabilities found in the firmware running on the C-Data and V-SOL devices. The security issues in the software allowed hackers to intercept and modify traffic, potentially stealing passwords sent in clear-text. The vulnerabilities in the software were exploited to create a backdoor access point into the networking devices, posing serious security risks [102827].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in the articles is malicious in nature. Security researchers discovered a "backdoor" in Chinese networking equipment that could allow cybercriminals to gain complete administrator CLI access to the devices, potentially intercept and modify customer traffic, steal passwords, and launch attacks on networks [102827]. The presence of such vulnerabilities in the devices poses serious problems and can be exploited by state-sponsored hackers to access sensitive information and wreak havoc on networks [102827]. The incident highlights the intentional introduction of vulnerabilities that could be exploited for malicious purposes.
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident reported in the articles is related to poor_decisions. The vulnerabilities found in the Chinese networking equipment were due to intentional backdoors in the firmware of the devices, allowing unauthorized access to the devices. This intentional design flaw could potentially lead to cybercriminals gaining complete administrator CLI access and intercepting and modifying customer traffic, posing serious security risks [102827].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the articles can be attributed to development incompetence. Security researchers Pierre Kim and Alexandre Torres discovered a "backdoor" in Chinese networking equipment that could allow unauthorized access to the devices due to vulnerabilities in the firmware running on the devices [102827]. The vulnerabilities found in the Telnet accounts of popular networking devices from Chinese companies C-Data and V-SOL could give cybercriminals complete administrator CLI access, allowing them to intercept and modify traffic, steal passwords, and potentially gain access to sensitive information passing through these devices [102827]. Additionally, the lack of proper scrutiny and regular patches for networking devices, as highlighted by Jayant Shukla, co-founder and CTO of K2 Cyber Security, further emphasizes the incompetence in securing these devices [102827]. (b) The software failure incident can also be considered accidental to some extent. The statement from C-Data mentioned that some issues were attributed to "counterfeit" devices that are not made by C-Data, indicating a potential accidental introduction of vulnerabilities in devices not manufactured by the company [102827]. Additionally, the company disputed, in some cases, the ability to remotely access the devices via a backdoor, suggesting a possible accidental misinterpretation of the security vulnerabilities [102827].
Duration temporary The software failure incident reported in the articles is more likely to be temporary rather than permanent. This is indicated by the fact that security researchers identified vulnerabilities in the firmware running on specific networking devices from Chinese companies C-Data and V-SOL [102827]. The vulnerabilities were found in the software, allowing unauthorized access to the devices, which suggests that the failure was due to specific circumstances related to the software design and implementation. Additionally, the response from C-Data acknowledged the vulnerabilities and provided measures to defend against cyber-attacks, indicating a potential temporary nature of the failure that can be addressed through software patches or updates.
Behaviour omission, value, other (a) crash: The software failure incident in the articles does not specifically mention a crash where the system loses state and does not perform any of its intended functions [102827]. (b) omission: The vulnerability in the Chinese networking equipment could lead to a failure where the system omits to perform its intended functions, allowing unauthorized access to Telnet accounts and potentially intercepting and modifying customer traffic [102827]. (c) timing: The articles do not indicate a failure related to timing, where the system performs its intended functions but too late or too early [102827]. (d) value: The software failure incident involves a failure where the system performs its intended functions incorrectly, as unauthorized access and potential data interception are not the intended functions of the networking devices [102827]. (e) byzantine: The incident does not exhibit a byzantine failure, where the system behaves erroneously with inconsistent responses and interactions [102827]. (f) other: The other behavior in this software failure incident is related to a security vulnerability that allows for unauthorized access and potential interception of customer traffic, posing serious security risks [102827].

IoT System Layer

Layer Option Rationale
Perception processing_unit, embedded_software (a) sensor: The software failure incident reported in the article is related to vulnerabilities found in the software (firmware) running on Fiber to the Home (FTTH) Optical Line Termination (OLT) devices from Chinese companies C-Data and V-SOL. These devices are part of the network infrastructure and act as the "endpoint" providing access to service providers on an optical network. The vulnerabilities discovered by security researchers could allow cybercriminals to intercept and modify the traffic from all the customers connected to these appliances, potentially stealing passwords sent in clear-text [102827]. (b) actuator: The article does not mention any specific failure related to actuator errors. (c) processing_unit: The software failure incident is primarily related to vulnerabilities found in the firmware running on the networking devices. The vulnerabilities could give cybercriminals complete administrator CLI access to the devices, allowing them to intercept and modify traffic and potentially steal passwords [102827]. (d) network_communication: The software failure incident involves vulnerabilities found in the networking devices' firmware, which could allow unauthorized access to the devices and interception of traffic. This could lead to potential security breaches and unauthorized access to sensitive information passing through the devices [102827]. (e) embedded_software: The failure incident is directly related to vulnerabilities found in the embedded software (firmware) running on the FTTH Optical Line Termination (OLT) devices from C-Data and V-SOL. The security researchers identified security issues in the firmware of these devices, which could be exploited by cybercriminals to gain unauthorized access and potentially steal sensitive information [102827].
Communication connectivity_level The software failure incident reported in the articles is related to the communication layer of the cyber physical system that failed at the connectivity_level. The failure was due to vulnerabilities found in the firmware running on Fiber to the Home (FTTH) Optical Line Termination (OLT) devices from Chinese companies C-Data and V-SOL. These vulnerabilities allowed unauthorized access to Telnet accounts on networking devices, potentially enabling cybercriminals to intercept and modify traffic, steal passwords, and gain complete administrator CLI access [102827]. The backdoor access to these devices posed serious security risks, as attackers could exploit the vulnerabilities to access sensitive information passing through the devices, launch attacks on other parts of the network, and cause disruptions or misconfigurations [102827].
Application TRUE The software failure incident described in the article [102827] is related to the application layer of the cyber physical system. The vulnerability found in the Chinese networking equipment's firmware allowed cybercriminals to gain complete administrator CLI access, intercept and modify traffic, and potentially steal passwords sent in clear-text. This indicates that the failure was due to contributing factors introduced by bugs and vulnerabilities in the software application layer [102827].

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence, unknown (a) unknown (b) unknown (c) unknown (d) People's material goods, money, or data was impacted due to the software failure [102827] (e) unknown (f) Non-human entities were impacted due to the software failure [102827] (g) unknown (h) There were potential consequences discussed of the software failure that did not occur [102827] (i) unknown
Domain information (a) The software failure incident reported in the articles is related to the information industry. The incident involves a "backdoor" found in Chinese networking equipment used in Fiber to the Home (FTTH) Optical Line Termination (OLT) devices, which provide access to service providers on an optical network. These devices are commonly used by home users throughout the U.S. and globally for internet connectivity [Article 102827].

Sources

Back to List