Walmart-exclusive router and others sold on Amazon & eBay contain hidden backdoors to control devices

[HempBoosh]

Summary

Suspicious backdoors have been discovered in a Chinese-made Jetstream router, sold exclusively at Walmart as their new line of “affordable” wifi routers. This backdoor would allow an attacker the ability to remotely control not only the routers, but also any devices connected to that network. 

 

Quotes

Quote

 

CyberNews reached out to Walmart for comment and to understand whether they were aware of the Jetstream backdoor, and what they plan to do to protect their customers. After we sent information about the affected Jetstream device, a Walmart spokesperson informed CyberNews: “Thank you for bringing this to our attention. We are looking into the issue to learn more. The item in question is currently out of stock and we do not have plans to replenish it.”

Besides the Walmart-exclusive Jetstream router, the cybersecurity research team also discovered that low-cost Wavlink routers, normally sold on Amazon or eBay, have similar backdoors. The Wavlink routers also contain a script that lists nearby wifi and has the capability to connect to those networks.

We have also found evidence that these backdoors are being actively exploited, and there’s been an attempt to add the devices to a Mirai botnet. Mirai is malware that infects devices connected to a network, turns them into remotely controlled bots as part of a botnet, and uses them in large-scale attacks. The most famous of these is the 2016 Dyn DNS cyberattack, which brought down major websites like Reddit, Netflix, CNN, GitHub, Twitter, Airbnb and more. 

 

My thoughts

You know the old saying "You get what you pay for", but this is a bit extreme. If I'm buying a cheap router then I expect it to perform decently. Now I'm finding out that they are potentially filled with backdoors? Feels like no matter how much research you do about tech, something bad still comes out later.

 

Sources

https://cybernews.com/security/walmart-exclusive-routers-others-made-in-china-contain-backdoors-to-control-devices/

[staticpage]

New AC1900 Dual Band WiFi Gaming Router, 801.11a/b/g/n/ac $39.99

 

Yep Yep legit AF

 

 

[kelvinhall05]

2 minutes ago, staticpage said:

New AC1900 Dual Band WiFi Gaming Router, 801.11a/b/g/n/ac $39.99

 

Yep Yep legit AF

 

 

Seems like a normal, cheap router to me (as far as hardware goes). Not sure how the price indicates that it has a backdoor.

[staticpage]

Just now, kelvinhall05 said:

Seems like a normal, cheap router to me (as far as hardware goes). Not sure how the price indicates that it has a backdoor.

Jet shopped for the same, lowest I could find was about $100 for something that can do the job as advertised.

[WereCatf]

2 minutes ago, staticpage said:

Jet shopped for the same, lowest I could find was about $100 for something that can do the job as advertised.

There are plenty of perfectly fine routers with the mentioned specs for ~$40 - $50. The hardware just simply doesn't cost that much anymore nowadays and the price definitely doesn't indicate the presence of backdoors or such.

[staticpage]

3 minutes ago, WereCatf said:

There are plenty of perfectly fine routers with the mentioned specs for ~$40 - $50. The hardware just simply doesn't cost that much anymore nowadays and the price definitely doesn't indicate the presence of backdoors or such.

I'm intrigued enough to ask for a link to some of these routers you mention. Cus even the listing on the Walmart sight says it is marked down from $139 and comparable to $100 competitors.

[WereCatf]

Just now, staticpage said:

I'm intrigued enough to ask for a link to some of these routers you mention. Cus even the listing on the Walmart sight says it is marked down from $139 and comparable to $100 competitors.

Newifi 3 D2:

https://www.ebay.com/itm/1200Mbps-WiFi-Wireless-Gigabit-Router-OpenWrt-32M-512M-DDR3-USB-3-0-4-Antenna/174514011931

https://wikidevi.wi-cat.ru/Lenovo_Newifi_3

https://openwrt.org/toh/hwdata/d-team/d-team_newifi_d2

 

The SoC and WiFi-hardware:

https://www.mediatek.com/products/homeNetworking/mt7621

https://www.mediatek.com/products/broadbandWifi/mt7603e

https://www.mediatek.com/products/broadbandWifi/mt7612e

[Blademaster91]

A $40 router? Yeah that can't be anything decent, it's bad enough some $100+ routers get caught with backdoors or have some horrible vulnerability the router manufacturer doesn't want to fix.

[BuckGup]

Basically all routers on the market have backdoors. Many companies view them as good things. There are backdoors to the software that runs HPC clusters

[WereCatf]

1 minute ago, Blademaster91 said:

A $40 router? Yeah that can't be anything decent, it's bad enough some $100+ routers get caught with backdoors or have some horrible vulnerability the router manufacturer doesn't want to fix.

Using OpenWRT instead of developing their own firmware alone does take quite a bit off the cost, allowing random Chinese manufacturers to produce very cheap and perfectly capable hardware.

[StDragon]

8 minutes ago, WereCatf said:

Using OpenWRT instead of developing their own firmware alone does take quite a bit off the cost, allowing random Chinese manufacturers to produce very cheap and perfectly capable hardware.

That's part of the equation. The other is using robust circuit design such a filters, and to spec capacitors. But many of these cheap Chinese products are built to sell out the door while minimizing the return rate. But they're not designed to last more than 6 months. And post-sales firmware support. Yeah, what's that?? Exactly!

 

And that's why you don't see many of those products in the west. 

[WereCatf]

6 minutes ago, StDragon said:

And post-sales firmware support.

If the router is using OpenWRT, then it's not the manufacturer who even touches the firmware in the first place. You just download firmware-updates from OpenWRT's site and install them when available. That's why I said that it takes off quite a bit from the price: the manufacturer doesn't need any devs for the firmware nor do they provide any firmware-updates or support or anything -- they just slap the hardware together and let enthusiasts deal with the firmware.

 

It's obviously not very user-friendly and totally not suitable for the average people, but for a nerd who is after good bang-for-the-buck and who is willing to deal with manual firmware-updates it's fantastic.

[Roswell]

This is a pretty big nothing burger. And no, accessing your router's firmware in no way means they can magically control all of the devices on your network like a sky wizard. Stop it.

 

Yes, they could in theory gain access to your router's firmware IF they:

 

1. had your IP address
2. you were AT THAT VERY MOMENT logged into your router's admin console
3. somehow magically knew you had that exact model
4. managed to get through whatever security is provided by your ISP/modem

So... unfortunate lapse in security that will likely never result in any real world issue. Please actually read the source material before posting alarmist threads.

[Neftex]

15 hours ago, Vitamanic said:

This is a pretty big nothing burger. And no, accessing your router's firmware in no way means they can magically control all of the devices on your network like a sky wizard. Stop it.

 

Yes, they could in theory gain access to your router's firmware IF they:

 

1. had your IP address
2. you were AT THAT VERY MOMENT logged into your router's admin console
3. somehow magically knew you had that exact model
4. managed to get through whatever security is provided by your ISP/modem

So... unfortunate lapse in security that will likely never result in any real world issue. Please actually read the source material before posting alarmist threads.

are you saying the backdoor in these routers isnt exploitable? when the research team already claimed it is being used?

 

router with backdoor can phone home, so you dont need to initiate the connection. backdoor can let you directly into routers firmware. you dont have to be logged in, they dont need to know the model beforehand, they dont need to circumvent "security from your isp" because the router itself initiated the connection.

 

the router can act as man in the middle attack for encrypted communication as well. sure it doesnt control all devices on the network but it can try and infect them through their vulnerabilities

[Arika]

Are you connected to the internet? chances are there's a backdoor somewhere that has access to your stuff. it's just a matter of when/who/if it's discovered and where/what it's in.

[Roswell]

36 minutes ago, Neftex said:

are you saying the backdoor in these routers isnt exploitable? when the research team already claimed it is being used?

 

router with backdoor can phone home, so you dont need to initiate the connection. backdoor can let you directly into routers firmware. you dont have to be logged in, they dont need to know the model beforehand, they dont need to circumvent "security from your isp" because the router itself initiated the connection.

 

the router can act as man in the middle attack for encrypted communication as well. sure it doesnt control all devices on the network but it can try and infect them through their vulnerabilities

The article is about 10 times longer now compared to when I originally read it. I assume they updated it. They made no mention of intercepting the malware in the original article and really only linked to the blog post from one of the researchers which was pretty inconclusive as I pointed out.

[bit]

1 hour ago, James Evens said:

In three words: We don't care.

 

-zoop-

https://www.walmart.com/search/?query=wavlink

If you wondered what they did: Nothing. Wavlink can still sell on Walmart.com like nothing happend.

Their quote most likely refers to walmarts own stock at their physical store. You're just showing the walmart marketplace and wavlink is a third party seller on there so yes, walmart itself technically doesn't have any stock of it anymore.

[Roswell]

1 hour ago, James Evens said:

@bit If they brand there marketplace Walmart then Walmart is responsible for it. Meaning there is no excuse for them not banning these products from the store.

Simmer down, it was reported 24 hours ago. They’re not going to instantly slap a big red button to ban a seller after reading an email. There’s definitely some kind of process they need to work through to verify the claims.

[bit]

1 hour ago, James Evens said:

@bit If they brand there marketplace Walmart then Walmart is responsible for it. Meaning there is no excuse for them not banning these products from the store.

yeah but we're not arguing about whether they should ban them from their marketplace, just whether walmart has stock of it and according to their website with a quick 2s search, i did not see any. I'm not saying that I dont think walmart should remove them from their marketplace either. The practice of whether a retailer should differentiate their product vs third party better on their website like this or Amazon, Best Buy, Newegg, etc, is a whole nother topic in itself.

 

edit: 69th post, nice