Your Tenda router could have a hidden firmware backdoor – disable this setting ASAP


Tenda firmware bakes a backdoor into routers

Adrian Kingsley-Hughes/ZDNET

Follow ZDNET: Add us as a preferred source on Google.


ZDNET’s key takeaways

  • Some Tenda routers have a firmware backdoor.
  • The backdoor can be exploited remotely.
  • Details of the backdoor are easily available.

Several firmware versions released for a popular brand of routers have been found to contain an undocumented backdoor that can allow anyone full access to the hardware.

The brand in question is Tenda, a company that manufactures network equipment such as routers, switches, access points, and video cameras. It’s a popular brand that sells hardware via the usual channels, such as Amazon.

The vulnerability was discovered by an anonymous researcher and reported by the CERT Coordination Center (CERT/CC) earlier this week.

Also: How I turned my old Android phone into a Wi-Fi extender – and fixed dead spots at home

Put simply, the backdoor is an admin password that’s been baked into the firmware that allows anyone who knows it to bypass access control security (username and password) and access the internal settings of the router.

By accessing a router’s administration panel, an attacker would be able to carry out a number of tasks that you might not want a third party to be able to do, from running internal network scans to find all the devices on the network to grabbing the Wi-Fi passcodes, setting up certain ports and web traffic to be forwarded to another destination, and disabling security features.

Also: My home’s Wi-Fi dead zones were worse than I thought – here’s what fixed them

While CERT has not reported what the username and password backdoor is, I was able to find it pretty easily, and since I have some Tenda hardware here, I was able to confirm that the backdoor works.

Given the ease of the hack, the fact that all the details are out there, and the popularity of Tenda hardware, I expect this hack to be exploited by hackers.

Firmware versions affected

The firmware versions that are affected are:

  • US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD
  • US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE
  • US_AC10V1.0re_V15.03.06.46_multi_TDE01
  • US_AC5V1.0RTL_V15.03.06.48_multi_TDE01
  • US_AC6V2.0RTL_V15.03.06.51_multi_T

It’s not known if this backdoor was added maliciously or as some sort of way for tech support to access hardware where the user has lost the password.

Also: Chrome’s next update will kill your ad blocker – and make the web less safe

Either way, it’s not a good thing.

If this vulnerability required hands-on access to the router, the scope of attack would be quite limited. Unfortunately, this can be exploited remotely over the internet.

What you can do now

If you own Tenda hardware, your best defense is to disable remote web management and change the default LAN IP until Tenda releases a patch to fix this backdoor.

Also: 5 ways to fortify your network against the new speed of AI attacks

I thought that I might be able to install an open-source firmware on the router, like DD-WRT, but because of the custom chipsets that Tenda uses, there aren’t any available.

ZDNET has reached out to Tenda for comment and a possible timeline for a patch, but as of the time of writing, the company has not replied. CERT reports that it, too, “were unable to reach the vendor to coordinate this vulnerability.”





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Misinformation about sunscreen makes up a small portion of TikTok videos about the subject, but those posts are disproportionately popular and widely shared, a new study finds.

Wellness topics are commonly affected by misinformation spread online. That includes content related to sunscreen — a crucial tool in preventing skin cancer. A new peer-reviewed study conducted by researchers at the University of Alberta found that misinformation on TikTok receives higher audience engagement compared to pro-sunscreen content. 

The study looked at 971 of the most-viewed TikTok videos about sunscreen and found that the most-viewed videos had anti-sunscreen messaging. These videos only made up a small fraction of content found on TikTok (6%), compared to pro-sunscreen videos (86.8%). And only 1.5% of the posts the researchers reviewed claimed sunscreen caused harm.

Although there are fewer anti-sunscreen videos, these attract the most attention because the messaging is more provocative, the researchers said. Public health officials have been concerned about the anti-sunscreen movement that claims, falsely, that sunscreen is harmful or prevents the health benefits of sun exposure. Among the myths these messages spread include that sunscreen causes cancer, it blocks the absorption of Vitamin D and that it’s toxic to humans. The popularity of this content on TikTok could influence viewers, particularly younger ones, to avoid it altogether. 

It’s not surprising that many Americans turn to social media for health advice. A Pew Research Center survey released in April found 36% of Americans reported getting health information at least sometimes from social media. (And 22% said they got health information from AI chatbots.) Wellness influencers know how to make particularly engaging content, which makes it easier for others to believe the message they’re sharing — even if it’s false or misleading. 

Experts attribute the willingness of Americans to believe sunscreen misinformation to a wide range of factors.

“I think sunscreen skepticism grew out of a few overlapping movements: clean beauty, distrust of institutions, fear of synthetic ingredients and a general wellness culture that tends to frame ‘natural’ as automatically safer,” Dr. Melanie Palm, a board-certified dermatologist and cosmetic surgeon at Art of Skin MD, tells CNET. Sensationalized messages spread easily on social media because they feed on real human fears. 

Although there’s relatively more pro-sunscreen TikTok content, experts believe the messaging for this has been short-sighted as well. The study found that the majority of sunscreen content promoted on TikTok was mainly centered around its beauty benefits, versus only 6% mentioning cancer risk reduction.

“For many people, especially younger people, photoaging feels more relevant than cancer prevention,” Palm says. Not that sun protection lacks beauty benefits. ”I don’t think it’s wrong to talk about the beauty benefits of sunscreen because sunscreen does help prevent brown spots, uneven tone, collagen breakdown, and premature aging,” Palm says. 

Since sunscreen content has leaned more towards the beauty angle, its skin cancer prevention messaging has been downplayed. “Dermatologists and brands need to say it [sunscreen can prevent skin cancer] more clearly, and we need to say it in plain language,” Palm says. The problem is that often the facts on social media sound like a lecture. Palm believes experts can work on explaining themselves better without diluting the science and being less dismissive if a patient is worried about sunscreen use.

“We can say, ‘I understand why that sounds concerning — here is what the evidence actually shows, and here are options if you prefer mineral sunscreen, tinted sunscreen, fragrance-free formulas or newer filters,’” Palm suggests. 

Palm recommends experts active on social media focus on shorter videos, simpler analogies and real-life examples of sun damage. That’s just one piece of the equation. Sunscreen manufacturers marketing their products on social media often use fear-based language. Palm recommends that they focus on educating the public instead. This includes explaining common terms such as “broad-spectrum” or why it’s important to reapply sunscreen. “Show sunscreens on different skin tones, because if a product leaves a white cast or pills under makeup, people are not going to wear it daily,” Palm says. 

With research showing that more people are receiving their news from social media, it’s prime time for experts to appear as relatable as possible when sharing content on social platforms. Sunscreen brands can aim to educate younger people on the importance of skin protection and still speak about its beauty benefits. Even if you’re sharing the truth on social media, the way you get that message across is just as important if you want to reach a greater audience. 





Source link