Do vendors put backdoors on network devices?

Question

There are several articles about "planting backdoors on network devices by vendors intentionally" , for example Hardware Vendor Offers Backdoor with Every Product.

They found backdoors that were made by the vendors. Also, they mentioned, that major network device companies put backdoors on devices to give support staff emergency access to devices. If they find a security vulnerability they want to be able to patch it easily without having to make the user download and install a fix.
Note that the backdoors I am considering is not the kind that Ed Snowden called a "government backdoors".

• Are these backdoors real?
• Are they necessary or do we need to patch it?
• Is it also a potential danger?

Answer 1

Are these backdoors real?

Yes, these backdoors are real. A quick search for vendor backdoor provides some examples:

• Hardware Vendor Offers Backdoor with Every Product - that's about Allied Telesis you've already mentioned.
• Backdoor account replaced by another backdoor in vendor stumble - about a vendor backdoor in audio equipment, where the fix was to replace the backdoor with a new one.
• Equipment Maker Caught Installing Backdoor Account in Control System Code - RuggedCom had a vendor backdoor in their industry equipement where the password could be derived from the MAC address.

And these are only some examples of obvious vendor backdoors instead of accidentally left backdoors from debugging or similar.

Are they necessary?

These are backdoors the customers don't know about, i.e. the vendor can sneak in and make changes without the customer noticing. I believe that having such backdoors greatly undermines the trust into the vendor. I don't think these are necessary - there are ways to have service accounts which are known to the customer and get only enabled for a short time if the customer actually requests support.

Is it also a potential danger?

Of course, For example in the above example of RuggedCom the password could be simply derived from the MAC address and not only the vendor but also potential hackers had knowledge about it. This means it is no longer a vendor backdoor but a backdoor for hackers too.