0

There are several articles that says that vendors plant backdoors on network devices intentionally, such as this one.

They found backdoors that were made by the vendors. Also, I read somewhere else that major network device companies put backdoors on devices to give support staff emergency access to devices. If they find a security vulnerability they want to be able to patch it easily without having to make the user download and install a fix.

Note that these kinds of backdoors that are my concern are not the type that Ed Snowden called "government backdoors".

Are these backdoors real? Are they necessary? Is it also a potential danger?

3

Are these backdoors real?

Yes, these backdoors are real. A quick search for vendor backdoor provides some examples:

And these are only some examples of obvious vendor backdoors instead of accidentally left backdoors from debugging or similar.

Are they necessary?

These are backdoors the customers don't know about, i.e. the vendor can sneak in and make changes without the customer noticing. I believe that having such backdoors greatly undermines the trust into the vendor. I don't think these are necessary - there are ways to have service accounts which are known to the customer and get only enabled for a short time if the customer actually requests support.

Is it also a potential danger?

Of course, For example in the above example of RuggedCom the password could be simply derived from the MAC address and not only the vendor but also potential hackers had knowledge about it. This means it is no longer a vendor backdoor but a backdoor for hackers too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.