7 ms·
How I discovered a hidden microphone on a Chinese NanoKVM
- Milpotel 10mo ago> [...] and runs a heavily stripped-down version of Linux that lacks systemd and apt. And these are just a few of the issues. ?!
- stefan_ 10mo ago> But what additionally raised red flags was the presence of tcpdump and aircrack - tools commonly used for network packet analysis and wireless security testing. While these are useful for debugging and development, they are also hacking tools that can be dangerously exploited. Must be another AI slop article. Stop feeding your writings into GPT & co to turn into extra long nonsense.
- kenjackson 10mo agoWhat was wrong with the above paragraph?
- deleted 10mo ago[deleted]
- nottorp 10mo agoLet's see: 1. It lacks systemd and apt. systemd is so resource hungry that i'm sure they removed it to reduce the RAM bill. Apt... why install apt if the distro has a different means of updating? 2. While these are useful for debugging and development, they are also hacking tools that can be dangerously exploited. This is purely fear mongering. Even the shell could be a "hacking tool that can be dangerously exploited". Let's remove the shell too. There are some legitimate complaints in the article, like the use of the same key on all installs. The rest looks more like fear mongering and security theater. Including the microphone. What were they supposed to do, desolder it manually and add $10 to the price of each device? I don't see the article complaining that a PiKVM has so many unused peripherals when used as a KVM. To go in the spirit of item #2, the usb ports could be used as "dangerous hacking tools" so you should desolder your usb ports from a Pi used as a KVM, right?
- mystraline 10mo agoCat is a hacking tool cause you can see the contents of /proc/kcore? Cp is a hacktool cause bad files can be copied? Grep is a hacktool cause only monster hackers use regex? (This is obvious sarcasm)
- whalesalad 10mo agoI don’t see this as noteworthy myself. It’s expected on a small embedded device such as this. You’re usually lucky to have busybox.
- kps 10mo agoPresumably Alpine. I bet it doesn't run GNOME either. And these are just a few of the issues!
- knallfrosch 10mo agoLacking software (apt) is a security issue. Having software installed (tcpdump) is also a security issue.
- margalabargala 10mo agoCould you elaborate on how lacking apt is a security issue?
- FateOfNations 10mo agoapt is a package manager. It's only relevant if the system uses it to manage it's packages. Red Hat based distributions, for example, don't use apt. Embedded devices typically don't manage packages on an individual basis, rather updating the entire distribution via "firmware updates".
- kotaKat 10mo agohttps://wiki.sipeed.com/hardware/en/kvm/NanoKVM/introduction.html https://wiki.sipeed.com/hardware/en/kvm/NanoKVM/introduction... Probably an older NanoKVM. "NanoKVM-Cube hardware is built on the LicheeRV Nano platform. To coordinate production and maintain consistency with the LicheeRV Nano for the SMT project, the hardware retains the display, touch, MIC, and amplifier circuits. To address potential privacy concerns, versions 2.2.6 of the application and 1.4.1 of the firmware and above will remove the relevant drivers. We will also eliminate these components in future productions."
- tayiorrobinson 10mo agoTo be fair, the microphone _is_ listed on the specsheet of the LicheeRV Nano https://wiki.sipeed.com/hardware/en/lichee/RV_Nano/1_intro.html https://wiki.sipeed.com/hardware/en/lichee/RV_Nano/1_intro.h... I assume they didn't intend to put a mic on the KVM product, but they wanted to make a KVM product, already had this SBC product, which reusing their existing stock of helped keep cost low. Should they have been more up front about it it? Sure, and it's not great that they had a bunch of security issues in the FW anyway, so not exactly great, but "hidden microphone in a Chinese KVM" lets the mind wander
- ndsipa_pomu 10mo agoIt doesn't strike me as that useful to have a hidden microphone in a KVM product as most of the time, they're going to be stuck in server rooms with just lots of fan noise to record. Far more of an issue would be any kind of keylogger built into the software, which is why it's best to go for devices that support open source software.
- i_am_proteus 10mo agoIt is possible to keylog via audio. https://ieeexplore.ieee.org/abstract/document/10190721 https://ieeexplore.ieee.org/abstract/document/10190721
- BenjiWiebe 10mo agoBut the point of a device like this is that you (and your keyboard) are NOT physically present.
- hinkley 10mo agoThey mean the K in KVM could trivially have a keylogger. For the computers attached to that KVM. Audio is for logging for computers not attached to the device in question. Which could be up to and including a whole server room save a couple machines.
- mannanj 10mo agoany speaker can be tapped into as a microphone by a motivated government.
- Aachen 10mo agoFrom a hardware point of view I've also noticed that speakers work like poor microphones (and LEDs like poor solar panels / light sensors), but is there any way to actually make this work on most devices without physically changing wiring? If the circuits aren't made to take measurements (or the software can't get at the readings) but only set a voltage on the wires, there wouldn't be a way to (ab)use this. I don't know enough about electronics to know whether this is commonly the case Not that it's not a good thing to be aware of, but do you have any sort of source for what kinds of devices can have their speakers turned into microphones? Then I'll believe you about the government part
- withinboredom 10mo agoI don’t think they meant literally “any” but more like a device with a speaker could be delivered to you that has a speaker/microphone. Like a Bluetooth speaker you order of the internet. It seems it would probably have to be personally targeted to you, but in that case, there are probably simpler ways.
- stragies 10mo agoMany a soundcard supports changing jack "direction". Here's a StackExchange answer from 2012, on how to do it with the GUI tool `hdajackretask` : https://askubuntu.com/a/911961 https://askubuntu.com/a/911961
- mannanj 10mo agoAny was an exaggeration and less than honest on my part, I apologize. I think the speakers in most smart devices though can because they have the circuitry as another comment mentioned to record the input in reverse via software. I think most speakers would have that today, most modern speakers. Plain speakers that just take a voltage signal though, probably not. Though how many people use those kinds of speakers today I wonder.
- lousken 10mo agois there a recording sample to hear the quality?
- jlward4th 10mo agoI recently discovered a similar concerning security issue with my KVM. In my case it was a pretty standard KVM for multiple machines to share a keyboard, mouse, and screen but also Ethernet. One day while looking at my home network I noticed the KVM had its own IP and was transferring GBs of data everyday. I quickly blocked it from my network. But having used it for a number of months I worried that with screen capture and access to all my input devices, someone could have gotten access to pretty much everything I use. I wasn’t able to figure out if any data was actually being sent off my network and I really didn’t want to put myself in any more risk so I just threw it in an electronics recycling bin. Pretty scary what a network connected KVM could maliciously do.
- Renaud 10mo agoShame you threw it away. It would have been useful to collect the traffic with Wireshark and share that with info about the device in a post or a blog for others to investigate and be warned about that brand and model.
- stragies 10mo agoWhy did you not just login to the device, and switched off "Broadcast to multicast", or changed the destination address? Edit: Some brands of Network-KVM use this, so that you can control the target device from another device, like e.g. an App on a tablet. That way you don't have to stand next to the target device in the noisy and cold machine room
- supportengineer 10mo agoWhat an amazing device, but also the price is incredible. This kind of device would have been such a game changer 15 to 20 years ago. Thank you for the detailed security analysis. At least the developers are responsive, that does seem like a green flag.
- bethekidyouwant 10mo agoIf someone hacks your KVM, I’m thinking the onboard microphone is the least of your problems.
- _def 10mo agoAnyone got a link to some community work on the open source side? Sounds like useful devices, if you fix the issues mentioned.
- gunalx 10mo agoI dont see the issue here. Its not like they have not disclosed what board it is based upon. And I do feel like its correct not advertising a mic if you dont have it enabled on this one. I dont really like nanokvm for being slow with updates and not patching stuff fast enough.
- pirbull 10mo ago> You can start with your iPhone - last year Apple has agreed to pay $95 million to settle a lawsuit alleging that its voice assistant Siri recorded private conversations. They shared the data with third parties and used them for targeted ads. “Unintentionally”, of course! Yes, that Apple, that cares about your privacy so much the clickbait title makes sense after reading this paragraph
- gruez 10mo agoNot really, because the paragraph you quoted was highly misleading. Even the plaintiffs admit that the recordings were caused by accidental activation, not some sort of nefarious conspiracy by Apple. Moreover there's no evidence that Apple "used them for targeted ads", only that they handed over to third party contractors for improving siri.
- LorenPechtel 10mo agoAnd Siri promptly got disabled on my wife's iPad because she kept triggering it inadvertently. Something about her accent kept tripping it. (And, in reverse, Alexa will often not trigger when my wife tries. She comes from a tonal language and it creeps into her English extensively.)
- jxhdh 10mo agoYou are using a KVM. When not trusting the manufacturer a microphone is the least of your problems xD
- pixl97 10mo agoThis said wildly inappropriate features included do violate the principle of least user authorization. You expect if your KVM gets hacked your servers are pretty fucked, the problem now is any conversation you had by the KVM is suspect too. Goes along with 'the S in IOT stands for security'.
- deleted 10mo ago[deleted]
- snapdeficit 10mo agoA kvm that requires Chinese dns servers? Just the fact it KvM over Ethernet should set off alarm bells from here till next Thursday. I would have a hard time trusting an internet based kvm.
- macki0 10mo agowait till you find out about iLO/iDRAC or vPro
- Ekaros 10mo agoShould I really be more trusting of some NSA controlled DNS server?
- snapdeficit 10mo agoYes. Hahaha. Of course not. Or maybe?? No, just kidding. But am i?
- ghostpepper 10mo agoA lot of the complaints here don't make a lot of sense and read like the author has never used an embedded linux device. The previously reported bugs are more substantial - hardcoded secrets for JWT access and firmware encryption, everything running as root, etc. However, "Chinese product uses Chinese DNS servers and it's hard to change them" or "no systemd nor apt installed" are totally expected and hardly make it "riddled with security flaws". Same with tcpdump and aircrack being installed - these hardly compromise the security more than having everything run as root. I would expect most users of this device will not be exposing the web interface externally, and the fact that they ship with Tailscale installed is actually impressive. I can't imagine the lack of CSRF protection will be a vulnerability for 99% of users. I am curious what the "weird" version of wireguard the author refers to but based on their apparent lack of knowledge on embedded systems in general I would not be shocked to find that it's totally innocuous.
- itopaloglu83 10mo agoHanlon's Razor at work; most of the shortfalls described in the article points to incompetence more than malice. Though I find it strange though, because I would call this the shortcomings of a crowdfunded project, but the author took it as a malicious and planned act to take over target computers and networks. As far as I remember, some of the botnets are formed by routers that vendors refused to patch, because they're no longer being sold and not profitable to do so.
- butvacuum 10mo agoI think you haven't gone far enough. Most of this thread is rampant ignorance and propaganda influenced bandwagoning. 1) It's from a company known for dev boards and SoCs- not consumer products. 2) The code is available on GitHub (nice!) 3) SiSpeed actively contributes to the mainline linux kernel for RISC-V in general as well as their SoCs. 4) Security in Embedded Applications is just... Bad. Amercian, Chinese, European, Russian, Indian- it doesn't matter.
- Ekaros 10mo agoAlso what do you really expect for 30€ or 60€ price point? On relatively low volume product. It even doing what is promised is already a good start to me. And that probably tells their priorities. Start from some already working image with wide support for features. And then add the features that are needed in specific use case. And then ship it.
- unknown_rookie 10mo agoOnce I dissected the code of a FDA-approved medical device, Vendys Endothelix. If connected to the internet, the device would covertly send measurement data to a specific email address. The usernames and comments baked in the code suggested Chinese development. I would be curious to know what percentage of our highly sensitive data ends up overseas.
- SoftTalker 10mo agoI think it's safe (or maybe prudent) to assume that pretty much all phones, computers, and network switching gear are backdoored by someone.
- n5NOJwkc7kRC 9mo agoWhat was "covert" about it? What is "measurement data"?
- finaard 10mo ago> To summarize: the device is riddled with security flaws, originally shipped with default passwords, communicates with servers in China, comes preinstalled with hacking tools, and even includes a built-in microphone So like pretty much any BMC out there, just with the benefit that an attacker taking over that thing doesn't have direct access to reflash your bios with a backdoored version? Any halfway sane person deployed any kind of BMC or networked KVM to a access restricted management VLAN for at least a decade now because all of those things are a big mess, and the impact of them getting owned typically is pretty severe.
- da_grift_shift 10mo ago[flagged]
- neom 10mo agoGotta be careful about them hidden microphones, they could be listening and recording all the keyboard clicks and translating them to the device.
- iJohnDoe 10mo agoSuch a cool device. Is it possible to buy something like this which is intended to be user installable for Linux that I could test/mess around with?
- PunchyHamster 10mo agoThe device is based on linux devboard so... yes
- kyrofa 10mo ago> [It] runs a heavily stripped-down version of Linux that lacks systemd and apt. And these are just a few of the issues. You mean it's not Debian-based? How is this an issue?
- thorncorona 10mo ago[flagged]
- mrbluecoat 10mo ago> The device initially came with a default password, and SSH access was enabled using this preset password That alone ends my trust in the brand.
- PunchyHamster 10mo ago...you need a password to log in onto it to change it. That's hardly unique. You could say "but they could make random one that is displayed on display!", but they also sell headless version with no display at all so that's not an option
- DooMMasteR 9mo agothey also fixed the issue, SSH is off by default now. BUT BE WARNED: it runs a web-server by default with no password set from the factory, you have to configure it first run to secure it.... yeah, this article is mostly a no banger, they made some dumb oversights/mistakes with the firmware but fixed them quickly and even documented the issues and concerns. The firmware if open source after all.
- wkat4242 10mo agoWhoa I have a bunch of these. But I never trusted them in the first place so they don't have internet access anyway. They're on a separate subnet. It'll be fine. Also where my servers are there's nothing interesting to hear except more servers and 3D printers.
- milesvp 10mo agoMics have a pretty standard look, and are hard to miss on the board. It would be more insideous if there were cheap film caps leading into a very expensive ADC. I work with with analogue audio, and it’s very important to design around the noise of cheap caps. They are for all intents and purposes microphones and if you were clever about different caps for different frequencies and good digital processing I have no doubt you could build something with comparable fidelity to some of the cheapers MICs in the vocal range.
- nixpulvis 10mo agoWhy is there a component on the board that isn't used in the product for any official purpose then? Even if you believe it was an accident and an oversight (which it could have been), you should be upset because it's something that could be pretty serious if you used in your home. Just because you might claim it's not malicious, doesn't make it not negligence.
- milesvp 10mo agoSo usually you would DNP the parts and they wouldn’t populate at the factory. But sometimes you have a bunch of boards already made that for some reason you can’t use for another SKU, and so you put them in another housing, and change the board for the next rev. Mind you, I’m not saying a mic in a KVM isn’t sus, just that it’s a little obvious, and certainly not stuxnet level espionage.
- slanterns 10mo agoCuz it's simply built upon the existing LicheeRV Nano SBC, then it has the same component just as the board.
- rcarmo 10mo agoThis is… not news. The base board has always had a microphone, the NanoKVM was just built around that base board.
- eps 10mo agotcpdump is not a "hacking" tool, not in a sense implied in the article.
- PeterStuer 10mo agoThese days tbh I'm just assuming every device I purchace has a microphone for one of the completely unwanted 'assistants'.
- franga2000 10mo agoWhy is this article trending again?? The NanoKVM is showcase product for the LicheeRV Nano. A built-in microphone is an advertised feature of that board. I like Matej's work, especially his GSM stuff, but this article is so overblown. A third are known issues and another third are non-issues. The last third was good security work and I genuinely appreciate he did it. Beat me to it by a feew weeks, since my order was stuck in customs while I tried to explain to them what a KVM was...
- crest 10mo ago* Includes a microphone? Look at the datasheet of the devboard they used, dummy. * Running everything as root? Valid point. That's a inexcusable mistake and has been for ever a sign of laziness and ignorance. * Not including systemd? Yes please. * Not including a package manager the author nows? Shows the authors ignorance to assume apt would be found on a small embedded system.
- account42 10mo ago> For instance, a security researcher even found an image of a cat embedded in the firmware. How can the article not include this picture or at least link to it. Internet, today you have disappointed me.
- zepan 10mo agoThanks to everyone for following the discussion on NanoKVM security. I think most of you will know exactly what to make of this article the moment you read the complaint that it 'runs a heavily stripped-down version of Linux that lacks systemd and apt.' Most of the claims in the article are not real vulnerabilities. Some harmless behaviors were indeed easy to misinterpret if viewed with bias, but we actually changed those behaviors and implementations over 10 months ago. It is surprising to see this article coming out today instead of last year. As for the onboard mic, it is not 'hidden.' It is a component that has been clearly documented and explained in our Wiki: https://wiki.sipeed.com/hardware/en/kvm/NanoKVM/introduction.html#NanoKVM-Hardware-and-Software-Resources https://wiki.sipeed.com/hardware/en/kvm/NanoKVM/introduction... We believe open source lets the facts speak for themselves. Thanks to the NanoKVM community for using your technical common sense to help clear this up!