Name: Backdoor account discovered in more than 100,000 Zyxel firewalls, VPN gateways | ZDNET
Brand: zdnet.com
SKU: zdnet-com-401
Availability: OnlineOnly

critic

Backdoor account discovered in more than 100,000 Zyxel firewalls, VPN gateways | ZDNET

preview

We and our partners use cookies to understand how you use our site, improve your experience and serve you personalized content and advertising. Read about how we use cookies and your choices . By continuing to use this site, you accept these cookies.AcceptRejectUpdate ConsentMore than 100,000 Zyxel firewalls, VPN gateways, and access point controllers contain a hardcoded admin-level backdoor account that can grant attackers root access to devices via either the SSH interface or the web administration panel. The backdoor account, discovered by a team of Dutch security researchers from Eye Control, is considered as bad as it gets in terms of vulnerabilities. Also: Device owners are advised to update systems as soon as time permits.Security experts warn that anyone ranging from DDoS botnet operators to state-sponsored hacking groups and ransomware gangs could abuse this backdoor account to access vulnerable devices and pivot to internal networks for additional attacks. Affected models include many of Zyxel's top products from its line of business-grade devices, usually deployed across private enterprise and government networks. This includes Zyxel product lines such as: Many of these devices are used at the edge of a company's network and, once compromised, allow attackers to pivot and launch further attacks against internal hosts.Patches are currently available only for the ATP, USG, USG Flex, and VPN series. Patches for the NXC series are expected in April 2021, according to a&nbsp;. Installing patches removes the backdoor account, which, according to Eye Control researchers, uses the "zyfwp" username and the "PrOw!aN_fXp" password. "The plaintext password was visible in one of the binaries on the system," the Dutch researchers said in a&nbsp;&nbsp;published before the Christmas 2020 holiday. Researchers said the account had root access to the device because it was being used to install firmware updates to other interconnected Zyxel devices via FTP.In an interview with&nbsp;ZDNet&nbsp;this week, IoT security researcher&nbsp;&nbsp;said that Zyxel should have learned its lesson from a previous incident that took place in 2016. Tracked as&nbsp;, Zyxel devices released at the time contained a secret backdoor mechanism that allowed anyone to elevate any account on a Zyxel device to root level using the "zyad5001" SU (super-user) password. "It was surprising to see yet another hardcoded credential specially since Zyxel is well aware that the last time this happened, it was&nbsp;," Anubhav told&nbsp;ZDNet. "CVE-2016-10401 is still in the arsenal of most password attack based IoT botnets," the researcher said.But this time around, things are worse with CVE-2020-29583, the CVE identifier for the 2020 backdoor account. Anubhav told&nbsp;ZDNet&nbsp;that while the 2016 backdoor mechanism required that attackers first have access to a low-privileged account on a Zyxel device — so they can elevate it to root —, the 2020 backdoor is worse as it can grant attackers direct access to the device without any special conditions. "In addition, unlike the previous exploit, which was used in Telnet only, this needs even lesser expertise as one can directly try the credentials on the panel hosted on port 443," Anubhav said. Furthermore, Anubhav also points out that most of the affected systems are also very varied, compared to the 2016 backdoor issue, which only impacted home routers.Attackers now have access to a wider spectrum of victims, most of which are corporate targets, as the vulnerable devices are primarily marketed to companies as a way to control who can access intranets and internal networks from remote locations. This is a big deal in the bigger picture because vulnerabilities in firewalls and VPN gateways have been one of the primary sources of ransomware attacks and cyber-espionage operations in 2019 and 2020. Security flaws in Pulse Secure, Fortinet, Citrix, MobileIron, and Cisco devices have often been exploited to attack companies and government networks. The new Zyxel backdoor could expose a whole new set of companies and government agencies to the same type of attacks that we've seen over the past two years.

We and our partners use cookies to understand how you use our site, improve your experience and serve you personalized content and advertising. Read about how we use cookies and your choices . By continuing to use this site, you accept these cookies.AcceptRejectUpdate ConsentMore than 100,000 Zyxel firewalls, VPN gateways, and access point controllers contain a hardcoded admin-level backdoor account that can grant attackers root access to devices via either the SSH interface or the web administration panel. The backdoor account, discovered by a team of Dutch security researchers from Eye...

public

Contributor

Catalin Cimpanu is a security reporter at ZDNet, where he covers cyber-security, data breaches, hacking, and other related topics. He previously served as security reporter for Bleeping Computer and Softpedia.

https://www.zdnet.com/meet-the-team/us/catalin.cimpanu/

Catalin Cimpanu

ZDNet is a business technology news website published by CBS Interactive, along with TechRepublic. The brand was founded on April 1, 1991, as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication owned by CNET Networks.

Backdoor account discovered in more than 100,000 Zyxel firewalls, VPN gateways | ZDNET

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS