Packet One has a backdoor too

The big tech (and privacy !) news of yesterday was the exposure of a second super administrator access to Telekom Malaysia’s Unifi (HSBB) service. First discovered by rizvanrp, and posted to lowyatt.net, it exposes the existence of a second level of access, and how to trivially guess the username and password used to access it.

As expected, there was an outcry from Unifi users (all 1,700 of them) about this possible invasion of privacy. While TM must be commended for responding quickly to this with a solution which seems fair, it highlights the lack of care when it comes to security by service providers.

It is highly irresponsible to deploy edge and access networking equipment in a customer premise, with a direct connection to their internal LANs, and allow this backdoor to exist. Especially since the authentication credentials are default across all installations and easy to guess.

Remote access definitely simplifies remote management and maintenance, but this flexibility must be limited by secure policies which protects both the Unifi network and the customer’s data infrastructure.

However, this policy of having a second super administrator account which is hidden from users is not exclusive to TMNet alone. Packet One does the same thing for the CPE WiMAX modems they deploy in homes and offices too.

In my private email correspondence with them, I’ve asked for this access to be given to me. Their initial response was to stall and refuse, but after mutiple complaints about their service quality (or lack thereof !), they finally relented and instead created a specialized access profile for me. However, this in no way is as complete and comprehensive as the super administrator access which they have refused to give up.

One wonders of the real reasons why they keep this hidden from users, and their refusal to allow users access into a device which sits on a private LAN infrastructure. Does Packet One also claim this for maintenance reasons ? If so, why not use monitoring solutions which are SNMP or agent based instead of directly logging in ? Isnt the very existence of this super administrator account a security loophole, both from personnel within Packet One and anyone else ?

For the record, this super administrator access is possible with some rudimentary technical manipulation of the boot process of the CPE WiMAX modem by technically savvy individuals, so in essence it really doesnt do much to prevent ordinary users from getting to it.

Perhaps it would do Packet One some good to take a leaf out of TMNet’s handling of this issue and come clean, before this situation blows up into a full fledged security incident.

Dare we hold our breath in waiting for them to respond ?