this vulnerability is unforgivable (...and hilarious?)

[@LowLevelTV]

wow that really is unforgivable. you know what else is unforgivable? not checking out lowlevel.academy (and getting a DISCOUNT?)

[@daveogfans413]

bro is talking about collars while looking like an e-pimp. cool look tho

[@End0fst0ry]

It's not a bug, it's a low effort backdoor

[@no_name4796]

The CIA was too busy trying to kill fidel castro...

[@himothaniel]

Semantic arguments are fun, but that's all they are. Backdoors target vulnerabilities. Vulnerabilities are bugs.

[@bolivianPsyOp]

I think they’re implying it was intentional

[@RaquelFoster]

@@himothanielCondescending responses to comments you don't understand are fun, but that's all they are.

[@himothaniel]

You can read condescension into my comment if you like, but there wasn't any there. A small joke went over my head. I can acknowledge that.

[@steveftoth]

This is what happens when you have 2 teams not talking to each other. One team did it right, the other not so much.

[@ArchaeanDragon]

"Buy another NAS", definitely won't be a D-Link, I can tell you that for nothing.

[@FrankEBailey]

QNAP or Synology should use this as free advertising for their newest kit

[@dieSpinnt]

@@FrankEBailey WTF are you? Buy the stuff and install firmware, that can be called that way: OpenWRT !!!

[@Exilum]

The guy who wrote the safe_system code is definitely a different person from the one who wrote account. I can't believe it is any other way

[@kapstersmusic]

Exactly. The person who wrote safe_system probably got into arguments with the person who wrote account, who told them to not to worry about it. Some manager then told them to ship it and move on. Then the manager got their bonus for delivering on time.

[@Exilum]

@kapstersmusic I would assume the person who wrote safe_system never saw what the one who wrote account did. That would be gross negligence to not replace these 4 lines with their better, ready-made equivalents. Safe string processing is part of the standard, and safe_system is just there. Even without changing the string processing, just using safe_system to make sure the exploitable buffer overflow isn't literally ready to use as-is would be 2 seconds well spent. The security researcher would have maybe spent hours instead of minutes to get a working exploit.

[@rufmeister]

The problem is not one programmer not being up to the task of writing safe code; or people talking to each other... the problem is quality assurance and testing. A company should never assume that a person doesn't make mistakes, it's about validation and testing. And D-Link apparently doesn't care enough about the quality of their products.

[@dynad00d15]

D-Link has been a security liability since the 2000's. :)

[@BotDetector-44]

As long as you keep using EoL devices, that's on you buddy

[@dynad00d15]

@@BotDetector-44 what are you taking about?

[@sootikins]

@@dynad00d15 Just ignore him - he's a D-Link salesman!

[@cooperised]

@@dynad00d15 I'm assuming that was sarcasm. I'm _hoping_ that was sarcasm...

[@BotDetector-44]

@@sootikins Right, because manufacturers update their software after 14 years from their initial release date. You guys might be some retards or a bit clueless how things work when producing hardware and software components but hey, I'm a salesman, you got me

[@play-good]

New vulnerability found in D-Link NAS devices D-Link : It's not my problem, it's yours

[@92sieghart]

@@play-good "sorry,we sold it to you,so your problem now"

[@GashimahironChl]

@@92sieghart D-Link, the last big company around that still respects ownership 🤣🤣

[@dieSpinnt]

.oO( Who did buy that s. in the first place? ... ROTFL )

[@mikaay4269]

"Fuck you, pay me" is a genius strategy when most of your customers do not have consumer protection laws

[@afjer]

And any attempt to pass consumer protection would be lobbied (read: "bribed") away by the powerful corporations that would be impacted by it.

[@mikaay4269]

@afjer this is why people become cyber criminals, stupidity

[@PXAbstraction]

As someone who has worked in both residential and corporate IT for over 20 years now, I'll never go near D-Link. Garbage products made by a company that does not care. Nothing about this situation surprises me.

[@hereticerik]

As a person that has programmed for 30+ years, that is absolutely insane. The incompetency is astounding. If D-link can't fix things like this, then don't buy D-link products, it's that simple. They clearly don't care about their customers.

[@TheInternetLord]

As a Gen-Zer even if I hated the collared shirt, that fire jacket makes up for it.

[@RaquelFoster]

It's hard to imagine a scenario where this is an isolated incident. At any competent organization, the first time something similar happened, the dev-sec-ops team would've forced all kinds of commit/deploy hooks checking for system calls and requiring the lead/PO to sign off that they weren't doing something stupid. This makes all D-Link hardware sketchy. They're not a new company, and they're not small, and they're not new to making routers.

[@kaleycrum6350]

This is actually a genius level move by D-Link: They not have to fix *past* bugs because they deem their hardware antiquated. Also! They also don't have to fix *future* bugs because they just scared away their entire customer base

[@xmine08]

So a common, old-school Shell Injection vulnerability. The Bobby Tables of system("command").

[@russellstyles5381]

For clueless - xkcd reference. Someone embedded a "Drop table" command in child's name. Deleted main database at school.

[@sundhaug92]

D-Link once made a router where the web-server ran in kernel-mode and had debug-commands

[@rikschaaf]

Prob a junior tech that was tasked to write the account script. This is why you need THOROUGH PR reviews and things like sonar to check for code smells like system and sprintf calls.

[@speedweasel]

yep. you cant just blame a junior for this. multiple people and systems had to fail to allow this code into production.

[@rikschaaf]

@speedweasel yup, a junior tech should never be blamed for something like this. If a junior dev is accidentally able to get such a bug into production, then a senior dev with bad intentions DEFINITELY would be capable of doing that as well. It's up to your pipeline engineers to make sure that CAN'T happen.

[@replicadse]

When does incompetence become sabotage?

[@ParkourGrip]

The team that wrote the "account" program assumed that their program is only going to be used by users that are already authenticated inside the machines shell. The team that wrote the HTTP server thought that the "account" program is safe to execute with parameters controlled by the unauthenticated user.

[@aieverythingsfine]

Imagine how chuffed the guy was finding this bug, like "yeah im definitley getting a payout, they will be so glad i found it!", just to be told to feck off and that the fix was buy their new products XD Poor bloke

[@jenslink9861]

But isn't connecting your NAS to the Internet an advertised feature? "Run your own cloud!"

[@flarebear5346]

Not like this. If you are going to do that then you should have security measures that can authenticate and restrict what can connect to it.

[@jenslink9861]

@@flarebear5346 Yes, I know. But which end user knows this. And now the vendor name is in the press again an they can start their next product. Always remember, "The S in IoT is for security" (Need to find this T-Shirt for next week it must be somewhere. )

[@Rovsau]

lmfao

[@newskybox]

You shouldn't have the nas open to the public internet, especially not your admin console. You'd want to have an authentication layer in front of any requests to the applications on your system, or better yet, only allow access to your system through a secure VPN. In the case of this bug, you wouldn't be able to send a request to (target IP)/cgi-bin... if it wasn't already open to the public internet (which again, it shouldn't be), but if it was or say you're connected to the same network, then your whole machine is wide open.

[@QWERTIOX]

Just run everything on the local network and have wireguard to connect to it

[@diogocruzdiniz3186]

I'm loving the channel name exploration in every video

[@bparker06]

I've never in 30 years heard of CGI "typically being a bash script or an ELF"

[@snake3837]

@@bparker06 well it was. Even PHP worked/works like that.

[@ClockDev]

In your defence, I've seen more Perl scripts as CGI than bash ones :-)

[@MorbidEel]

That is probably the case for these sorts of "UI glue for small devices"

[@cheetah2003-z5w]

A new form of forced obsolesce? Activate all the security flaws after a specific date and refuse to patch them.

[@rz2374]

is nobody going to talk about how those sprintfs probably are a buffer overflow vulnerability as well

[@steveftoth]

He did mention that in the video too but the low hanging fruit is the system call. I mean both need to be fixed and are right next to each other. Not sure how people are going to do that though, if at all.

[@mirror1766]

@@steveftoth by buying a new device - D-Link

[@wolcek]

D-link? You mean the company unable to understand how email works? Whatever they did, I'm not surprised.

First mistake they made was buying a D-link. If I see d-link device on customer’s network it has immediately to go out.

[@jearlblah5169]

We need software engineers who, like other professional engineers, can be held personally legally liable for their work. The software industry is much too lax with the rigor of their code.

[@SoftBreadSoft]

You have to have legal technical standards to have individual liabilities. No such thing in software (and good luck), so who sells the product, the company, takes liability.

[@speedweasel]

legal liability sits with company directors and officers.

[@dieSpinnt]

Your device ... your possession I really don't get it that adult man and woman are not able to install ... effing OpenWRT ! Have I uttered a secret? ROTFL

[@mrlithium69]

you're one of the most competent coders im watching on youtube if not THe best. Good job breaking this down for all the up and coming wizards

[@RandomGeometryDashStuff]

04:58 note for windows users: 7-zip file manager "Open Inside #" can also find squashfs like binwalk

[@RandomGeometryDashStuff]

note for command line 7-zip users (7zz is linux 7-zip command line version): 7zz l -t# "DLINK_DNS-340L_1.08b01(1.01.0502.2018)"

[@dieSpinnt]

@@RandomGeometryDashStuff with the same google search ... why not give OpenWRT a try? I get it, you enthusiasts stay under the foot of Mr. Chia-Jui Chang :P

[@collin4555]

Holy moly, if I can get how bad it is without rewinding, it's a really stupid bug

[@Rovsau]

D-LINK. As in the grade.

[@maosenlin4170]

I've seen more than once maintainers of very active, open source, self-hosted applications saying "our average user does not need enterprise level security features" when they refuse to implement things like mTLS support in their mobile client. Or sometimes they tell you to use treafik as your reverse proxy when you expose the service to wan, while traefik requires the docker socket in a container that is supposed to be facing internet. Absolutely unforgivable.

[@Uvuv6969]

At thjs point we need to make cyber security flaws illegal. Theres not really another way to force these companies to actually be responsible

[@someonespotatohmm9513]

The EU kinda did, atleast they force a minimum ammount of years of updates for things like vulnerabilities now.

[@Jodlkacke]

@@someonespotatohmm9513 yeah we did... on smartphones as long as they are guarantee cases. so 2 years more or less. the d-link stuff mentioned here is EoL since 2017. not really fair to blame somebody to not have updated their old ass fk. anybody here mad at Microsoft for not patching Vista anymore? no? exactly the same thing.

[@silentarcher7355]

Great breakdown of the vulnerability and the triaging process!

[@TankR]

Aaaaaand that is another final nail in the coffin for D-link anything now. I mean, on top of the surprise d-link is even a thing anymore still.... But yeah, that kind of reply, without say....releasing some source so the community can support the products they refuse to....has done exactly what they want but not how they want it. Yeah, Ill replace EVERY d-link device with NOT d-link now. Good job on the PR front d-link....morons....

[@Jodlkacke]

i mean i hate D-Link as much as the next IT-guy but this isnt really fair. the stuff is EoL since 2017. anybody here blaming any other software publisher for not updating there nearly 10 year old shit? just a good point in time to get rid of anything that has D-Link written on it.

[@corvusnocturne]

if your worried about not getting views put on a choker it'll work, trust me

[@drgabi18]

🤨📸

[@corvusnocturne]

@@drgabi18 its a proven fact, thats why so many streamers wear them and why so many vtubers have them on their models

[@drgabi18]

@@corvusnocturne Kai Saikota and Fauna are the only vtubers I know that have one, except them, I have never seen anyone with one Eric Parker has kitty headphones, so Low Level could learn from him

[@zakaryan2004]

this video literally had "no views" as he said "this video is gonna get no views"

[@shellcatt]

Like your attitude here! :) Also the colors are so fresh ;)

[@kharmachaos667]

I would wear what you're wearing. I'm not a gen z straight boy, though, so mileage varies. Great video. Amazing the exploit was so simple.

[@k7iq]

Yes, LOVE this kind of video content ! I had, within the last 4 years a consumer D-Link and ASUS router/access point in the house. Both of those were garbage. Too bad since they used to be the ones to get. Both of them broke and even a third. Can't remember which one but one of those did a complete factory reset at < 85 degrees F. I cannot trust Chinese made routers unless it is a verified decent product. Quality Control has gone to crap.

[@nombrefalso]

The best real life example that i can give of this case, is like forging a whole metal perimeter fence for your house and then installing it on the neighbors 🤣

[@federicodidio4891]

That was fun... 😂 I know you know, but I'll pointing out that at 2:34 it is just URL-encoding of plain ASCII, no Base64, so %27 is a single quotation mark and %20 is a space. I would expect the exploit to be a little bit different in the quotation style, by looking at 11:13... is it done on purpose to fool the skids? 🤔Am I blind? 😆Or maybe there was some string replacement along the way...? The stuff is pretty basic nonetheless, LOL 😁

[@chainq68k]

Honestly, whoever was working on the program account probably felt like he did not need to be safe, because it's not exposed to the web, and/or he was a junior, and they just told him "whatever do this trivial stuff", and whoever was working on the CGI felt like he did everything he could, as he was using safe_system. The two developers never talked to each other, and the only staff-level senior engineer who had the chance - if they had one at all - to catch this bug was either pulled in to some important business meeting, or was on a holiday that week. And obviously they had no security testing/review/audit process, where this could have been caught. I see these two points a bigger issue, than the fact this bug happened at all. Of course, this now gets huge feedback because DLink said "just buy another one", but I promise you, most software, especially closed one that runs the world is riddled with this kind of issues, and it's never a single developer's or even the developer team's fault, but more likely the product of the corporate culture around them, and the wrong incentives set by leadership - be it technical or managerial.

[@leok42]

8:36 that's what I call a well organized home dir!

[@GXShade]

LowLevelLearning is still the best name

[@bjorntorlarsson]

"- Does this mean that I have flawed the exam?" "- Oh no, oh no! Of course not. We are strictly DEI here. We really don't wanna get sued. You should go get another employer if you wanna do that. Here I have a list of some 'friends' that I can recommend!"

[@disieh]

I think this is partially a general Linux problem inherited from Unix, doing user management in straight C with `getpwent`, `fgetspent` and so on is difficult to do correctly (file locking and so on) so majority won't even try.

[@johnFrom1984]

How is a vendor supposed to support his entire product line for eternity? Also, who's more likely to still work at D-LINK - the one who wrote "safe_system" or the one who wrote "account"? :P

[@NetBandit70]

oh you mean that 'computing appliances' aren't like toasters, and are really just computers that need constant updates forever? but I bough this 'appliance' because it is cute and single purpose like a toaster that needs no updates ever

[@Matt0x00]

You don't need to have it facing the web right? You could create a site with that has a ton if images or s and spry the ip range to find the router.

[@Exilum]

I'm on the older side of Gen Z but I absolutely despise *wearing* collared shirts. Though I don't mind you having one. It's not tight too, so it doesn't feel like I'm getting choked just by watching.

[@brianramsey414]

There needs to be a law, making these tech companies put expiration dates on their products like our food.

[@ro-kg5vb]

This is so easy to prevent. We use automatic code checks so this will not go into the product. It's also possible to use #define to break the build if some forbidden things are used. This is the real problem here. They don't have processes to prevent that bug so there also will be much more similar bugs.

[@henrygrechcini]

Are you tempted to fix the vulnerability and release an update?

[@ejennings98]

I could not see the collar on your shirt due to the hoodie. I think it was a cool use of obfuscation

[@H1contr4st]

What youre seeing here is someone who understands this vulnerability, then they made the effort to make the code appear like its protected, then blatantly disregarded that and atill allowed it through. I would call ethics into question here. Dlink needs to be audited...

[@v12alpine]

Even with the stupid bug the most basic thing called input sanitation would have stopped it.

[@DerekSmit]

I once tested a web application where to change your password you could enter a new one without giving the old one. Even worse it was over a get request. So you could basically inject a custom get request in any website and just lure a logged in user to your website so it would change their password without them knowing.

[@terryniachos950]

Great stuff! BTW what font are you using in terminal? I absolutely love it!

[@minigamer4262]

What happened to LowLevelLearning btw

[@J.erem.y]

Serious question, how long does everyone think a manufacturer should support a product?

[@emperorall]

That sweatshirt is unforgivable.

[@jacob_90s]

Is there an actual way to pass a system call, where rather than having to pass a single string that the shell/OS has to parse the arguments out of, you can pass an array of strings containing the arguments? Seems like that would be the safer way.

[@maciejzettt]

It's like some home-brew php websites in 2000s calling eval() on user input 😅

[@eyezikandexploits]

I have a project that scans random ip's and gets all html titles and greps out d-link, along with many other but i have a list of like 3,000 d-link servers in a file somewhere

[@windyozoner7077]

It is made on purpose.

[@novousabbott4926]

Request: Bring back Low Level Learning! It just sounds nicer

[@mrpocock]

This will continue until companies are legally and monetarily liable.

[@CristalCorp]

you are a person I appreciate. Thank you

[@TracyNorrell]

These devices were first released 11 years ago, and went end of support in 2021, right? I'm a little confused by your reaction to d-link not offering a firmware update for something. Can you help me understand how long a manufacturer should support firmware that is years past it's EoS/EoL?

[@tranthien3932]

Bought a D-Link NAS, got the vulnerability, showed to D-Link to get the "You should have bought a newer system" treatment... And we still say AI will doom us all,... idk what worse than this.

[@potat0-c7q]

Just because you bought a product once, doesn't mean they have to keep writing updates for it forever. Also, who the hell is making their NAS face public IP space?

[@FinnySpam]

don't worry, elder gen z doesnt mind collars, shirts or necklaces!

[@crusaderanimation6967]

HOT TAKE: If vendor stops supporting product because if it's out of live even with such security critical cases, we as society should stop supporting copyrights related to it. Granted here not that much is to protect, but if there's any copyright protection on that code, it should vanish, reverse engineering ? Producer orphaned it, we're not gonna prevent people to adopt this child. Re distributing binaries ? If it's not worth for you to fix it it's not worth to us to chase people that copied it.

[@zimmerderek]

It's very easy to tell how this bug happened. It's not unexplainable. They used cheap contractors that didn't talk to each other.

[@tomersch13]

Now as someone who work in the secure network world i mit ask... Is that code only in the old versions or is a code no one bother to check since then and it in all the new systems as well?

[@mrpocock]

Exec commands should not accept non-sanitised strings. It should just not support it at the type level.

[@LuNemec]

I think your "I cant even" just entered the memeland.

[@blu12gaming44]

D-Link: Buy our *new* products or get pwned.

[@jkobain]

IIRC, they've been doing this to their product for… more than a decade, I guess?

[@markusmiller3500]

typical D-LINK move... I never bought a D-LINK product ever again, after I found out that the user support to their products back then was done by community members (they told me to fuck off, because of an equally ridiculous hardware issue)

[@logiciananimal]

It tells you that not only did one person think this cascade of problems was ok, but either there are no peer reviews or automatic checking there or they were overridden somehow. Both are bad.

[@gydo1942]

D-link security is horrible, one of their routers had a massive hole where the devs seemingly forgot to remove "command.php" in the release firmware. It does exactly what you think it does, and even without needing a password!

[@СергейМакеев-ж2н]

bsc_lan.php?NO_NEED_AUTH=1 Can you guess what this one does?

[@d_shepperd]

How is requiring one to buy a new NAS different than Microsoft insisting one has to buy a new computer in order to keep getting updates on Windows 10? Just curious. Shouldn't one be equally outraged?

[@cluberti]

Not to be "that guy" but these affected hardware platforms were released between 2011 (the 32x devices) and 2014 (340L) - how long *should* a manufacturer support software for a device that was sold that cheaply? I'm curious because while I understand this vulnerability is bad, the fact that they're not patching it on some hardware models that they shipped 10-13 years ago shouldn't really be a knock against them - only the vulnerability being this simple and destructive. Saying they're saying "f off" because they won't update software on some almost 14 year old NAS devices seems a bit unfair and distracts a bit from the discussion around the vulnerability itself.

[@timotheos0190]

This bug shows that their code is ( guess it) 😂

[@Aguyinachair]

​@@cluberti another way to think about it is that this bug has been around for 10+ years. D-link should be fixing this out of principle alone. Otherwise why would anyone trust with their products in the future? The fact that they dont care at all about this pretty simple exploit is a major red flag for any of their existing products. Points to a lack of basic security hardening in their products. Imo it shows theyre too focused on making and selling new and shiny things. Instead of products youd feel okay about on your network I should add that I never particularly liked D-link already. Feeling pretty justified ngl

[@GashimahironChl]

@@Aguyinachair D-Link gear was always bottom tier garbage and that's probably why you don't like it, or been taught not to like it, but having sloppy code that creates pretty glaring security flaws was the final nail in that cheap coffin.

[@jackhandyy]

So, you can easily fix the bug by calling the safe system instead of system?

[@apedanticpeasant1447]

I will never again in my life buy D-Link equipment and will encourage all of my clients to do the same.

[@apedanticpeasant1447]

Anyone who doesn’t take security seriously has no business being a vendor. Samsung and SONOS I’m looking at you.

[@BuzzKillingtonne]

lmao. don't buy anything Dlink? got it. I just can't believe they would go through the effort of securing it only to fall flat on their faces like that. and it's such a simple fix yet they refuse to fix it. IMO they should have to fix it like how car manufacturers have to do safety recalls, this code should never have shipped in the first place.

[@BaileyMagikz]

me forgetting D-link existed 😂 well d-link thats one way to advertise yourself for free 🤣

[@RottenMuLoT]

To be fair, I understand that at some point you don't have the resources and the will to fix all this. For example, imagine D-Link filled for bankruptcy (which should have happened already but). My point is, open source it! The law should be so that if something goes "out of support" then it must be open-sourced. This whole video would have been more straight forward and the fix would have been released already. Btw, there is such a custom firmware for DNS-xxx and it is named Alt-F.

[@Lucas2RC]

So... bug resulted from a program/code made to prevent this type of bug. There is a bug in your bug. And such great manufacturer posture, congrats, no more DLink for my future purchases.

[@dumaskhan]

And it is going to get worse. We are now entering into the age of deregulation. Want clean water? pay us beech. want security on your devices? pay us beech. you want to live? oh hahahahah! fun fact, Ubuntu, in my native language is a word you use to describe "things" as in "small little things". You could also use it to describe people you consider "small"

[@nordgaren2358]

Amazing. But C devs will say this is a "skill issue" and that we don't need a modern safe language...

[@nathanbanks2354]

I'm sure you could do something this stupid in php or rust or anything else too.

[@arekusei9580]

well, it is really a skill issue. You can have a bug like this in any language

[@GashimahironChl]

This is literally a skill issue though

[@nordgaren2358]

@@nathanbanks2354 you can do something this stupid in Rust, too, but if you do, you deserve it, and everything that comes with it.

[@nordgaren2358]

C devs cry about this being a skill issue, but literally cannot learn Rust because of the borrow checker. Sure, you can do this easily in Rust, but it's also no a language that will allow you to compile any braindead code, which filters out a lot of people.

[@МаркБорман-ь7е]

I have only 1 quastions: 1) that a heck is gen z means? we love you Low Level - keep do what u do; thx a lot

[@simonmaracine4721]

Generation Z are the people who were born between year 2000 and 2010. Many only recently started getting into adulthood. There is also generation Y and X, who are older than Z, and generation alpha, who is younger.

[@richardodonoghue2178]

Whoever wrote that should have been fired ..

Dollarama Macklemore with the cyber sec news!

[@OVERKILL_PINBALL]

So DNS-321 and DNS-323 is in the clear?

[@russellstyles5381]

So D-Link is the Hertz of computers. Bet they rent from Hertz.

[@seedmole]

genuinely hilarious lol, peak passing-the-buck monkeys-on-typewriters kinda error