05.09.2024
1 min
1063
A penetration tester bought an ultra-cheap device from Temu to find out what was really hiding behind its low price. Inside, he discovered something alarming that the average buyer would never suspect.
Chinese online retailer Temu has become wildly popular thanks to its extremely low prices. A cheap Wi-Fi extender may seem like an affordable way to eliminate areas with a weak signal. However, what Keiran Smith discovered was far more serious than receiving shoes three sizes too small or trousers made from excessively thin fabric. Most concerning of all, the true cost of such savings remains hidden from most buyers.
Smith, known online as Affix, purchased a six-antenna “Wi-Fi signal booster and range extender” after seeing it in an algorithmically targeted Temu advertisement.
The OSCE3-certified penetration tester understood that, for £3, he was buying a white-label device. Such gadgets are manufactured by one company and then sold by different retailers under their own brand names. As a result, every reseller and customer inherits the security features and vulnerabilities built in by the original manufacturer.
Wi-Fi extenders occupy a particularly sensitive position within a home’s infrastructure because they connect to the same network used by personal devices and household appliances. That is why Smith decided to take one of these devices apart and find out what was inside.
Smith’s investigation began with the hardware. He identified the extender’s main processor as the MediaTek MT7620, a low-cost chip widely used in routers and Wi-Fi repeaters.
The researcher then used a Bus Pirate to copy the contents of the SPI flash memory where the device’s firmware was stored.
However, Smith discovered much more serious problems when he began analyzing the software.
Smith found that the extender contained a hidden administrator account with the highest possible level of privileges. The account’s password was hardcoded into the firmware. This means that every device running the same firmware uses exactly the same password.
Crucially, the hidden account is separate from the regular administrator password that users can change through the extender’s standard settings. Therefore, even if the owner follows basic security recommendations and sets a new password, the hidden password remains unchanged.
“It is worth explaining precisely why this is so serious, as the term ‘hardcoded password’ can cover a wide range of security failings,” Smith wrote in his Substack post.
“In this case, the password is an immutable compile-time constant rather than a value derived from the MAC address or serial number. This means it is identical on every device ever sold,” the researcher explained.
Smith also discovered another dangerous feature: a remote login service runs continuously on the device and accepts the hidden root password.
According to Smith, the combination of three issues makes the situation particularly dangerous:
A hidden administrator account that is not visible to the user and cannot normally be found or changed.
The same password on every device.
Remote access enabled by default. A potential attacker does not need physical access to the extender or the local network.
The penetration tester believes these factors combine to create a dangerous, built-in, always-on backdoor. It can be accessed remotely, while the average owner has no way of knowing it exists or disabling it through the standard settings.
“Default credentials are something the owner can see, is told about, and can change. What we have here is the opposite on every count,” Smith explained.
Even if the owner discovers the hidden account and has enough technical knowledge to change its password manually, the extender will undo the change and restore the original password after a reboot.
Smith also discovered other security issues, including a command injection vulnerability. It could allow an attacker to force the extender to execute arbitrary commands and gain complete control over the device.
In addition, the firmware update mechanism was not properly protected by cryptographic verification. As a result, an attacker could potentially tamper with an update and insert malicious code, while the device would be unable to determine that the file was not legitimate.
“None of it took a clever bug. The hardware dump was the easy part. The rest is a lesson in what ‘range extender,’ ‘£3,’ and ‘free shipping’ really costs.” Keiran Smith, independent penetration tester at Affix
Smith’s research does not prove that the hidden access mechanism was deliberately added to the inexpensive device for malicious purposes. According to the penetration tester, it may originally have been intended for factory testing or technical support and simply never removed before the product went on sale.
