{"id":49624,"date":"2021-07-16T09:05:53","date_gmt":"2021-07-16T13:05:53","guid":{"rendered":"https:\/\/swling.com\/blog\/?p=49624"},"modified":"2021-07-16T09:05:53","modified_gmt":"2021-07-16T13:05:53","slug":"kiwisdr-root-access-through-project-developers-backdoor","status":"publish","type":"post","link":"https:\/\/swling.com\/blog\/2021\/07\/kiwisdr-root-access-through-project-developers-backdoor\/","title":{"rendered":"KiwiSDR: Root access through project developer’s backdoor"},"content":{"rendered":"

\"\"<\/a>Many thanks to SWLing Post<\/em> contributor, Franco (K4VZ) , who writes:<\/p>\n

Just a quick note to let you and the SWLing post readers know about the news of a backdoor in the KiwiSDR software that for years “gave root to project developer”.<\/strong><\/em><\/p>\n

https:\/\/arstechnica.com\/gadgets\/2021\/07\/for-years-a-backdoor-in-popular-kiwisdr-product-gave-root-to-project-developer\/<\/a><\/p>\n

For years, a backdoor in popular KiwiSDR product gave root to project developer<\/h1>\n

Users are rattled after learning their devices and networks were exposed.<\/strong><\/p>\n

KiwiSDR is hardware that uses a\u00a0software-defined radio\u00a0to monitor transmissions in a local area and stream them over the Internet. A largely hobbyist base of users does all kinds of cool things with the playing-card-sized devices. For instance, a user in Manhattan could connect one to the Internet so that people in Madrid, Spain, or Sydney, Australia, could listen to AM radio broadcasts, CB radio conversations, or even watch lightning storms in Manhattan.<\/p>\n

On Wednesday, users learned that for years, their devices had been equipped with a backdoor that allowed the KiwiSDR creator\u2014and possibly others\u2014to log in to the devices with administrative system rights. The remote admin could then make configuration changes and access data not just for the KiwiSDR but in many cases to the\u00a0Raspberry Pi, BeagleBone Black, or other computing devices the SDR hardware is connected to.<\/p>\n

A big trust problem<\/h3>\n

Signs of the backdoor in the KiwiSDR date back to at least 2017. The backdoor was recently removed with no mention of the removal under unclear circumstances. But despite the removal, users remain rattled since the devices run as root on whatever computing device they\u2019re connected to and can often access other devices on the same network.<\/p>\n

\u201cIt\u2019s a big trust problem,\u201d a user with the handle xssfox told me. \u201cI was completely unaware that there was a backdoor, and it\u2019s hugely disappointing to see the developer adding backdoors in and actively using them without consent.\u201d [Click here to continue reading the full article…<\/a><\/strong>]<\/p>\n

Thank you for sharing this, Franco (and many other readers who’ve recently shared this article.<\/p>\n

I’ve always been a big fan of the KiwiSDR network and the receiver so, of course, this is disappointing news. It sounds as if there’s no evidence the developer did anything nefarious through this root access backdoor, but they were also well aware it existed. That is, without question, a huge security issue.<\/p>\n

The KiwiSDR developer comments here on the SWLing Post<\/em> so my hope is that, perhaps, they can shed some light on this story in our comments section.<\/p>\n","protected":false},"excerpt":{"rendered":"

Many thanks to SWLing Post contributor, Franco (K4VZ) , who writes: Just a quick note to let you and the SWLing post readers know about the news of a backdoor in the KiwiSDR software that for years “gave root to project developer”. https:\/\/arstechnica.com\/gadgets\/2021\/07\/for-years-a-backdoor-in-popular-kiwisdr-product-gave-root-to-project-developer\/ For years, a backdoor in popular KiwiSDR product gave root to project […]<\/p>\n","protected":false},"author":15,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[6,3,43,158,998],"tags":[1125,8638,4741,9365,9366,157,4087],"class_list":["post-49624","post","type-post","status-publish","format-standard","hentry","category-manufacturers","category-news","category-shortwave-radio","category-software-defined-radio","category-web-radio","tag-arstechnica","tag-franco-venturi-k4vz","tag-kiwisdr","tag-kiwisdr-root-backdoor","tag-kiwisdr-vulnerability","tag-sdr","tag-software-defined-radio"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pn3uc-cUo","jetpack-related-posts":[{"id":17847,"url":"https:\/\/swling.com\/blog\/2016\/03\/kickstarter-launch-the-kiwisdr-for-beaglebone\/","url_meta":{"origin":49624,"position":0},"title":"Kickstarter launch: The KiwiSDR for BeagleBone","author":"Thomas","date":"March 20, 2016","format":false,"excerpt":"Many thanks to SWLing Post reader and KiwiSDR developer,\u00a0John Seamons (ZL\/KF6VO), who notes: The KiwiSDR for BeagleBone Kickstarter just launched: https:\/\/www.kickstarter.com\/projects\/1575992013\/kiwisdr-beaglebone-software-defined-radio-sdr-with https:\/\/www.kickstarter.com\/projects\/1575992013\/kiwisdr-beaglebone-software-defined-radio-sdr-with Many thanks, John! Those of you who had such a positive response to our previous post about John's New Zealand-based web SDR, may consider supporting this Kickstarter and\u2026","rel":"","context":"In "Current Events"","block_context":{"text":"Current Events","link":"https:\/\/swling.com\/blog\/category\/current-events\/"},"img":{"alt_text":"Kiwi-SDR-1","src":"https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2016\/02\/Kiwi-SDR-1.jpg?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2016\/02\/Kiwi-SDR-1.jpg?resize=350%2C200 1x, https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2016\/02\/Kiwi-SDR-1.jpg?resize=525%2C300 1.5x, https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2016\/02\/Kiwi-SDR-1.jpg?resize=700%2C400 2x"},"classes":[]},{"id":43655,"url":"https:\/\/swling.com\/blog\/2020\/06\/kiwisdr-coms-simple-urls-for-popular-kiwisdr-portals\/","url_meta":{"origin":49624,"position":1},"title":"KiwiSDR.com’s simple urls for popular KiwiSDR portals","author":"Thomas","date":"June 12, 2020","format":false,"excerpt":"Many thanks to the crew at KiwiSDR.com who have made simple subdomain style forwarding links to open and explore popular KiwiSDR portals: Receiver list: rx.kiwisdr.com Map view: map.kiwisdr.com Signal-to-noise ratio based scores: snr.kiwisdr.com Thank you--this makes it so much easier to remember KiwiSDR portal addresses!","rel":"","context":"In "Ham Radio"","block_context":{"text":"Ham Radio","link":"https:\/\/swling.com\/blog\/category\/ham-radio\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/06\/KiwiSDR-Map-View.jpeg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/06\/KiwiSDR-Map-View.jpeg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/06\/KiwiSDR-Map-View.jpeg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/06\/KiwiSDR-Map-View.jpeg?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":45299,"url":"https:\/\/swling.com\/blog\/2020\/09\/kiwisdr-in-stock-again-at-seed-studio\/","url_meta":{"origin":49624,"position":2},"title":"KiwiSDR in stock again at Seed Studio","author":"Thomas","date":"September 12, 2020","format":false,"excerpt":"Many thanks to SWLing Post contributor, Richard Langley, who notes that the KiwiSDR kit is now in stock and shipping again directly from Seed Studio. Click here for the order\/product page. Thanks for the tip, Richard!","rel":"","context":"In "News"","block_context":{"text":"News","link":"https:\/\/swling.com\/blog\/category\/news\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/09\/KiwiSDR.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":43651,"url":"https:\/\/swling.com\/blog\/2020\/06\/the-sdr-hu-web-sdr-portal-is-no-more-but-we-have-several-excellent-alternatives\/","url_meta":{"origin":49624,"position":3},"title":"The SDR.hu web SDR portal is no more, but we have several excellent alternatives","author":"Thomas","date":"June 1, 2020","format":false,"excerpt":"In January, Andr\u00e1s Retzler--owner of the SDR.hu KiwiSDR portal--started requiring registration and a ham radio license in order to access their extensive online database of SDRs. Today, we learned of the site's closure.\u00a0 Here's the message posted at SDR.hu: The SDR.hu project has been finished I'd like to say a\u2026","rel":"","context":"In "Ham Radio"","block_context":{"text":"Ham Radio","link":"https:\/\/swling.com\/blog\/category\/ham-radio\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/06\/KiwiSDR-Map-View.jpeg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/06\/KiwiSDR-Map-View.jpeg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/06\/KiwiSDR-Map-View.jpeg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/06\/KiwiSDR-Map-View.jpeg?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":41505,"url":"https:\/\/swling.com\/blog\/2020\/01\/popular-kiwisdr-portal-now-requires-ham-radio-license-alternatives\/","url_meta":{"origin":49624,"position":4},"title":"Popular KiwiSDR portal now requires ham radio license: alternatives","author":"Thomas","date":"January 7, 2020","format":false,"excerpt":"Many thanks to SWLing Post contributor, Dan Robinson, who discovered via Gilles Letourneau's YouTube Channel that the popular SDR.hu KiwiSDR portal now requires registration and a ham radio callsign. I almost didn't believe this at first, but then checked on the SDR.hu FAQ page to find this message: What is\u2026","rel":"","context":"In "Ham Radio"","block_context":{"text":"Ham Radio","link":"https:\/\/swling.com\/blog\/category\/ham-radio\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/01\/SDR.hu_.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/01\/SDR.hu_.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/01\/SDR.hu_.jpg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2020\/01\/SDR.hu_.jpg?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":21542,"url":"https:\/\/swling.com\/blog\/2016\/09\/marks-multi-user-sdr-is-now-online\/","url_meta":{"origin":49624,"position":5},"title":"Mark’s multi-user SDR is now online","author":"Thomas","date":"September 26, 2016","format":false,"excerpt":"SWLing Post contributor, Mark Fahey, has just announced that his new Beaglebone-powered KiwiSDR receiver is online. \u00a0Mark notes: Please try out my multi-user 0-30MHz SDR[.]\u00a0The test system is operating from my monitoring station at Freemans Reach in south east Australia (near Sydney). [...]The test system is fully self contained and\u2026","rel":"","context":"In "Antennas"","block_context":{"text":"Antennas","link":"https:\/\/swling.com\/blog\/category\/antennas\/"},"img":{"alt_text":"mark-fahey-beagle-kiwi-sdr","src":"https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2016\/09\/Mark-Fahey-Beagle-Kiwi-SDR.jpg?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2016\/09\/Mark-Fahey-Beagle-Kiwi-SDR.jpg?resize=350%2C200 1x, https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2016\/09\/Mark-Fahey-Beagle-Kiwi-SDR.jpg?resize=525%2C300 1.5x, https:\/\/i0.wp.com\/swling.com\/blog\/wp-content\/uploads\/2016\/09\/Mark-Fahey-Beagle-Kiwi-SDR.jpg?resize=700%2C400 2x"},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/swling.com\/blog\/wp-json\/wp\/v2\/posts\/49624","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swling.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swling.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swling.com\/blog\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/swling.com\/blog\/wp-json\/wp\/v2\/comments?post=49624"}],"version-history":[{"count":0,"href":"https:\/\/swling.com\/blog\/wp-json\/wp\/v2\/posts\/49624\/revisions"}],"wp:attachment":[{"href":"https:\/\/swling.com\/blog\/wp-json\/wp\/v2\/media?parent=49624"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swling.com\/blog\/wp-json\/wp\/v2\/categories?post=49624"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swling.com\/blog\/wp-json\/wp\/v2\/tags?post=49624"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}