<story><title>Walmart router, others on Amazon, eBay have hidden backdoors to control devices</title><url>https://cybernews.com/security/walmart-exclusive-routers-others-made-in-china-contain-backdoors-to-control-devices/</url></story><parent_chain><item><author>heavyset_go</author><text>If Walmart sold products that were contaminated with lead, and people got sick, they would still be held liable even if they didn&amp;#x27;t manufacture the products themselves.</text></item><item><author>kortilla</author><text>It doesn’t sound like the back door was put in for Walmart to use. So no, Walmart shouldn’t be slammed for this vulnerability anymore than for the vulnerabilities in the PCs they sell.</text></item><item><author>javajosh</author><text>Am I the only one who thinks that Wal-Mart should be absolutely &lt;i&gt;slammed&lt;/i&gt; for doing this? Like, they are a corporation actively participating in the material worsening of our national security. I don&amp;#x27;t even want to &lt;i&gt;think&lt;/i&gt; about a threat model that includes undermined router hardware! If they can&amp;#x27;t be patched remotely those things need to be recalled, destroyed, and Wal-Mart fined significantly.&lt;p&gt;(When I say slammed I mostly mean &amp;quot;pay big fines&amp;quot;, maybe jail time if the flaw was known, and it should result in real reputational damage to Wal-Mart and its willingness to sell anything with a network connected computer in it. At the very least, if the buy cost is even less than the china price, that difference is coming from somewhere. Wal Mart should have spotted that.)</text></item></parent_chain><comment><author>floatingatoll</author><text>Only if Walmart failed to apply a level of diligence sufficient to protect against lead exposure risk, a known risk with laws in place demanding appropriate care and notification and recalls.&lt;p&gt;What is the industry-accepted, “will pass muster by a judge and jury”, level of due diligence that is considered minimally acceptable when purchasing Internet-connected devices from a supplier for resale to consumers?&lt;p&gt;The current answer as I understand is, simply, “no level of due diligence is expected with regards to network functionality, as the relevant UL&amp;#x2F;CE standards for ‘networking’ only concern themselves with RF interference at most”.&lt;p&gt;Should all computer resellers of any business size, whether Walmart nationwide or PC Hand-Me-Downs in a single city, be required to hire specialists to disassemble device firmwares for auditing purposes? Should this burden be placed on importers? Is this even legal under the DMCA?&lt;p&gt;Should the UL certification be found at fault here, since clearly they did not audit nor certify the device’s preinstalled firmware?</text></comment>
<story><title>Walmart router, others on Amazon, eBay have hidden backdoors to control devices</title><url>https://cybernews.com/security/walmart-exclusive-routers-others-made-in-china-contain-backdoors-to-control-devices/</url></story><parent_chain><item><author>heavyset_go</author><text>If Walmart sold products that were contaminated with lead, and people got sick, they would still be held liable even if they didn&amp;#x27;t manufacture the products themselves.</text></item><item><author>kortilla</author><text>It doesn’t sound like the back door was put in for Walmart to use. So no, Walmart shouldn’t be slammed for this vulnerability anymore than for the vulnerabilities in the PCs they sell.</text></item><item><author>javajosh</author><text>Am I the only one who thinks that Wal-Mart should be absolutely &lt;i&gt;slammed&lt;/i&gt; for doing this? Like, they are a corporation actively participating in the material worsening of our national security. I don&amp;#x27;t even want to &lt;i&gt;think&lt;/i&gt; about a threat model that includes undermined router hardware! If they can&amp;#x27;t be patched remotely those things need to be recalled, destroyed, and Wal-Mart fined significantly.&lt;p&gt;(When I say slammed I mostly mean &amp;quot;pay big fines&amp;quot;, maybe jail time if the flaw was known, and it should result in real reputational damage to Wal-Mart and its willingness to sell anything with a network connected computer in it. At the very least, if the buy cost is even less than the china price, that difference is coming from somewhere. Wal Mart should have spotted that.)</text></item></parent_chain><comment><author>cogman10</author><text>Seems analogous the child labor and slave problem.&lt;p&gt;Walmart keeps on getting caught selling unethically produced goods.  We need stronger laws to punish them when that happens.  It doesn&amp;#x27;t seem to be enough to allow them to self govern.&lt;p&gt;Ditto for the likes of Amazon.</text></comment>