OLT Devices Have Backdoor Placed Intentionally by Chinese Manufacturers, Researchers Say

Chinese-built optical line termination (OLT) devices from a company named V-SOL seem to have been built intentionally with backdoors, say security researchers who analyzed their firmware.

Most people have yet to hear about OLT devices, and that’s because they’re not visible or interesting to regular users. These devices offer fiber to the home (FTTH) connectivity, which means that, if you have high-speed internet, it’s probably going through one of these.

Lots of companies make this type of hardware, and C-DATA is just one of the vendors. According to new research from Pierre Kim and Alexandre Torres, these devices have a series of vulnerabilities, but the more troublesome part is that some of these vulnerabilities are actually backdoors left intentionally opened by the manufacturers.

The researchers looked at several models that share codebase, including V1600D, V1600D4L, V1600D-MINI, V1600G1, and V1600G2. Other models are believed to be affected as well, even if they were not directly tested, and they include V1600D2-L, V1600D2, V1600D4, V1600D4-DP, V1600D8, V1600D16, and V1600G0.

“The V-SOL OLTs are FTTH OLTs allowing to provide FTTH connectivity to a large number of clients (using ONTs),” say the researchers.

“Some of the devices support multiple 10-gigabit uplinks and provide Internet connectivity to up to 1024 ONTs (clients). We validated the vulnerabilities against V1600D4L OLT in our lab environment with the latest firmware versions (V1.01.49),” they continue.

Some of the regular vulnerabilities include common examples such as hardcoded RSA keys, command injection or just insecure management interfaces.

The main problem is the backdoor left opened, accessible with hardcoded Telnet credentials. Users only have low-privilege CLI access when logged in with these credentials, but the rights can be elevated to complete administrator CLI access with ease.

In this particular case, since the researchers believe that the manufacturers intentionally placed backdoors into the devices, they opted for full disclosure, which means that anyone with the tools and knowledge can now attack the OLT devices.