Researcher finds Chinese KVM has undocumented microphone, communicates with China-based servers

[6Foot2]

Link: Researcher finds Chinese KVM has undocumented microphone, communicates with China-based servers [Tomshardware.com]

 

Quote

A Slovenian security researcher has published an analysis of Sipeed’s NanoKVM that raises far-reaching concerns about the €30-€60 ($35-70) remote management device. Alarmingly, the researcher’s teardown shows the device ships with a catalogue of security failures and an undocumented microphone that can be activated over SSH.

 

The compact RISC-V board, which arrived on the market last year as a budget alternative to PiKVM, offers HDMI capture, USB HID emulation, remote power control, and browser-based access to a connected PC. It is beginning to show up in IT environments precisely because it requires no software on the target machine and can operate from BIOS to OS install.

 

The researcher says the device’s software stack exposes weak points from the moment it boots. Early units arrived with a pre-set password and open SSH access, a problem the researcher reported to Sipeed and which the company later corrected. The web interface still lacks basic protections, including CSRF defence and any mechanism to invalidate active sessions...