Forscher stellen fest, dass chinesisches KVM über ein undokumentiertes Mikrofon verfügt und mit in China ansässigen Servern kommuniziert – der nanoKVM-Switch von Sipeed weist weitere schwerwiegende Sicherheitslücken auf und ermöglicht Audioaufzeichnung, behauptet Forscher

> More troubling, the encryption key used to protect login passwords in the browser is hardcoded and identical across all devices. According to the researcher, this had to be explained to the developers “multiple times” before they acknowledged the issue.

Malicious ignorance or genuine stupidity?

> The NanoKVM’s network behavior raises further questions, as it routes DNS queries through Chinese servers by default and makes routine connections to Sipeed infrastructure to fetch updates and a closed-source binary component. The key verifying that component is stored in plain text on the device, and there is no integrity check for downloaded firmware.

> The underlying Linux build is also a heavily pared-down image without common management tools, yet it includes tcpdump and aircrack, utilities normally associated with packet inspection and wireless testing rather than production hardware intended to sit on privileged networks.

> All this, paired with the discovery of a tiny surface-mount microphone, should make any user suspicious of the device’s true intentions.

My hope is that the try-hard tech nerds who would use something like this would know to do research on any device that they’re plugging into their network. But even plugging it into a segmented network wouldn’t protect from the microphone if it still has internet access.

Whole thing is fucked.

[Response to concerns about NanoKVM security](https://github.com/sipeed/NanoKVM/issues/301)