Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI tells router users to reboot now to kill malware infecting 500k devices

arstechnica.com

Post reply on HN
Print view View original

91–100 of 299 posts

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#91

Post by hedora »

ocdtrekkie wrote: post #32
lisper wrote: post #29

Earlier quoted context omitted.

> unless you belong to a certain high risk segment of the population. I don't think we are so far from the day that "high risk" will mean anyone who opposes the government. > Mine is similar to one of the affected units, enough so that it's likely vulnerable. I'm looking at replacing it. That's probably wise.

People in an adversarial relationship with the government they live under would definitely be that segment of the population, yes.

So, 100% of the US population, based on:

- the continued militarization of police

- classifying 66% of houses as constitution-free border crossings

- holding citizens for years without charges or trial

- a for-profit prison system that engages in de facto forced labor

- criminalizing mental health issues and withholding psychiatric care from insured people.

For the record, these things have all been going on for multiple presidential administrations, and have enjoyed bipartisan support.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#92

Post by staticassertion »

chasil wrote: post #90
anf wrote: post #87

Earlier quoted context omitted.

Is there no laws w.r.t. negligence that can be used to punish negligent actors? If a door manufacturer is negligent in their construction of the door and someone gets robbed as a result, in violation of how they expected their door to work, is there nothing currently in the law that could help them?

I propose that hardware manufacturers be forced to divulge admin methods and encryption keys to their products 6 months after their software updates end. At least users can apply workarounds in that condition. As it stands, there are no options for the owner of the device.

This just shifts the burden to the users, I don't see this as a meaningful solution.

I think that there would probably need to be classifications of software.

Things like:

1) Is this infrastructure (routers, scada)

2) What level of user data is exposed to this software ? (unencrypted user data, credit card info, etc - we already do this to some extent)

3) What level of exposure exists? (NAT'd, routable, etc)

And then start imposing restrictions on software in those cases.

But this is very off-the-cuff, obviously it's far more complex than this. But someone needs to be responsible.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#93

Post by supertrope »

ronjouch wrote: post #45

What's a good affordable router well supported by Tomato/OpenWRT, these days? (put differently: 2018's version of the Linksys WRT54G :) From what I understand, alternative firmwares like Tomato & OpenWRT are not inherently safe from VPNFilter, but it seems to me the rate at which they are maintained make them less easy targets (?). So this new flaw made me think now is a good time to replace my crappy router and its…

IMO both are obsolete especially if your connection is >50Mbps. If you must DIY use pfsense on a x86 machine with Intel NIC and low idle power draw. Otherwise use Ubiquti Edgerouter or Microtik.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#94

Post by supertrope »

polshaw wrote: post #67
wrycoder wrote: post #53

Earlier quoted context omitted.

Just search for WRT54GL on Amazon. It's selling for $34.99, which is pretty affordable. N.B. the WRT54G doesn't work with Tomato.

The problem with that being a lot of people's internet is now faster than 54mbit

802.11g actual max throughput is 22Mbps, assuming you don’t live in an apartment.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#95

Post by mturmon »

DannyBee wrote: post #84
hfdgiutdryg wrote: post #73

Earlier quoted context omitted.

Boy is that ever not true. https://www.woodshopnews.com/.amp/news/table-saw-suit-nets-1... This guy was given a table saw with the guard already removed, and was using it on the floor (a table saw should be used at table height, so that you can have a foot forward to prevent falling into the blade). He was apparently not using push-sticks. Somehow, the table saw manufacturer was found 65% liable in the case, because…

One thing he misses is that PTI, et al had explored flesh sensing technology and pretty much didn't feel like doing it. They also have opposed almost all safety standards. Oh, did I mention the members have many more ridiculous patents than gass? They've sued each other over patents on worksite radios before. https://insight.rpxcorp.com/litigation_documents/3919186 They are also multi billion dollar conglomerates, of…

This was the shocker to me:

> The cost of table saw injuries, to the government and insurers, is greater than the value of the table saw market!

...making it seem like the manufacturers are just taking the profits and dumping the externalities.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#96

Post by varjag »

anf wrote: post #87
staticassertion wrote: post #86

Earlier quoted context omitted.

> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…

Is there no laws w.r.t. negligence that can be used to punish negligent actors? If a door manufacturer is negligent in their construction of the door and someone gets robbed as a result, in violation of how they expected their door to work, is there nothing currently in the law that could help them?

Is this sarcastic? Locks get picked and doors smashed by burglars multiple times a day.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#97

Post by tetha »

staticassertion wrote: post #86
rgbrenner wrote: post #80

Earlier quoted context omitted.

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.

> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…

This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways.

And even assuming we have a definition of 'infrastructure software' and a way to reliably enumerate a set of vulnerabilities, attribution of liability is even harder:

- Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries.

- What happens if that library is openssl and almost all webservers on the internet are vulnerable?

- What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library.

- On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally?

I dislike being so negative about it, but I wouldn't want to get sued for sticking an MIT license on a silly project 10 years ago someone necro'd and stuck into a router, so to say.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#98

Post by bitwize »

rgbrenner wrote: post #80
zackmorris wrote: post #30

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.

> Do you really want liability for software bugs?

GDPR has shown that inconveniencing tech companies with legal consequences for their negligence can be a net boon to society. So yes, liability for software bugs. Hell, we probably need to start licensing programmers.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#99

Post by ybrah »

hedora wrote: post #91
ocdtrekkie wrote: post #32

Earlier quoted context omitted.

People in an adversarial relationship with the government they live under would definitely be that segment of the population, yes.

So, 100% of the US population, based on: - the continued militarization of police - classifying 66% of houses as constitution-free border crossings - holding citizens for years without charges or trial - a for-profit prison system that engages in de facto forced labor - criminalizing mental health issues and withholding psychiatric care from insured people. For the record, these things have all been going on for mult…

No, he meant criminals.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#100

Post by RyanZAG »

vntok wrote: post #60
mikec3010 wrote: post #54

Earlier quoted context omitted.

Not true. Product liability lawsuits have been around for ages. It's just that the tech industry has been able to escape them, by and large. I think one of the greater injustices in business was Microsoft's avoidance of a lawsuit from their spate of windows malware from roughly 2003-2010. They just sat on their hands and let for-profit A/V companies and nonprofit volunteers secure their platform, while consumers lost…

> after being rooted by 4 lines of JavaScript Could you provide any sort of source for this extraordinary claim of yours?

Here's a fairly recent one, I guess. The 3 lines of javascript do most of the work.

https://nakedsecurity.sophos.com/2013/10/11/anatomy-of-an-ex...

Post reply on HN