Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI tells router users to reboot now to kill malware infecting 500k devices

arstechnica.com

Post reply on HN
Print view View original

101–110 of 299 posts

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#101

Post by losteric »

rgbrenner wrote: post #80
zackmorris wrote: post #30

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.

Companies should be liable for deficiencies in their commercial products... that's basic consumer protection.

Samsung had to recall and repair dangerously defective hardware - why not Cisco? Does it matter whether the public risk is in the battery or router memory?

And, imo, it follows that free OSS organizations are not liable for vulnerabilities. No money, no consumers. I think it's fair that businesses should expect to do their due diligence before blindly reusing public domain IP...

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#103

Post by PeterisP »

anf wrote: post #87
staticassertion wrote: post #86

Earlier quoted context omitted.

> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…

Is there no laws w.r.t. negligence that can be used to punish negligent actors? If a door manufacturer is negligent in their construction of the door and someone gets robbed as a result, in violation of how they expected their door to work, is there nothing currently in the law that could help them?

Just as a door being breakable by sufficient force doesn't necessarily mean that the manufacturer is negligent, the fact that some software isn't perfect (i.e. contains bugs) doesn't necessarily mean that the developers are negligent.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#104

Post by tony101 »

rgbrenner wrote: post #80
zackmorris wrote: post #30

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.

> Do you really want liability for software bugs?

For free software? No. No payment, no obligation.

For paid products? Yes. If you are selling a device, you should be liable for it, just like a car manufacturer would have liability if the brakes failed because they were improperly installed.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#105

Post by staticassertion »

tetha wrote: post #97
staticassertion wrote: post #86

Earlier quoted context omitted.

> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…

This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a wa…

> Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways.

When it comes to SOHO routers it's not as hard as it should be, by a long shot. Tons of hardcoded creds and pretty surface vulns in them.

> - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries.

Yes.

> - What happens if that library is openssl and almost all webservers on the internet are vulnerable?

Everyone deploying it is liable.

> - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library.

The company doing so is liable.

> - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally?

You are liable.

As in, the person who produces the product is liable for what they put in the product.

But, as I said elsewhere, this is all off the cuff and relies on a way to properly classify software, which is extremely hard.

But yeah, to your points, none of those feel hard to deal with at all.

I'm not a lawyer. This is not an area I'm so familiar with. But we already have some controls for CC info, and extending those further would be hard but a good start. This situation is extremely out of hand, whether I have the solution today or not.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#106

Post by fulafel »

rgbrenner wrote: post #80
zackmorris wrote: post #30

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.

> If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs?

For some bugs, that count as negligence. Sw engineering as a field knows how to make much safer products than what is in these wormable boxes.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#107

Post by staticassertion »

varjag wrote: post #96
anf wrote: post #87

Earlier quoted context omitted.

Is there no laws w.r.t. negligence that can be used to punish negligent actors? If a door manufacturer is negligent in their construction of the door and someone gets robbed as a result, in violation of how they expected their door to work, is there nothing currently in the law that could help them?

Is this sarcastic? Locks get picked and doors smashed by burglars multiple times a day.

Architects and civil engineers are held liable. I would imagine we would use a similar system, as someone with no idea how that system works.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#108

Post by rad_gruchalski »

tony101 wrote: post #104
rgbrenner wrote: post #80

Earlier quoted context omitted.

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.

> Do you really want liability for software bugs? For free software? No. No payment, no obligation. For paid products? Yes. If you are selling a device, you should be liable for it, just like a car manufacturer would have liability if the brakes failed because they were improperly installed.

A lot of these routers contain tons of oss libraries. Would it then depend on which component caused the bug? It‘s a rabbit hole.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#109

Post by dgzl »

losteric wrote: post #101
rgbrenner wrote: post #80

Earlier quoted context omitted.

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.

Companies should be liable for deficiencies in their commercial products... that's basic consumer protection. Samsung had to recall and repair dangerously defective hardware - why not Cisco? Does it matter whether the public risk is in the battery or router memory? And, imo, it follows that free OSS organizations are not liable for vulnerabilities. No money, no consumers. I think it's fair that businesses should expe…

In Samsung's case, the defects could be directly responsible for damages to human lives. That's a far reach from software vulnerabilities. Not to mention that software bugs can be incredibly difficult to identify, and sometimes impossible until new exploitation methods are discovered, often times well after the creation of the software, and sometimes only due to new software and hardware tools that only later become available.

If you ever wanted an example of how to stifle innovation, read the comment I'm replying to.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#110

Post by mikehotel »

wpdev_63 wrote: post #47

Does anyone know if this affects routers flashed with LEDE/DD-WRT?

Forums don't have anything definite yet, but you can check existing network connections (netstat/iftop) and block the known CC domains.

https://forum.lede-project.org/t/cert-advisory-vpnfilter-des...

A comment on another forum suggests OpenWRT/LEDE is not affected due to file system layout differences:

https://nakedsecurity.sophos.com/2018/05/23/vpnfilter-is-a-m...

Post reply on HN