Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI tells router users to reboot now to kill malware infecting 500k devices

arstechnica.com

Post reply on HN
Print view View original

111–120 of 299 posts

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#111

Post by inetknght »

tetha wrote: post #97
staticassertion wrote: post #86

Earlier quoted context omitted.

> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…

This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a wa…

Do you sell the product? If you don't, why is this a concern? I think the parent's arguments are for software that's being sold, not just random silly project that you don't care about (which is obvious if you don't sell it).

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#112

Post by losteric »

tetha wrote: post #97
staticassertion wrote: post #86

Earlier quoted context omitted.

> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…

This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a wa…

Safety liability follows and ends with the chain of financial transactions.

No commerce, no liability.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#113

Post by tony101 »

nfoz wrote: post #14
jacksmith21006 wrote: post #11

Glad now have Google WiFi. Most secure consumer router you can get, imo.

How would you know if this were true? Is it just branding/reputation? I use a peplink, which doesn’t target the “consumer” market. Is that better? Seems impossible to know.

According to Google, their consumer routers get automatic security updates.[1] While I don't necessarily trust everything that Google says, I do believe in their ability to secure devices better than most other consumer router vendors.

[1] https://support.google.com/wifi/answer/6309220?hl=en

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#114

Post by jey »

supertrope wrote: post #94
polshaw wrote: post #67

Earlier quoted context omitted.

The problem with that being a lot of people's internet is now faster than 54mbit

802.11g actual max throughput is 22Mbps, assuming you don’t live in an apartment.

It's usually 802.11ac

EDIT: oops, thanks

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#115

Post by tony101 »

rad_gruchalski wrote: post #108
tony101 wrote: post #104

Earlier quoted context omitted.

> Do you really want liability for software bugs? For free software? No. No payment, no obligation. For paid products? Yes. If you are selling a device, you should be liable for it, just like a car manufacturer would have liability if the brakes failed because they were improperly installed.

A lot of these routers contain tons of oss libraries. Would it then depend on which component caused the bug? It‘s a rabbit hole.

No matter which component caused the bug, the device vendor that made the final product should always be responsible, unless it has a contract outsourcing the responsibility for a specific component to another entity. If the vendor simply used open source libraries, then it needs to review and take responsibility for the code, or hire a contractor to do so. This might also incentivize them to provide timely security updates, in order to minimize damages.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#116

Post by losteric »

dgzl wrote: post #109
losteric wrote: post #101

Earlier quoted context omitted.

Companies should be liable for deficiencies in their commercial products... that's basic consumer protection. Samsung had to recall and repair dangerously defective hardware - why not Cisco? Does it matter whether the public risk is in the battery or router memory? And, imo, it follows that free OSS organizations are not liable for vulnerabilities. No money, no consumers. I think it's fair that businesses should expe…

In Samsung's case, the defects could be directly responsible for damages to human lives. That's a far reach from software vulnerabilities. Not to mention that software bugs can be incredibly difficult to identify, and sometimes impossible until new exploitation methods are discovered, often times well after the creation of the software, and sometimes only due to new software and hardware tools that only later become…

My admittedly ambiguous threshold is "significant impact to quality of life"

Battery fires can kill so even a handful is significant, but a security vulnerability that impacts thousands of routers has lower but wider impact. Some companies will be targeted for DDoS or using the routers to probe and infect the company infrastructure... some consumers will end up paying ransomware, or having their finances hacked, or personal info leakes, or bandwidth siphoned.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#117

Post by DannyBee »

mturmon wrote: post #95
DannyBee wrote: post #84

Earlier quoted context omitted.

One thing he misses is that PTI, et al had explored flesh sensing technology and pretty much didn't feel like doing it. They also have opposed almost all safety standards. Oh, did I mention the members have many more ridiculous patents than gass? They've sued each other over patents on worksite radios before. https://insight.rpxcorp.com/litigation_documents/3919186 They are also multi billion dollar conglomerates, of…

This was the shocker to me: > The cost of table saw injuries, to the government and insurers, is greater than the value of the table saw market! ...making it seem like the manufacturers are just taking the profits and dumping the externalities.

To be fair, it depends on what you consider to be the market. A lot of what used to be done here is now automated. For example, panel dividing:

https://www.homag.com/en/products/cutting/

https://youtu.be/ujgLsZZlOQg

This stuff is now very cheap. They are talking about the jobsite and home market, and if you compare that to what these videos show, yeah it's wildly unsafe

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#118

Post by losteric »

zackmorris wrote: post #30

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?

I don't think they should be fined, but they should be required to fix security vulnerabilities.

Default passwords are a vulnerability, and defective by design is not an excuse...

My Netgear router came with a secure unique password printed on a card, an internal-only admin panel, and UPnP disabled by default. It's not hard.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#119

Post by DougN7 »

staticassertion wrote: post #105
tetha wrote: post #97

Earlier quoted context omitted.

This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a wa…

> Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. When it comes to SOHO routers it's not as hard as it should be, by a long shot. Tons of hardcoded creds and pretty surface vulns in them. > - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review…

I have a very hard time believing you’ve developed software that has been released. I’ve always done my very best to release robust and stable software, and I’ve still shipped bugs. Should I be sued out of existence?

We don’t need hardware and software costs spirally out of control like healthcare because of the liability. If device makers would just support their products (bug fixes) for 10(?) years I think that would do it.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#120

Post by namibj »

tony101 wrote: post #115
rad_gruchalski wrote: post #108

Earlier quoted context omitted.

A lot of these routers contain tons of oss libraries. Would it then depend on which component caused the bug? It‘s a rabbit hole.

No matter which component caused the bug, the device vendor that made the final product should always be responsible, unless it has a contract outsourcing the responsibility for a specific component to another entity. If the vendor simply used open source libraries, then it needs to review and take responsibility for the code, or hire a contractor to do so. This might also incentivize them to provide timely security…

You need to bundle mandatory, sizable insurance as a requirement for getting the license to sell/not selling illegally (i.e., treat the device as illegal as an insurance provider who is not licensed to sell insurance, not as an unlicensed medical doctor). The insurance would make the vendor fix his shit. And he can't just chicken out. Make some way for sufficiently large companies to self-insure, or they will be mad. If they don't get mad, they probably like the reduction in competition.
Post reply on HN