Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI tells router users to reboot now to kill malware infecting 500k devices

arstechnica.com

Post reply on HN
Print view View original

241–250 of 299 posts

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#241

Post by subway »

amarkov wrote: post #179
rebuilder wrote: post #134

Earlier quoted context omitted.

It seems to me this is one of those situations where the programmer mindset does not properly interface with the lawyer mindset. In programming, you have true and false, and generally things fall into one or the other category with no human input. In law, you have concepts like "reasonable", and a whole lot of human input, by design. So my expectation would be that if software vendors were to be held responsible for…

On the contrary, it's the legal perspective that's most worrying. If every software bug carries the potential for liability, there's no way your legal department will let you have a widely-visible bug tracker, or easily report bugs at all. It'd be much like copyright violations are treated today, where there's a formal process to raise the issue and everyone's specifically trained not to discuss them openly.

What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it?

Change the phrase "software bug" to "engineering error". Then consider the liabilities involved with the manufacture of any real-world-might-kill-someone product. The lawyer's view starts to make a helluva lot more sense.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#242

Post by ehsankia »

degenerate wrote: post #7

"There's no easy way to determine if a router has been infected. It's not yet clear if running the latest firmware and changing default passwords prevents infections in all cases." Antivirus provider Symantec issued its own advisory Wednesday that identified the targeted devices as: Linksys E1200 Linksys E2500 Linksys WRVS4400N Netgear DGN2200 Netgear R6400 Netgear R7000 Netgear R8000 Netgear WNR1000 Netgear WNR2000…

What about if you were running a custom firmware like Tomato? I'm surprised there's still so little info on this.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#243

Post by huhlig »

tetha wrote: post #97
staticassertion wrote: post #86

Earlier quoted context omitted.

> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…

This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a wa…

OSS libraries are almost always shipped with a no warranty license. Your router however is not. The Vendor shipping a hardware product IS responsible for the quality and safety of that product. By shipping libraries as part of their product with a no warranty liability to lower their costs they absorb the liability.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#244

Post by chuckdries »

ronjouch wrote: post #45

What's a good affordable router well supported by Tomato/OpenWRT, these days? (put differently: 2018's version of the Linksys WRT54G :) From what I understand, alternative firmwares like Tomato & OpenWRT are not inherently safe from VPNFilter, but it seems to me the rate at which they are maintained make them less easy targets (?). So this new flaw made me think now is a good time to replace my crappy router and its…

I've stopped trying to find routers with OSS support, it's too much of a pain in the ass. Instead, I got a Core 2 Duo based used Dell Optiplex from my local university's surplus store for $10, threw a second nic in it, and installed PFsense. Sure, it's bigger than a consumer router, but PFSense is battle tested and it's really fast. I use a Ubiquity UniFi access point to provide wireless capability.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#245

Post by namibj »

bsamuels wrote: post #188
vntok wrote: post #60

Earlier quoted context omitted.

> after being rooted by 4 lines of JavaScript Could you provide any sort of source for this extraordinary claim of yours?

I won't provide a source but i'll provide a modified real life example, since i'm pretty sure this vuln is still in the wild. I was doing a pen test on a router whose manufacturer decided it would be an OK idea to use GET requests to launch their ping diagnostic tool on their router's unauthenticated QA web interface. this ping diagnostic tool was triggered by doing GET http://192.168.1.1/diagnostic/trace&ip=X.X.X.X…

It might even be an evil pixel... E.g., worse than javascript-requiring exploits.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#246

Post by frankzinger »

dboreham wrote: post #169
pilsetnieks wrote: post #59

Earlier quoted context omitted.

So critical that they'd leave the web interface running on public IPs without firewalling? If not then they're probably safe.

Is it known that the vulnerability is in the web UI? I ask because the CERT report advised to disable/ACL web UI but it didn't (afaik) say that this was the attach vector. They might have just thrown that in as sound general advice.

From their official forum post[1]:

"Your devices are safe if the port 80 is firewalled, or if you have upgraded to v6.38.5 or newer."

[1] https://forum.mikrotik.com/viewtopic.php?f=21&t=132499

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#247

Post by frankzinger »

wtallis wrote: post #172
supertrope wrote: post #93

Earlier quoted context omitted.

IMO both are obsolete especially if your connection is >50Mbps. If you must DIY use pfsense on a x86 machine with Intel NIC and low idle power draw. Otherwise use Ubiquti Edgerouter or Microtik.

Ubiquiti is overpriced and Mikrotik is underpowered. There are good consumer routers that have 802.11ac for the price of a wired-only Ubiquiti router. If you're comfortable installing OpenWRT, it still offers more capabilities for a lower price than those "prosumer" brands that pretend to be real enterprise-grade stuff.

Mikrotik is underpowered in what sense? Computing power or router features?

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#248

Post by jake_the_third »

ComodoHacker wrote: post #227
WalterBright wrote: post #180

Earlier quoted context omitted.

It's really too bad that nobody makes hardware with the obvious solution - put the firmware in ROM. Then it cannot be altered by malware. If the vendor really, really wants to update the firmware, have the write-enable switch be a physical one, not a software switch.

You really want vendor to patch vulnerabilities in firmware without pushing any buttons.

And you really don't want malicious actors to push malware to vulnerable firmware without pushing any buttons.

When firmware can't fully trust itself (and it cant), the correct option is to deffer ultimate judgement and control to the physical owner.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#249

Post by all_blue_chucks »

WalterBright wrote: post #231
all_blue_chucks wrote: post #205

Earlier quoted context omitted.

Most HTTP libraries verify certificates by default. That's all you really need to do...

Doesn't look like that stopped the router malware from installing itself.

Citation that they have an auto-update that verifies certificates?

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#250

Post by justinhj »

zackmorris wrote: post #30

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?

Why aren’t door manufacturers held responsible when a home is burgled? The locks can be picked, the door is weak enough to kick it open? The fact is you can’t make an unpickable lock or an inpentrable door. You also can’t make a sophisticated device like a router, with many features, unhackable
Post reply on HN