Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI tells router users to reboot now to kill malware infecting 500k devices

arstechnica.com

Post reply on HN
Print view View original

251–260 of 299 posts

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#251

Post by gwbas1c »

rgbrenner wrote: post #80
zackmorris wrote: post #30

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.

> Do you really want liability for software bugs?

Depends on the nature of the bug, certain kinds of security holes are well known and should come with liability. Examples: SQL injection, default passwords, no encryption of sensitive information on the wire, no permission checks.

Some of these kinds of bugs are so well known that I don't see how someone could argue against liability.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#252

Post by learc83 »

AnthonyMouse wrote: post #233
staticassertion wrote: post #228

Earlier quoted context omitted.

> Cisco hasn't owned Linksys in years I didn't say they did... I was providing two examples. I wouldn't call linksys tiny, either. You're assuming a lot about the costs of this liability for a made up law with no defined penalty. Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial?

> I didn't say they did... I was providing two examples. But Cisco (i.e. Talos) are the ones finding the vulnerabilities in routers made by other companies in this case. > Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial? They still would be companies though. That's the point. If they expect to be out of business by then regardless, or they're…

>Regulation and liability only works against monopolies and other huge companies.

That's not true at all. Many industries that are very competitive and are full of small companies are effectively regulated.

>There is no blood to be had from that stone.

There's a simple fix to this problem. You require companies to carry insurance to cover the problems you're talking about. We do it with general contractors, doctors, tree removal companies etc...

The regulation says it's illegal to manufacturer, sale, or distribute non-licensed routers, and part of the requirement for licensing is insurance.

I'm not saying that this is necessarily the best course of action in this instance, but there are definitely time tested solutions for the problem you're describing.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#253

Post by wtallis »

frankzinger wrote: post #247
wtallis wrote: post #172

Earlier quoted context omitted.

Ubiquiti is overpriced and Mikrotik is underpowered. There are good consumer routers that have 802.11ac for the price of a wired-only Ubiquiti router. If you're comfortable installing OpenWRT, it still offers more capabilities for a lower price than those "prosumer" brands that pretend to be real enterprise-grade stuff.

Mikrotik is underpowered in what sense? Computing power or router features?

Compute power, mostly. The hEX and RouterBoard products are mostly single-core MIPS processors in the 600-800MHz range, with a few using the dual-core 880MHz MIPS chip from Mediatek. You have to go all the way up to the $180 RB3011 to get a decent dual-core 1.4GHz ARM, or you could get that same CPU in a TP-Link router for $125 and also get dual-band WiFi (though admittedly, half as many Ethernet ports, but the second 5-port switch in the RB3011 certainly isn't worth the price difference).

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#254

Post by 8bitsrule »

WalterBright wrote: post #180
drchiu wrote: post #5

Earlier quoted context omitted.

A factory reset, according to Cisco, will fix it. Correction: according to the original report a reset will mitigate the stage 2 and 3 attack only Source: https://blog.talosintelligence.com/2018/05/VPNFilter.html?m=...

It's really too bad that nobody makes hardware with the obvious solution - put the firmware in ROM. Then it cannot be altered by malware. If the vendor really, really wants to update the firmware, have the write-enable switch be a physical one, not a software switch.

Heh. I'm so old, I can remember that only time, ever, that a vendor sent me an upgrade hardware and a box to return the old one in. (Don't remember which vendor, only that it wasn't a rich one.)

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#255

Post by 8bitsrule »

haldean wrote: post #78
wrycoder wrote: post #53

Earlier quoted context omitted.

Just search for WRT54GL on Amazon. It's selling for $34.99, which is pretty affordable. N.B. the WRT54G doesn't work with Tomato.

The WRT54 is dog slow by today's standards. My residential Comcast service is faster than it can handle; my max down almost doubled when I swapped my WRT54GL for an AC3200

A few years ago I used my 54G to DL a 15GB file at (a reported max of) 60Mb/s. Obviously took a while ... without hiccups. I'm guessing most US customers aren't getting service that fast ... so there's still plenty of use for them. (Still use one all day at 25Mb/s.)

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#256

Post by WalterBright »

all_blue_chucks wrote: post #249
WalterBright wrote: post #231

Earlier quoted context omitted.

Doesn't look like that stopped the router malware from installing itself.

Citation that they have an auto-update that verifies certificates?

I have no idea. But obviously that simple solution is not so simple:

1. it is not trivial to produce

2. there could be vulnerabilities in the crypto implementation (like that never happens!)

3. there could be buffer overflow attacks that let the malware bypass the crypto

4. The server itself could be compromised into sending a correct certificate encoded malware

5. How are you going to audit all that?

A physical switch, on the other hand, is much easier to audit, and an attacker would need physical control of device to compromise it.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#257

Post by stephen_g »

wtallis wrote: post #172
supertrope wrote: post #93

Earlier quoted context omitted.

IMO both are obsolete especially if your connection is >50Mbps. If you must DIY use pfsense on a x86 machine with Intel NIC and low idle power draw. Otherwise use Ubiquti Edgerouter or Microtik.

Ubiquiti is overpriced and Mikrotik is underpowered. There are good consumer routers that have 802.11ac for the price of a wired-only Ubiquiti router. If you're comfortable installing OpenWRT, it still offers more capabilities for a lower price than those "prosumer" brands that pretend to be real enterprise-grade stuff.

In my experience, a lot of the MikroTik hardware has been underpowered (struggling to get decent routing and IPSEC performance), so I’ll agree with you on that point.

But I’ve found a lot of Ubiquiti hardware to be extremely high quality given how cheap it is. At my office, we installed seven new 802.11ac Ubiquiti access points for as much as it would have cost to add one more 802.11n to our Cisco system (apart from wanting 802.11ac, we also decided to decommission the Cisco because the controller would periodically crash every two months or so).

To get the number of 10GbE interfaces and performance the EdgeRouter Infinity has (for $1600) in a Cisco would cost multiple times the price there too.

I don’t know if I’d trust it for service-provider infrastructure, but we’ve replaced a lot of enterprise Cisco stuff in our office networks with Ubiquiti and only had a good experience.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#258

Post by khedoros1 »

Vektorweg wrote: post #235
tetha wrote: post #97

Earlier quoted context omitted.

This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a wa…

If a software company tells me, that their software is safe, they should be liable in case it isn't. Most FOSS licenses come with 'without warranty' notice. Businesses, who use it, should know that.

Sounds like it would be smartest for all software to come with a warning that it may be vulnerable to malicious interference. It'll be the software version of a Prop 65 warning.

There's no such thing as absolutely safe software.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#259

Post by khedoros1 »

subway wrote: post #241
amarkov wrote: post #179

Earlier quoted context omitted.

On the contrary, it's the legal perspective that's most worrying. If every software bug carries the potential for liability, there's no way your legal department will let you have a widely-visible bug tracker, or easily report bugs at all. It'd be much like copyright violations are treated today, where there's a formal process to raise the issue and everyone's specifically trained not to discuss them openly.

What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Change the phrase "software bug" to "engineering error". Then consider the liabilities involved with the manufacture of any real-world-might-kill-someone product. The lawyer's view starts to make a helluva lot more sense.

> What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it?

Millions of malicious people constantly attacking it with cheap equipment from a distance with little chance of being caught doing so?

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#260

Post by ravenstine »

I'm amazed at how many people here think that a company should be default responsible for what is essentially a third-party tampering with their product. Unless the problem is a result of negligence, it's unreasonable to say that a company should be automatically responsible, except perhaps if they decide not to address the problem in in future products.
Post reply on HN