Earlier quoted context omitted.
Based on Ubiquiti's track record over the last few years, I certainly wouldn't bet my money on that.
Please elaborate.
Think it is probably based on things like
"CITRON EXPOSES UBIQUITI NETWORKS"
FBI tells router users to reboot now to kill malware infecting 500k devices
281–290 of 299 posts
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#282Verizon routers not known to be vulnerable? That's a bit surprising, although not so much if a particular country is being targeted.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#283Earlier quoted context omitted.
How would you know if this were true? Is it just branding/reputation? I use a peplink, which doesn’t target the “consumer” market. Is that better? Seems impossible to know.
The more it seems, is that I should run my own freebsd or centos linux router, and turn on the full compliment of security (Selinux, aide, firewalld, etc) and run my own. And put Openscap on there and use the US government configuration base remediation. Itd be painful to setup initially, but once setup should be rock solid.
Google WiFi would give you a more secure solution. Google has a hardware token in the Google WiFi locked to the stored image and that is locked to the running image.
So things like this hack would be exposed.
But then Google keeps them up to date. But the other is Google has now found Shellshock, Heartbleed, Meltdown, Cloudbleed, Spectre among several other big ones and just invest far more in security than anyone else.
They find these problems before anyone. Plus they write them up and highly recommend a few of their blog posts.
A great one is their write up on the Broadpwn vulnerability.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#284Earlier quoted context omitted.
IMO both are obsolete especially if your connection is >50Mbps. If you must DIY use pfsense on a x86 machine with Intel NIC and low idle power draw. Otherwise use Ubiquti Edgerouter or Microtik.
Ubiquiti is overpriced and Mikrotik is underpowered. There are good consumer routers that have 802.11ac for the price of a wired-only Ubiquiti router. If you're comfortable installing OpenWRT, it still offers more capabilities for a lower price than those "prosumer" brands that pretend to be real enterprise-grade stuff.
I was at $150 a year ago for an edgemax router + one of the long-range access points (i added a second ap, but for comparison's sake, that was the cost for those 2 components), which gave me an open-source router os (vyos) out of the box. I'm not sure what the cheaper option is once figuring in your own time-cost to hack openwrt in, but it's hard to imagine it would be some dollar-sum that really deserves this much angst.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#285Earlier quoted context omitted.
>Regulation and liability only works against monopolies and other huge companies. That's not true at all. Many industries that are very competitive and are full of small companies are effectively regulated. >There is no blood to be had from that stone. There's a simple fix to this problem. You require companies to carry insurance to cover the problems you're talking about. We do it with general contractors, doctors,…
> That's not true at all. Many industries that are very competitive and are full of small companies are effectively regulated. There are many industries that are very competitive and full of small companies and have regulations , but what most commonly happens in those cases is that the regulations are rarely enforced which nobody much minds because the competition is preventing abusive practices regardless. > There'…
>There are many industries that are very competitive and full of small companies and have regulations, but what most commonly happens in those cases is that the regulations are rarely enforced which nobody much minds because the competition is preventing abusive practices regardless.
Again I don't think this is true at all. Some counter examples: restaurants, electricians, general contractors, engineering firms, beauty salons, and tanning salons.
>None of those things happen at scale. When a doctor makes a mistake, it affects one patient. A single security vulnerability can affect millions of people.
A single bridge failure can affect an entire city, and a large building collapse could cost billions in payouts--yet engineering and construction firms can and do buy insurance to cover these things.
Magnitude isn't a problem here, even insurance companies buy insurance from larger insurance companies.
>It's also a poor thing to try to insure because the main risk factor is code quality but insurance companies are generally not equipped to evaluate that.
Insurance companies are able to evaluate risk factors for every industry--they are better able to evaluate risk than anyone else, and it's not like they wouldn't hire domain experts.
There's nothing special about software in this regard--it's a complex system, but the insurance industry regularly insurances against damage resulting from far more complex systems than software--weather for instance.
I'm not sure if requiring router manufacturers to buy insurance would lead to a net benefit or not, but the problems you're creating have already been solved by other industries. There's nothing magic about software that makes it impossible to insure.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#286Earlier quoted context omitted.
What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Change the phrase "software bug" to "engineering error". Then consider the liabilities involved with the manufacture of any real-world-might-kill-someone product. The lawyer's view starts to make a helluva lot more sense.
> What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Millions of malicious people constantly attacking it with cheap equipment from a distance with little chance of being caught doing so?
Whilst that is true, it doesn't have to be that way. If from day one, liability for software bugs lead back to whomever wrote the code, then the world would be a much different place.
For one thing, we would be much more conservative in how we wrote code. Libraries would be vetted, with insurance contracts attached to them. Programming languages would not allow for dynamic data, type coercion, or weak typing. In the 80s, rather than C rising to prominence, Ada would have. Haskell would be our generations Javascript, and XHTML would have won over HTML5 simple because guessing how rendering should work would open up a browser maker to high fines and lawsuits.
We'd have to rewrite our entire software stack from the ground up. It's not impossible, but we'd have to view it as a multi-decade transition like how the chemical industry was slowly forced to not use heavily polluting procedures.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#287Earlier quoted context omitted.
It's even worse: most of these companies don't even write the software for the low end consumer hardware. They just license it from a third party, usually in Asia, and pay them to turn features on or off and skin the UI for their branding. It's no surprise that routers from competing manufacturers are vulnerable, since it's all the same under the hood. The companies that sell the finished product have zero insight in…
But there's open source software for this. Why don't they just use that?
There is no one to point the finger at (i.e. blame) when something goes wrong.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#288Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#289Earlier quoted context omitted.
There is a _huge_ business opportunity for the entrepreneurial mind. Auto update of firmware with proper monitoring and health checks as the roll out continues.
Yes, technically ; the reason it doesn't exist is that "proper monitoring" would highlight how atrocious everyone's development practices are. Oh, and this would accidentally plug all the holes "everyone" variously uses when they're found helpful... generally you want to attract military funding, not scare it away :D
Heh, probably. I don't know if i agree on your point about companies' development practices. Basic monitoring is very simple to add.
I thought what'd a very basic monitoring & release for a self driving car would look like:
Below could be measured as A/B experiment - (control 1% on old release, experiment 1% on new release).
1. Number of miles driven 2. Number of user intervention. 3. Score rating (assuming users give a rating for their comfort after reach ride). 4. Number of rides completed. 5. Average/median speed driven 6. Average/median G change (like too much breaking would cause a change in G-force user is enforced to). 7. Average/median time-to-destination etc.
The data is already available and collected, what's missing is a way that's plug&play for these companies to push the data and necessary dimensions and integrate them into their roll outs.
You can find such metrics for almost all internet-connected device.
Make a dashboard out of this, give a way to slice data, give visualization tools and a way to query it out, and this is a winner.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#290Earlier quoted context omitted.
If a software company tells me, that their software is safe, they should be liable in case it isn't. Most FOSS licenses come with 'without warranty' notice. Businesses, who use it, should know that.
Sounds like it would be smartest for all software to come with a warning that it may be vulnerable to malicious interference. It'll be the software version of a Prop 65 warning. There's no such thing as absolutely safe software.
Except we can forbid by law to attach such devices to public networks. If you want to attach a router with no guarantees of security, by a router with guarantee of security and plug in it before vulnerable one.