Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI tells router users to reboot now to kill malware infecting 500k devices

arstechnica.com

Post reply on HN
Print view View original

291–299 of 299 posts

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#291

Post by v_lisivka »

bradknowles wrote: post #160
tetha wrote: post #97

Earlier quoted context omitted.

This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a wa…

Perhaps a “UL Labs” type of solution for software, so that if your software and organization are certified according to the current standard, then your liabilities would be reduced? And yes, organizations and versions of software would have to be recertified on a regular basis. You would want software versions to be able to be certified quickly and through an automated process, but there is already some best practice…

If certification authority said that software is secure and then security flaws are found, then who is liable?

IMHO, we should have optimistic check: any public network device must have guarantee from the vendor to fix any remote vulnerability in 30 days after discovery by independent security organization(s), otherwise vendor liable for the damage done by his device.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#292

Post by v_lisivka »

jamescostian wrote: post #213
staticassertion wrote: post #145

Earlier quoted context omitted.

I've been shipping production software for years... I think you've misread my post if you think I said that every bug should lead to a lawsuit. It's right in the first part of my first post that we should not be holding every product equally liable for every bug. There is a line somewhere , and beyond that line is negligence. A developer exposing a potential vulnerability in an internal service that does not handle s…

>>>> - What happens if that library is openssl and almost all webservers on the internet are vulnerable? >>> Everyone deploying it is liable. > I've been shipping production software for years... Have you ever shipped software which depends on openssl? If not, then pretend that you have. Since you believe that you are liable, can you give me a ballpark of how much money you think you personally should be sued for bec…

If vendors refuse to update vulnerable OpenSSL library when fix is provided for free, risking their customers, then they should be punished until they change their altitude. Volunteers are doing that for free. Why businesses cannot pay to OpenWrt project for 10 year service for their products?

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#293

Post by cup-of-tea »

zackmorris wrote: post #30

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?

Because we don't hold software engineering to the same standard as other types of engineering.

Most the world has been led to believe that computers are unpredictable machines with feelings that break randomly.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#294

Post by ryanlol »

DougN7 wrote: post #288
ryanlol wrote: post #234

Earlier quoted context omitted.

You should not be transmitting sensitive information to the internet.

So don’t use online banking, or email, or online insurance or any online healthcare, or ... ?

Do you seriously use any of those without TLS? In the year 2018?

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#295

Post by xedeon »

jacksmith21006 wrote: post #281
r00fus wrote: post #52

Earlier quoted context omitted.

Please elaborate.

Think it is probably based on things like "CITRON EXPOSES UBIQUITI NETWORKS" http://citronresearch.com/citron-exposes-ubiquiti-networks/

That's your source? I advise you look up Citron's track record and history. That outfit is run by Andrew Left, an activist short-seller. He even targeted companies such as Shopify etc.

"Looking at Citron’s track record, Barron reports that, on average, companies that Left writes about see their value drop by ten per cent in a year. “And some drop as much as 95 per cent,” he writes. But that’s of little consolation to those who followed Citron’s advice and shorted NVIDIA, Motorola or Mobileye."

Ubiquity makes solid networking hardware for prosumers and small businesses that costs considerably less.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#296

Post by wtallis »

awinder wrote: post #284
wtallis wrote: post #172

Earlier quoted context omitted.

Ubiquiti is overpriced and Mikrotik is underpowered. There are good consumer routers that have 802.11ac for the price of a wired-only Ubiquiti router. If you're comfortable installing OpenWRT, it still offers more capabilities for a lower price than those "prosumer" brands that pretend to be real enterprise-grade stuff.

I was at $150 a year ago for an edgemax router + one of the long-range access points (i added a second ap, but for comparison's sake, that was the cost for those 2 components), which gave me an open-source router os (vyos) out of the box. I'm not sure what the cheaper option is once figuring in your own time-cost to hack openwrt in, but it's hard to imagine it would be some dollar-sum that really deserves this much a…

> I'm not sure what the cheaper option is once figuring in your own time-cost to hack openwrt in, but it's hard to imagine it would be some dollar-sum that really deserves this much angst.

WTF? Angst!?

It takes minutes to install and configure OpenWRT on supported hardware. You upload the OpenWRT firmware like any manufacturer-provided firmware update, and after it's beeen flashed the router reboots into OpenWRT. The added time cost compared to learning and configuring any other router OS is negligible.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#297

Post by nvarsj »

namibj wrote: post #158
nvarsj wrote: post #56

Earlier quoted context omitted.

I'd be wary of any Ubiquiti network kit. I only trust their APs. The ERL for example is an awful router - it has had a firmware issue for years now where it causes persistent packet loss due to reordering incoming packets. I discovered these problems in my own testing, and there is a giant thread on the forums about it which I helped kick off. The ER-X is the only thing that seems to work properly. Their switches are…

How large do you want the switch to be? Where I am, if I download something form google drive, I get _major_ bufferbloat on the downstream, I suspect because everthing except the last PHY link to my laptop (on a LAN port) handles at least 1Gbit, but the switch is still a little old-ish and won't do more than fast Ethernet. Please, for god's sake, either drop packets or use fq-codel or something similar, but don't use…

To support a certain bandwidth on a switch you need big enough buffers. Bandwidth delay product is what you want - latency * bandwidth, you need a buffer of at least that size to support throughput in the system. Multiply that by the number of ports to support concurrent bandwidth. The toughswitches were engineered with very small buffers, such that they couldn't even support reasonable bandwidth on a LAN with low latency.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#298

Post by nvarsj »

walterbell wrote: post #131
nvarsj wrote: post #56

Earlier quoted context omitted.

I'd be wary of any Ubiquiti network kit. I only trust their APs. The ERL for example is an awful router - it has had a firmware issue for years now where it causes persistent packet loss due to reordering incoming packets. I discovered these problems in my own testing, and there is a giant thread on the forums about it which I helped kick off. The ER-X is the only thing that seems to work properly. Their switches are…

Why didn’t you use PFsense from Netgate?

I don't like pFsense because it's difficult to automate and lacks bufferbloat AQM. I use ansible checked into source code - it's easy to rebuild and tweak, and works great. And with Linux you get access to fq_codel and cake. These are easy to setup and work extremely well, with 1-5ms bufferbloat even under throughput saturation. I couldn't manage to get anything similar in pfsense's QoS.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#299

Post by asah »

CapacitorSet wrote: post #15
djsumdog wrote: post #10

Earlier quoted context omitted.

If they've seized the C&C domain, can't they push an update that disable the malware?

As far as I know, they typically won't do this to avoid responsibility for bricking safety- and mission-critical routers.

um, few-if-any of the devices on this list are approved for safety- and mission-critical uses.
Post reply on HN