I do not own a DLink router but do own a consumer-grade Gateway from Netgear. Is there any mechanism I can use to check for published vulnerabilities against my hardware?
D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
61–70 of 306 posts
Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
#62This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…
I daresay people aren't going to like this answer but, you ultimately have to align the interests of the manufacturers and the consumers. Which probably means some sort of subscription model and even a requirement that the subscription be current to function.
I know. Yuck. But the only other real possibility is to legislate that such updates be made available for N years as part of the purchase conditions.
Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
#63This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…
I'm not really sure there is enough evidence behind your assertion. Google wifi APs have got continuous updates from Sep. 2015 to current day. Sonos players have been continuously supported for 15 years. Apple's just-released OS runs on 7-year-old hardware. There are and have always been fly-by-night organizations that sell junk with bad software and no updates. That's not new, nor is the existence of reputable vendors with long support policies.
Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
#64Earlier quoted context omitted.
If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. It doesn't matter if it's a Prius or a Ferrari. These vendors are selling defective devices and it is fixable via software patch. Just because they stopped selling them doesn't mean they shouldn't have to fix it.
You have warranties for those, though. Also, no lives are in risk in dlink's case. It's more comparable with a shirt that falls apart after washing a few times.
If vulnerable D-link router becomes part of botnet, and attacks devices on my network?
Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
#65This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…
>anyone who can address that problem
If no one addresses this problem, regulations will be imposed.
Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
#66This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…
I think consciousness raising is important to. Many have made efforts to explain these downsides, but it is a never ending challenge to keep the public aware of why closed source technology harms them compared to potential open options. Consumer opinion is one of the tools we can use to change this situation, and an important one IMO.
Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
#67Earlier quoted context omitted.
In an hospital, someone could die from a hacked device.
I should really, really hope hospitals are not using routers like these.
Medical equipment more and more often has networked embedded software that can't be updated. They won't throw away a multimillion-dollar device just because it can't be upgraded from Windows XP.
Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
#68Earlier quoted context omitted.
What do you expect from companies that sell kit at $50/£50/€50? You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Then again, I buy stuff that can be flashed with OpenWRT ...
$50 honestly seems expensive considering how long home routers have been around. It's not as if it's novel technology. I'd expect cheap mass-produced routers to be around $15 - $25, like an immersion blender.. I don't quite understand why cheap ones are still $40-$60.
$50 is incredibly cheap for a home-router (which also is a wireless access point, a switch and a firewall).
Prosumer or enterprise grade hardware is usually magnitudes more expensive.
An edgerouter X is $50 for instance, but doesn't have wifi and lacks serious routing features. It is considered a very low end router compared to more expensive stuff from Juniper or Cisco. (even an entry grade router/firewall like an SRX300 will run you back atleast 4x the price of the edgerouter.)
One thing these $50 routers lack besides proper software is stability. Most consumer networking equipment has an abysmal track record in terms of reliability.
Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
#69Whoever patches them will be the one who maintains control over them. What organizations are best positioned to do that? I suggest the intelligence agencies of Russia, Israel, and the US. Whether any of them will take the opportunity is anyone’s guess.
Of course, the underlying problem here is that users depend on vendors for patching, and their incentives are misaligned. Free software like DD-WRT removes that dependency and thus the incentive misalignment problem. To the extent that educational, legal, and technical measures prevent users from exercising the freedoms of free software in practice, these problems will get worse and worse
Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
#70Earlier quoted context omitted.
If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. It doesn't matter if it's a Prius or a Ferrari. These vendors are selling defective devices and it is fixable via software patch. Just because they stopped selling them doesn't mean they shouldn't have to fix it.
> If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. This is a bit of a spurious comparison. Nobody is dying from an unpatched router. Why should a company be on the hook for a device, particularly if it's out of warranty? If you expect more than that, you need to be buying something with a contract stating you're going to get more than that.
You don't watch Mr. Robot do you?