Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

threatpost.com

Post reply on HN
Print view View original

91–100 of 306 posts

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#91

Post by NullPrefix »

nominated1 wrote: post #39
hackbinary wrote: post #13

Earlier quoted context omitted.

What do you expect from companies that sell kit at $50/£50/€50? You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Then again, I buy stuff that can be flashed with OpenWRT ...

Xiaomi sells routers in this price range that ship with OpenWrt. The buildroot even has config options for branding! It costs them nothing for the OS. It costs D-Link more to produce their mess.

"But how will we differentiate from the market without our \"value added\" non-standard software?"

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#92

Post by gambiting »

Linksys routers still ship with Samba 1.0 which has literally been deprecated for like 20 years now. These companies literally don't give a crap what they ship, I can only imagine that the firmware is made by someone who stood next to a building where a talk about internet security was held....a month earlier.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#93

Post by anderskaseorg »

OJFord wrote: post #78
eropple wrote: post #72

Earlier quoted context omitted.

> the only other real possibility is to legislate that such updates be made available for N years as part of the purchase conditions I am unclear why this is not the preferential solution here. "Don't sell lemons" is a societal good.

It drives prices up in equivalence with subscription pricing over the typical lifespan. (i.e. not obviously better or worse)

Maybe the manufacturers would figure out more efficient solutions given incentives that encouraged them to do so. For example, they might decide it’d be more efficient to use OpenWrt than to do separate security maintenance for N incompatible closed platforms.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#94

Post by Jwarder »

untog wrote: post #54
webreac wrote: post #53

Earlier quoted context omitted.

In an hospital, someone could die from a hacked device.

I should really, really hope hospitals are not using routers like these.

I'd expect a hospital has to have a pro-ish router due to the size of the network. However, I can easily see someone setting up some of these as a "temporary" fix just to get things working for some subnet. I totally expect some small clinics, independent doctors' offices, or EMS stations use devices like these.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#95

Post by eloff »

I'll think twice before buying D-link again. They've just tarnished their brand irrevocably for me, even though my router is not affected - I had to turn it over and compare version numbers to be certain, and I don't want to have to track exploits and check version numbers to have peace of mind.

What manufacturer can I buy next time with a good security record?

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#96

Post by rolltiide »

dclusin wrote: post #20
hackbinary wrote: post #13

Earlier quoted context omitted.

What do you expect from companies that sell kit at $50/£50/€50? You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Then again, I buy stuff that can be flashed with OpenWRT ...

If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. It doesn't matter if it's a Prius or a Ferrari. These vendors are selling defective devices and it is fixable via software patch. Just because they stopped selling them doesn't mean they shouldn't have to fix it.

Think about why and how governments have that kind of leverage over the auto industry.

There are arbitrary and discretionary licenses that have been created in response so prior issues.

Licensing/certification regimes allow for almost any expansion of the role of government to those licensed, including capital requirements to resolve an issue.

So first you would need a license, determine the scope of the license, who needs it, and the consequences of operating without one.

Good luck

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#97

Post by GTP »

msla wrote: post #33
hackbinary wrote: post #13

Earlier quoted context omitted.

What do you expect from companies that sell kit at $50/£50/€50? You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Then again, I buy stuff that can be flashed with OpenWRT ...

> You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Let's unpack this: You get what you pay for... yet you also say that OpenWRT solves this problem and is available free of charge. If you pay for a support contract, you get support right up to the point where the company decides to…

>Finally, the product as it was at time of purchase was a >product fit to be sold, without major defects If somebody later discovers a bug in the firmware that bug was present from the beginning, so this is false.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#98

Post by redwall_hp »

eropple wrote: post #72
ghaff wrote: post #62

Earlier quoted context omitted.

I daresay people aren't going to like this answer but, you ultimately have to align the interests of the manufacturers and the consumers. Which probably means some sort of subscription model and even a requirement that the subscription be current to function. I know. Yuck. But the only other real possibility is to legislate that such updates be made available for N years as part of the purchase conditions.

> the only other real possibility is to legislate that such updates be made available for N years as part of the purchase conditions I am unclear why this is not the preferential solution here. "Don't sell lemons" is a societal good.

Laws requiring that consumer electronics not be effectively disposable is also a net good for the environment as well. I'd like my router to have active cooling (so it doesn't self destruct from heat) and run an open source firmware that will survive longer than a single manufacturer may be willing to maintain it. (They all can jointly contribute.)

Phones should have some level of modularity and repairability, so they can last a multiple of their present service life. (Think smaller scale standards like in desktop PCs.)

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#99

Post by paggle »

zamadatix wrote: post #82
ktta wrote: post #27

Earlier quoted context omitted.

Open source software on routers is a little complicated. FCC requires home router manufacturers to prevent users from modifying transmit settings (primarily to prevent interference with weather systems - which 5G is also going to mess with). While the router manufacturers themselves might not provide features to modify the parameters, allowing third-party open source firmware opens them upto liability, because third-…

The FCC is certainly the problem in this case. If someone modifies the product to break the law the person is at fault not the manufacturer. That someone could do modify their radio to do bad things shouldn't stop me from modifying mine to do good things.

Would you also say that Uber doesn't violate taxi laws or AirBNB doesn't violate zoning laws, and it's just the Uber drivers and AirBNB hosts who are using the products to violate the law? What's your responsibility when you hand someone a loaded gun and it goes off?

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#100

Post by iforgotpassword »

eloff wrote: post #95

I'll think twice before buying D-link again. They've just tarnished their brand irrevocably for me, even though my router is not affected - I had to turn it over and compare version numbers to be certain, and I don't want to have to track exploits and check version numbers to have peace of mind. What manufacturer can I buy next time with a good security record?

One where you can wipe the original firmware and install OpenWRT.
Post reply on HN