Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

threatpost.com

Post reply on HN
Print view View original

161–170 of 306 posts

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#161

Post by tonyarkles »

bogomipz wrote: post #103
jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

>"Today's manufacturers cannot afford to update software for hardware devices they have already moved on from." What is this statement based on? None of your links show any kind of unit economics that support the assertion that providing critical security patches for a defined support window is infeasible for manufactures and their business models.

I agree wholeheartedly, and outright reject the premise of the original statement.

This is a choice that they make. Yes, having a legacy support team is going to cost a bit of money, but not a ridiculous amount. Maybe instead of having a ridiculous number of barely-differentiated SKUs, they could lighten the support burden a bit by making a smaller number of solid well-supported models.

Edit: also, basing the models on a common platform would help too. I assume they generally do this already, but if not...

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#162

Post by singron »

jjeaff wrote: post #137
spartas wrote: post #118

Earlier quoted context omitted.

>Of course, in reality, this CVE seems almost un-exploitable in the wild, anyway. How will an exploiter get to the login page in the first place? They'd have to know your network password and be in your physical vicinity, or your ISP would have to send traffic to your router's login page from the Internet. Nope. Not at all. Most router attacks these days are malicious JavaScript (like in ads and trackers) that send H…

Would this not also require some sort of exploitable CORS vulnerability?

You can submit forms without CORS as long as there is no CSRF protection. I don't know what CSRF protection is being used.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#163

Post by dredmorbius »

The affected routers may be supported by OpenWRT, a free software wireless router project, or similar projects (dd-wrt, Tomato). Looking the OpenWRT Table of Hardware (https://openwrt.org/toh/start?dataflt%5BBrand*~%5D=D-Link), I find:

DIR-655: OpenWRT: not listed.

DIR-866L: OpenWRT: not listed. dd-wrt: https://wiki.dd-wrt.com/wiki/index.php/D-Link_DIR-868L

DIR-652: not listed

DHP-1565: Present: https://openwrt.org/toh/d-link/dhp-1565

Buying well-supported hardware and flashing with OpenWRT (or similar) is strongly recommended.

OpenWRT: https://www.openwrt.org/

Tomato: http://www.polarcloud.com/tomato

dd-wrt: https://dd-wrt.com

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#164

Post by wmf »

jrochkind1 wrote: post #87

> D-Link last week told Fortinet’s FortiGuard Labs, which first discovered the issue in September, that all four of them are end-of-life and no longer sold or supported by the vendor (however, the models are still available as new via third-party sellers). OK, let's say I am someone who actually knows "end-of-lifed" is a thing, and a thing you don't want... How would I check to see if a certain router was end-of-life…

How would I check to see if a certain router was end-of-lifed before buying it?

You should be able to Google "$MODEL_NUMBER support", although D-Link's Web site is pretty bad and doesn't say tha the product is EOL (although since the last firmware update is from 2013 you could guess).

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#165

Post by AnthonyMouse »

ghaff wrote: post #62
jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

I daresay people aren't going to like this answer but, you ultimately have to align the interests of the manufacturers and the consumers. Which probably means some sort of subscription model and even a requirement that the subscription be current to function. I know. Yuck. But the only other real possibility is to legislate that such updates be made available for N years as part of the purchase conditions.

> But the only other real possibility is to legislate that such updates be made available for N years as part of the purchase conditions.

What would be better is to require that the firmware be replaceable with something like DD-WRT or OpenWRT. One of the biggest issues with hardware like this is that the original manufacturer goes out of business and yet millions of people still have their devices.

You can't require updates from a company that no longer exists, but that's not really a problem if their hardware can run the latest versions of half a dozen different open source router firmwares.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#166

Post by heavenlyblue »

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

This all is simply fixed by open-sourcing the outdated software.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#167

Post by tombert »

Natales wrote: post #144

Since I have an ESX box with multiple NICs running 24x7 at home, I've been using both, pfSense [1] and OPNSense [2] on a VM for years, with excellent performance, stability and top notch features. Combine that with 2 UniFi APs, multiple SSIDs each landing on separate VLANs, all converging on the router VM as separate "interfaces", so you can very selectively do policy-based routing per MAC address, and whitelist/blac…

I had come into possession of a bunch of thin clients with USB 3.0 and gigabit ethernet about a year ago, and as a result I installed PFSense, which is my router in my house.

It has been great...I'm definitely never going back to a crappy commercial router ever again.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#168

Post by jdnenej »

heavenlyblue wrote: post #166
jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

This all is simply fixed by open-sourcing the outdated software.

Open source the in date software as well. All home router software is absolutely horrendous

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#169

Post by spartas »

chopin wrote: post #156
jjeaff wrote: post #137

Earlier quoted context omitted.

Would this not also require some sort of exploitable CORS vulnerability?

CORS prevents the JS from seeing the result but it doesn't prevent the sending of the request. This is one of the reasons my internal network is not 192.168.1.1/24 and the router is not 192.168.1.1.

> This is one of the reasons my internal network is not 192.168.1.1/24 and the router is not 192.168.1.1.

Do you also disable WebRTC on all clients on your network? An attacker (or script) may be foiled by your non-standard gateway network, but your work in obfuscating the router is wasted if they can get at your client IP address.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#170

Post by kaylynb »

redblacktree wrote: post #14
nly wrote: post #7

It's times like this i'm glad my home router is a x86 mini PC running Arch Linux + iptables + Unifi (Complete with DNS MITM forcing all DNS out of my apartment over TLS)

How high-touch is this kind of setup? I have a separate access point and I am using a consumer-grade "wireless router" for DHCP. (and other things?) I'm more of an app developer that does DevOps stuff when I have to. Is this something I can get done in a day or so? Is a Raspberry Pi enough, or do I need something more powerful?

It depends, and it's certainly not a consumer solution. I use Ansible manage my devices so it takes a bit more up front time to setup but it pays off in the long run. It's very low maintenance overall but you do need some technical knowledge.

I recently switched from OpenBSD to Linux and it was mostly painless. nftables is almost as usable as pf.

If you get a decent WiFi card you can just use hostapd and manage your wireless networks on the gateway; slicing it up however you want without needing vlan capable switches on your network.

Post reply on HN