D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

Post by jdnenej » Tue, Oct 08, 2019, 8:54 PM UTC

ghaff wrote: post #62

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

I daresay people aren't going to like this answer but, you ultimately have to align the interests of the manufacturers and the consumers. Which probably means some sort of subscription model and even a requirement that the subscription be current to function. I know. Yuck. But the only other real possibility is to legislate that such updates be made available for N years as part of the purchase conditions.

Post by kbenson » Tue, Oct 08, 2019, 8:56 PM UTC

chopin wrote: post #156

jjeaff wrote: post #137

Earlier quoted context omitted.

Would this not also require some sort of exploitable CORS vulnerability?

CORS prevents the JS from seeing the result but it doesn't prevent the sending of the request. This is one of the reasons my internal network is not 192.168.1.1/24 and the router is not 192.168.1.1.

Post by chriscappuccio » Tue, Oct 08, 2019, 8:58 PM UTC

Post by m-p-3 » Tue, Oct 08, 2019, 9:07 PM UTC

zamadatix wrote: post #82

ktta wrote: post #27

Earlier quoted context omitted.

Open source software on routers is a little complicated. FCC requires home router manufacturers to prevent users from modifying transmit settings (primarily to prevent interference with weather systems - which 5G is also going to mess with). While the router manufacturers themselves might not provide features to modify the parameters, allowing third-party open source firmware opens them upto liability, because third-…

The FCC is certainly the problem in this case. If someone modifies the product to break the law the person is at fault not the manufacturer. That someone could do modify their radio to do bad things shouldn't stop me from modifying mine to do good things.

Post by m-p-3 » Tue, Oct 08, 2019, 9:09 PM UTC

wtallis wrote: post #47

ktta wrote: post #27

Earlier quoted context omitted.

Open source software on routers is a little complicated. FCC requires home router manufacturers to prevent users from modifying transmit settings (primarily to prevent interference with weather systems - which 5G is also going to mess with). While the router manufacturers themselves might not provide features to modify the parameters, allowing third-party open source firmware opens them upto liability, because third-…

Really it seems like the radio ASICs themselves should be adding a little bit of embedded flash or OTP memory. But barring that, as the storage requirements of routers increase (having already moved from NOR to NAND flash) we may eventually reach the point where a router includes a BGA SSD whose controller can enforce permanent read-only permissions on a partition that stores RF parameters.