D-Link Home Routers Open to Remote Takeover Will Remain Unpatched • Hacker News Board

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#181

Post by foxylion » Tue, Oct 08, 2019, 9:15 PM UTC

kbenson wrote: post #173

chopin wrote: post #156

Earlier quoted context omitted.

CORS prevents the JS from seeing the result but it doesn't prevent the sending of the request. This is one of the reasons my internal network is not 192.168.1.1/24 and the router is not 192.168.1.1.

Doesn't CORS generally send an OPTION request first to see if the target site even allows the requests, thus preventing this? That's what I've seen when trying to work around browser CORS limitations.

You can also just do a normal form post request into an invisible iframe that is generated by the attacker's javascript.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#182

Post by ghaff » Tue, Oct 08, 2019, 9:21 PM UTC

jdnenej wrote: post #171

ghaff wrote: post #62

Earlier quoted context omitted.

I daresay people aren't going to like this answer but, you ultimately have to align the interests of the manufacturers and the consumers. Which probably means some sort of subscription model and even a requirement that the subscription be current to function. I know. Yuck. But the only other real possibility is to legislate that such updates be made available for N years as part of the purchase conditions.

There is an even better solution. Simply use open source firmware on these devices and this will not be an issue. It's much less effort to maintain one common firmware rather than a new one for every device.

Some subset of the code may be common. A lot of code that is specific to a particular device won't be. I'm actually open to the idea that vendors could benefit from working with open source firmware and differentiate in other ways. But "use open source" doesn't magically reduce the effort. They probably already have core software bases that they don't need to change all that much for new devices.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#183

Post by x2f10 » Tue, Oct 08, 2019, 9:21 PM UTC

chooseaname wrote: post #147

I tell everyone who will listen don't buy consumer networking gear. Buy from Ubiquity or get the enterprise routers/APs from your favorite brand. They are much more likely to be updated and don't really cost much more. Sure, it takes some know how to set up, but they can call me if they take my recommendations.

Eero is a much better alternative for the average person. Solid features, INCREDIBLY easy to setup, nice app, helpful support, etc. Big fan.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#184

Post by zamadatix » Tue, Oct 08, 2019, 9:26 PM UTC

m-p-3 wrote: post #177

zamadatix wrote: post #82

Earlier quoted context omitted.

The FCC is certainly the problem in this case. If someone modifies the product to break the law the person is at fault not the manufacturer. That someone could do modify their radio to do bad things shouldn't stop me from modifying mine to do good things.

The same argument can be made with any other tools in existence. Don't blame the tool for doing something bad, blame the user.

That is a different argument than you imply, please read the existing sibling comment chain to see how as it's pretty much the same discussion.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#185

Post by tzs » Tue, Oct 08, 2019, 9:27 PM UTC

pdonis wrote: post #15

qwerty456127 wrote: post #3

For national security sake all routers should be required to support open firmwares.

You can install OpenWRT on most D-Link routers. I have one at home that works fine that way.

Most, maybe, but not all. Only one of the 4 models in this case is listed as supported on the OpenWRT site.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#186

Post by pjdemers » Tue, Oct 08, 2019, 9:28 PM UTC

For what home routers cost, they could probably ship a new one to everyone who complains about the bug for less than it costs to patch all of them. Especially since the set of people who will actually apply a patch is only slightly larger than the set who will complain about a bug.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#187

Post by crankylinuxuser » Tue, Oct 08, 2019, 9:38 PM UTC

__jal wrote: post #174

eropple wrote: post #90

Earlier quoted context omitted.

They were lemons at time of sale, though, we just didn't know it yet . Between that and the ecosystem/society argument, I think it's a no-brainer. > However, how would you feel about legislation that required five years of dealer service to be included with every automobile sale? Or other products in a similar vein? This analogy doesn't work for me; software bugs are defects , they aren't something getting old and fa…

The operative difference is that intelligent adversaries are not coming up with new and better methods of making your bumper fall off. The economics of providing 5 years of defensive patching on a $100 device simply does not work.

Then maybe they shouldn't be able to make a profit on doing society wrong in the medium or long term.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#188

Post by rlpb » Tue, Oct 08, 2019, 9:40 PM UTC

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

> Can you provide an "enterprise class embedded OS" to device manufacturers and address post-deployment updates? Can you provide infrastructure device manufacturers can use to manage post-deployment updates themselves?

Ubuntu is already doing this: https://ubuntu.com/internet-of-things

For Linux distributions, security updates and maintenance are a solved problem. Ubuntu adds to this a read-only filesystem with atomic updates for embedded devices, vendor-only apps and app stores, and so forth.

Disclosure: I work for Canonical, but not in this particular area.

Speaking for myself, I find it frustrating that Ubuntu's solutions aren't more widely known and recognised. As far as I know, our community is very aware of the issues involved in this space and there is no other solution that solves the "IoT maintenance" problem properly.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#189

Post by WalterSobchak » Tue, Oct 08, 2019, 9:41 PM UTC

ape4 wrote: post #11

frereubu wrote: post #6

Earlier quoted context omitted.

Non-shortened link: https://supportannouncement.us.dlink.com/announcement/public...

"D-Link takes the issues of network security and user privacy very seriously. " ... "These products have entered End of Service Life. There is no support or development for these devices. We recommend replacing the device with an new device that is actively supported."

Reminds of an old post by Troy Hunt: https://www.troyhunt.com/we-take-security-seriously-otherwis...

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#190

Post by samgranieri » Tue, Oct 08, 2019, 9:45 PM UTC

wil421 wrote: post #79

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

> This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. Ubiquiti has a number of CVEs and has addressed them in a timely manner, IMHO. If you’re buying t…

I also have Ubiquiti networking equipment at home.

Originally I had a DLink gaming router, but as soon as that router went out of support I switched to Apple networking gear, thinking Apple would do an excellent job with support. Also, 802.11AC wasn't supported on my Dlink router.

Then I read an article about Ubiquiti networking equipment on ArsTechnica a few years ago and thought about getting that for a forever home.

The thing that sealed my home network upgrade was Apple discontinuing their networking equipment. I figured (at the time) that Apple would abandon support for their devices. I remembered the Ars article from 4 years ago, and took the plunge on a cloud key, access point, USG, and Unifi Switch. Is this overkill or a 1 bedroom apt or 2 bedroom condo? Yes. However, having the piece of mind that the hardware I bought has continuous software upgrades and excellent customer support via their forums is outstanding.