Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

threatpost.com

Post reply on HN
Print view View original

191–200 of 306 posts

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#191

Post by tbyehl »

bluGill wrote: post #71
pxeboot wrote: post #5

Until there is some legally required amount of time to provide security updates for connected devices, I would expect the "buy a new one if you want to be protected" response to continue indefinitely.

At one "legal training" class our lawyers said that there is the potential that we could be required to recall and fix any product we have ever made. We have machines we made in the 1950s that are still regularly used for the purpose they were bought for, but without modern safety standards. We believe we can argue in court that the modern safety devices didn't even exist back then so we shouldn't have to update thos…

> I would expect a consumer router to run without problem for not less than 10 years

That's not a realistic expectation. Nobody is selling consumer devices with a 10-year support lifecycle.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#192

Post by sekjldfhsfklh »

I think there is a simple solution: if the seller doesn't support it, then they have to open source it.

Own (key word) an old RPG that won't run because the publisher decided the servers were no longer profitable?

RPG gets opened sourced.

Have a John Deer remote operated tractor that John Deer won't fix a bug that allows attackers to operate remotely?

John Deer's tractor software gets open sourced.

No support? No legal IP protection.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#193

Post by zanny »

ghaff wrote: post #182
jdnenej wrote: post #171

Earlier quoted context omitted.

There is an even better solution. Simply use open source firmware on these devices and this will not be an issue. It's much less effort to maintain one common firmware rather than a new one for every device.

Some subset of the code may be common. A lot of code that is specific to a particular device won't be. I'm actually open to the idea that vendors could benefit from working with open source firmware and differentiate in other ways. But "use open source" doesn't magically reduce the effort. They probably already have core software bases that they don't need to change all that much for new devices.

The thing is that for a new device you only need hardware enablement in the kernel - something largely one off that manufacturers can do in the same cadence as device sales so their priorities align.

What should be happening is that the FCC / international communications bodies should be directly funding a project like OpenWRT and using regulation to compel device manufacturers seeking approval by the bureau to submit their requests contingent to providing device specific hardware enablement upstream and to default-ship their devices with this common OS. Then those certification costs fund the ongoing operating system project.

If a company then wanted to implement a new feature to push their hardware, they could... by submitting it upstream.

There have been so many billions of developer hours wasted in the pursuit of profit by reinventing every single damn wheel a trillion times over its disgusting to think about and governments should be recognizing this flaw in US-IP-driven software business models and work to correct it.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#194

Post by crankylinuxuser »

GTP wrote: post #97
msla wrote: post #33

Earlier quoted context omitted.

> You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Let's unpack this: You get what you pay for... yet you also say that OpenWRT solves this problem and is available free of charge. If you pay for a support contract, you get support right up to the point where the company decides to…

>Finally, the product as it was at time of purchase was a >product fit to be sold, without major defects If somebody later discovers a bug in the firmware that bug was present from the beginning, so this is false.

I could consider things like catching on fire or assisting a crime (DDoS, botnet, etc) to be such cases where they absolutely should be on the hook to be required to fix.

And we already have a system put in place to assess. It's called CVEs. If you exist, you should be on the hook to fix.

It's called 'Being Responsible'. And corporations have a strong tendency to not want to be. That's why we need the 'stick'.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#195

Post by megous »

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

> This is the new normal, folks. Consumer technology is manufactured for six to twelve months.

Not completely true. For example, just something I discovered recently is that some e-book readers have very long lifespan if you look inside and ignore the battery. There's not even an electrolytic or tantalum capacitors there. Really nothing that will expire.

If you don't kill it mechanically, these will survive for 10 years+ just fine. Even the internal memory holding the OS and your data is easily replaceable (uSD card, and no other memory that can get corrupted). Indeed you can easily upgrade your $150 2GB e-book reader to 32GiB for $6, with a much faster uSD card. Or even replace the OS completely. ;)

The only thing that makes these devices' lives limited is the battery and the cheap noname uSD card. They even make it so that display is easily replaceable, no glue or anything.

What I hate is lack of commitment to free software. Manufacturer will just dump incomplete old kernel code on github once, without a source code to also GPLed bootloader, after years of nagging from users, and calls it a compliance with GPL.

They don't even bother with mainline Linux support, that would make it so that anyone could use their device for whatever creative prupose and it would get automatic longterm software support for free, even after they would not want to bother anymore to support it.

It's not even a cost thing, I just reverse engineered one such device and it now runs Linux 5.4-rc2 and all HW works, including an eink display driver. It took about 2 weeks of occasional work. Instead the manufacturer probably spent huge amount of time hacking together some old kernel and messy SoC vendor drivers, so that the OS at least holds together for their purposes.

It's probably just some culture thing of not giving a fuck about anything but themselves. And there's a huge amout of waste as a result. At least some people sell these devices if they are just locking up/hanging (sure sign of uSD card data corruption) on eBay. But many will probably just throw it out. Such shame.

So yeah, some tech is indeed solid, but manufacturer will gladly mess all the benefits up on the software side, for no real reason, at least to me.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#196

Post by wtallis »

ghaff wrote: post #182
jdnenej wrote: post #171

Earlier quoted context omitted.

There is an even better solution. Simply use open source firmware on these devices and this will not be an issue. It's much less effort to maintain one common firmware rather than a new one for every device.

Some subset of the code may be common. A lot of code that is specific to a particular device won't be. I'm actually open to the idea that vendors could benefit from working with open source firmware and differentiate in other ways. But "use open source" doesn't magically reduce the effort. They probably already have core software bases that they don't need to change all that much for new devices.

Pretty much the only custom code that router vendors write is the web UI, which is sometimes a fully custom job and sometimes a reskin of DD-WRT or OpenWRT's web interface. Otherwise, they're generally shipping whatever code they got from the SoC vendor, which is generally a fork of OpenWRT from around when that SoC taped out.

"Use open source" would make the situation appreciably better, because it would mean not accepting any closed-source or out of tree drivers that lock you in to particular kernel versions and non-standard management APIs. Once those problems are out of the way, frequently rebasing the web interface on current upstream OpenWRT is pretty straightforward.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#197

Post by crankylinuxuser »

sekjldfhsfklh wrote: post #192

I think there is a simple solution: if the seller doesn't support it, then they have to open source it. Own (key word) an old RPG that won't run because the publisher decided the servers were no longer profitable? RPG gets opened sourced. Have a John Deer remote operated tractor that John Deer won't fix a bug that allows attackers to operate remotely? John Deer's tractor software gets open sourced. No support? No leg…

Then the problem gets moved to encryption keys, which aren't part of the "open source".

All the code's there - you just don't have the right to change it!

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#198

Post by crankylinuxuser »

triangleman wrote: post #157

Correct me if I'm wrong, but in order to perform this attack you need to be connected to the router's LAN in order to access the admin page, right? So you would need to gain access to the WiFi or attach a computer to the router via Ethernet. This cannot be exploited over the internet, unless perhaps the user enables the admin page via WAN.

Sadly, wrong.

Assuming 192.168.1.1 is your router, you can craft a webpage on the public internet to exploit that IP address, without javascript.

With js, it's trivial.. But you have to deal with CORS being set up. Question then becomes - is CORS set up right? If not, pwn3d.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#199

Post by ralph84 »

dredmorbius wrote: post #145
dangus wrote: post #89

Earlier quoted context omitted.

Until consumers are willing to spend on subscription services to keep devices up-to-date, new hardware is the de facto method of paying for software development work. Of course, in reality, this CVE seems almost un-exploitable in the wild, anyway. How will an exploiter get to the login page in the first place? They'd have to know your network password and be in your physical vicinity, or your ISP would have to send t…

Until consumers are willing to spend on subscription services... You cannot shift a Gresham's Law race-to-the-bottom dynamic by insisting on consumer (or producer) willpower. You've got to enforce a floor. In other consumer (and industrial) products, this has tended to happen through the combined mechanisms of strict liability, certification, and independent inspection (in specific cases). Where manufacturers, or as…

Ma Bell was leasing telephones since the days of Alexander Graham Bell. In fact you weren't allowed to use any telephone except one leased from your telco until the breakup of the Bell System in the 80s.

Not sure that is what we want to go back to.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#200

Post by [deleted] »

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

[deleted]
Post reply on HN